7 Ways QME Practices Can Reduce Local Copies of Claimant Records

A record can leave the secure portal once and remain on a workstation for months.

A QME coordinator downloads a 2,400-page record set before an evaluation. The physician receives another copy. A reviewer saves selected exhibits to a desktop folder. Supplemental records arrive by email two days later. By the time the report is signed, the practice may have five or six local versions of the same claimant file.

That is where the exposure grows.

Medical record review depends on access to detailed clinical information. For a Qualified Medical Evaluator (QME) practice, those files may contain diagnoses, medications, imaging, mental health notes, employment information, and other sensitive data. HHS explains that the HIPAA Security Rule applies administrative, physical, and technical safeguards to electronic protected health information, or ePHI, maintained or transmitted by regulated entities.

The practical goal is not to prevent every authorized use of a record. It is to reduce unnecessary copies, keep necessary copies under defined controls, and document what happens when the work ends. The following seven changes give QME practices a workable place to start.

Why local copies multiply during QME medical record review

Local copies usually appear because someone is trying to keep the evaluation moving. Large PDFs open slowly. Staff want an offline backup. A reviewer extracts a smaller working set. Counsel sends a late report as an attachment. None of those actions feels unusual on its own.

The problem appears later, when the practice cannot answer three plain questions: Where is the claimant file now? Who can open it? When will each working copy be removed?

NIST advises organizations handling ePHI to protect the information they create, receive, maintain, or transmit against reasonably anticipated threats and impermissible uses or disclosures. For a QME office, that calls for a workflow that follows the record after intake, including downloaded and exported copies.

1. Keep the master record set in one approved case workspace

The master record set should remain in the approved case environment whenever the review task can be completed there. Staff can then work from the same source instead of building separate desktop folders.

This also reduces version confusion. If a corrected report or late diagnostic study arrives, the case coordinator has one place to associate it with the evaluation. The physician is less likely to review an older folder without the supplemental material.

Before selecting a workspace, verify the actual controls. Ask whether access can be limited by case, whether activity is logged, whether links expire, and whether downloaded exports can be restricted. A polished login screen does not answer those questions.

2. Replace routine downloads with view-first review

View-first review means opening the record inside the approved workspace before deciding that a local copy is necessary. The rule is modest: do not download by default.

Some tasks will still require a working copy. A physician may need records during an approved offline review period, or a source document may need to be included in a defined reporting workflow. Record the reason, the device, the owner, and the expected deletion date. That small pause turns an invisible copy into an accountable one.

3. Use case-specific access instead of broad shared folders

A QME staff member should receive access based on the case and assigned task. A scheduling coordinator may need the appointment documents but not the complete clinical record. A reviewer may need the record set but not unrelated evaluations stored in the same drive.

HHS identifies access controls, unique user identification, audit controls, authentication, and transmission security among the technical safeguards for ePHI. The exact configuration depends on the practice and its systems, but shared credentials make accountability difficult. If three people use one login, the access log cannot reliably show which person opened the file.

4. Create a controlled method for supplemental records

Supplemental records often bypass the original intake route. They arrive in a reply chain, through a second portal, or as a link sent to one coordinator. That creates a parallel file path.

Route supplemental material back into the existing case workspace. Label the receipt date, source, page range, and review status. Then notify the assigned reviewer from the case system rather than forwarding the file itself. If the updated material must be downloaded, apply the same ownership and deletion rule used for the original records.

5. Turn off automatic syncing for folders that receive claimant records

A file saved to one workstation may be copied automatically to a personal cloud account, a mobile device, or another computer signed into the same sync service. The person may never realize that extra copies exist.

Check the Downloads folder, desktop sync settings, email attachment cache, browser download history, backup folders, and shared-drive shortcuts on every device used for QME record review. The task belongs in the practice's device and media policy, not in an informal reminder sent after a problem.

Remote work needs the same check. HHS maintains specific guidance on remote access and mobile-device use for ePHI, which should be considered alongside the practice's own risk analysis and policies.

6. Set a retention rule for working copies before review starts

A deletion rule should distinguish the official record that must be retained from temporary copies created for review. Do not erase records simply because the report has been served. QME practices may have retention duties under California rules, professional requirements, contracts, litigation holds, or other applicable law.

California's Division of Workers' Compensation rules include requirements concerning medical-legal documents and electronic service. The exact retention obligation must be confirmed for the practice and matter.[4] Once that is clear, assign a disposition date to temporary downloads, extracted exhibits, draft bundles, and duplicate attachments.

HHS guidance also addresses disposal and media reuse for PHI. Deleting a shortcut or moving a file to the Recycle Bin may not complete the approved disposal process. The practice's information-security lead or qualified adviser should define the method for each device and storage location.

7. Verify deletion instead of relying on memory

A policy that says staff should delete local files is only the beginning. The QME practice needs a check that shows the task occurred.

Use a case-close checklist with the person responsible, the locations checked, the completion date, and any exception. Include physician laptops, reviewer workstations, shared folders, removable media, email attachments, exported report folders, and approved backups. If a copy must remain, document why, where it is held, who can access it, and when the need will be reviewed again.

A practical example from an evaluation workflow

A published LezDo TechMed case study described an IME firm that had relied on email, shared drives, and physical copies. The firm reported document-tracking delays and version-control problems. Moving case submission, file sharing, status tracking, and delivery into CaseDrive gave the team a centralized workflow.

The example concerns an IME practice, but the operational lesson applies to QME offices as well. Centralization does not remove the need for local-copy rules. It makes the exceptions easier to see. When a file leaves the controlled case environment, the practice can ask who needed it and when it should be removed.

Questions to ask during the next workflow review

• Which QME tasks currently require a download?

• Can those tasks be completed with view-only or in-workspace access?

• Which devices automatically sync the Downloads or Desktop folders?

• Are supplemental records returned to the original case workspace?

• Can the practice identify the person behind each access event?

• What official records must be retained, and which files are temporary working copies?

• Who confirms deletion at case close, and where is that confirmation recorded?

The bottom line

A QME practice does not need a ban on every local file. It needs fewer unnecessary copies and clear control over the copies that remain.

Start with the Downloads folder. Then check email attachments, synced desktops, shared drives, and supplemental-record handoffs. Each location should have an owner, a permitted purpose, and a disposition rule that accounts for applicable retention duties.

Medical record review is easier to manage when the record has one recognized home. If a claimant file leaves that home, the practice should be able to explain where it went, who used it, and what happens next.

The same level of scrutiny should also extend to the vendors who handle your medical records. If you are evaluating whether your current medical record review provider follows the security, compliance, and document-handling practices your cases require, read our blog, "Is Your Medical Record Review Vendor Compliant? Find Out Now." It outlines the key questions to ask before entrusting sensitive medical records to any review partner.

Source Credit

U.S. Department of Health and Human Services,  

California Division of Workers' Compensation, QME Regulations