Six weeks after one of your physicians stood up mid-cabin and said "I'm a doctor," an airline's claims adjuster emails your practice asking for "all documentation related to the incident." Your privacy officer starts looking and finds four artifacts: a photo of a drug packaging label on a practice-issued iPhone, a dictated note that got filed into your EHR under a patient who is not your patient, a text thread with a ground-based medical advisory service, and a scanned napkin in someone's desk drawer. That is what a flight emergency looks like from the records side. This article is about classifying those artifacts, setting a defensible retention clock, and destroying them on schedule.

No clinical guidance here. The question on the table is administrative: what did your organization create or receive, does it belong to you, how long must you hold it, and who shreds it.

What Actually Lands in Your Systems After a Flight Emergency

Practices are surprised by the volume. An encounter that happened at 35,000 feet with no chart, no consent form, and no billing still generates a paper trail because modern clinicians document reflexively and carry practice-owned devices.

Inventory what typically shows up:

  • Handwritten notes the clinician transcribed after landing, sometimes onto practice letterhead.
  • Photographs on a practice-issued or MDM-enrolled personal phone — medication packaging, a monitor screen, a wound.
  • Text messages or a call log with the airline's contracted ground medical support.
  • An incident form or statement the airline requested, often emailed to a work address.
  • A dictation that a scribe or transcriptionist routed into your EHR because that is where dictations go.
  • Later, inbound records: an air ambulance run sheet, an emergency department summary, or a request from a plaintiff's attorney.

Every one of those items is identifiable health information about a person. Whether it is your PHI under HIPAA depends on the next section — but every item is discoverable, and every item is a breach exposure until it is either governed or gone.

Does a Flight Emergency Record Belong to Your Designated Record Set?

Split the analysis into two fact patterns. Your policy should name both, because the retention clocks differ.

Fact Pattern One: Your Clinician Volunteered as a Good Samaritan

When a physician responds to a call for help aboard a commercial aircraft, they are generally not delivering care as your covered entity's workforce. Nobody scheduled the encounter, your practice does not bill it, and the Aviation Medical Assistance Act shapes the liability picture for volunteer responders. In that posture, the record is not part of your designated record set and the passenger is not your patient for access-and-amendment purposes.

That analysis collapses the moment the artifact enters your infrastructure. A photo synced to your practice cloud tenant, a dictation sitting in your EHR, a statement drafted on a work laptop — those live inside systems you certified in your risk analysis. If they leak, they leak from you, and OCR will not spend much time on whether the encounter was technically extramural. Your obligation is custodial: protect it under the Security Rule while you hold it, and hold it no longer than a written rule says you may.

Fact Pattern Two: The Records Come to You for Treatment

Different story when an established patient of yours has a flight emergency and the downstream records flow in — an air medical transport run sheet, a receiving hospital's discharge summary, records forwarded by an airline's medical services contractor. Once you receive those to make decisions about that patient, they are part of the designated record set, subject to the right of access, the 30-day response clock, and your standard chart retention schedule. Do not create a separate "travel incident" folder outside the chart. Segregated stashes are how practices miss records requests.

How Long Do You Keep Flight Emergency Records?

Short answer, and the one your board will ask for:

HIPAA sets no medical record retention period. HIPAA requires six years of retention for documentation the rules themselves demand — policies, procedures, risk analyses, business associate agreements, and disclosure accountings — measured from creation or from the date last in effect, whichever is later (45 CFR 164.316(b)(2)(i)). Chart retention is governed by state law, payer contracts, and Medicare requirements. For a flight emergency record, apply the longest applicable clock: your state's chart retention rule, any minor-patient tolling rule, Medicare and managed care record requirements that can run ten years on contract-related documentation, and any litigation hold, which overrides every scheduled destruction date.

Two clocks then, running side by side. The content clock governs the note, photo, or run sheet. The compliance clock governs everything you generated about handling it: the incident memo, the accounting-of-disclosures entry if you released it to an airline or insurer, and the destruction certificate. That second bucket is a flat six years under 164.316(b)(2)(i), and it is the bucket practices forget.

The HHS overview of the Privacy Rule and its supporting regulations is worth keeping bookmarked for the citation, and 45 CFR 164.528 sets the six-year window for accounting of disclosures — relevant the moment you send anything to an airline, an insurer, or an attorney under a valid authorization or legal process.

A Worked Retention Clock

Make it concrete. Assume an incident on March 14, 2026, and a state rule requiring adult charts be held seven years from the date of last service.

  1. Passenger is not your patient (volunteer response). No treatment relationship, no chart. Your policy should require the artifacts be consolidated into one access-restricted location within 5 business days, retained only while a claim is reasonably foreseeable, and destroyed on a date certain. Many practices pick the outer bound of their state's negligence statute of limitations plus one year and put the destruction date in writing on the day the file is opened. Destroy date recorded: March 14, 2026 plus that interval.
  2. Patient is yours, records received for treatment. The run sheet and hospital summary merge into the chart. Destruction date rides with the chart: seven years after the last date of service, not seven years after the flight.
  3. The disclosure log. You released a copy to the airline's insurer on April 22, 2026 under a signed authorization. Retain the authorization and the log entry until April 22, 2032.
  4. The incident memo and legal analysis. Six years from creation, aligned with your 164.316(b)(2) documentation schedule.
  5. Litigation hold. If counsel issues a hold on April 3, 2026, every date above freezes. Nothing gets destroyed, including the phone photos, until counsel releases the hold in writing. Log the release. Then recompute.

Assign owners, not departments. In a ten-provider group this usually reads: privacy officer opens and closes the file, practice manager runs the quarterly destruction cycle, IT handles device and mailbox sanitization, and the responding clinician signs an attestation that no copies remain on personal accounts.

Secure Destruction: The Standard You Cite and the Vendor You Sign

The Security Rule requires policies for the disposal of PHI and the media it lives on (45 CFR 164.310(d)(2)(i)-(ii)). HHS guidance on what HIPAA requires when disposing of information is blunt about the failure mode: PHI left in dumpsters, unlocked bins, or on retired hardware. For electronic media, cite NIST SP 800-88 Rev. 1 and pick your method per media type — clear, purge, or destroy — then keep the sanitization record.

Flight emergency artifacts are unusually media-diverse, which is exactly why they slip through a paper-only destruction policy. Your checklist should cover each:

  • Paper — cross-cut shredding or a locked-bin vendor pickup with a certificate of destruction naming the date and method.
  • Phone photos — deletion plus verification that the image is out of the cloud photo library, the recently-deleted folder, and any backup snapshot within its retention window.
  • Email and text — purge from the mailbox and the journal or archive tier; confirm your retention policy in the mail platform actually enforces the deletion rather than merely hiding the item.
  • EHR entries — most systems will not hard-delete. Document the sequestration or restriction method your vendor supports, and note it in the destruction log rather than pretending the record is gone.
  • Retired hardware — purge or destroy per NIST, with serial numbers on the certificate.

Your Shredding Vendor Is a Business Associate

A document destruction company that takes custody of PHI performs a function on your behalf and is a business associate. So is an off-site storage company holding boxed charts, and so is a ground-based medical advisory service that handles identifiable information for you. If the flight emergency file is the first time you have looked hard at who touches PHI on the way out the door, expect gaps — most practices have a shredding contract signed by an office manager years ago with no BAA attached.

Close that gap before your next destruction cycle. You can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — which is faster than chasing a vendor's legal department for a template you will end up rewriting anyway. Send it with the next pickup schedule and get it countersigned.

The Artifact Nobody Governs: The Personal Phone

The single most common finding in a flight emergency file review is a photograph on a clinician's personal device. It is not in your EHR, not in your backup, not in your inventory — and it is PHI in your workforce member's custody.

Handle it procedurally, not by scolding. Your policy should state that any image or note captured during a volunteer emergency response is transferred to the designated practice location within a set window, then deleted from the originating device with an attestation. Add the attestation form to your incident packet so the clinician signs it while the memory is fresh. Then confirm the deletion propagated to whatever cloud photo service the phone syncs to, because that is where these things quietly survive.

If your BYOD policy does not currently contemplate off-site, unbilled encounters, add a paragraph. Reviewing the pattern of small, avoidable exposures reported to OCR through the HHS breach reporting portal is a quick way to make the case internally that stray images and improper disposal are real categories, not hypotheticals.

Build the Packet Before You Need It

Practices that handle this well have a one-page intake packet sitting in a shared folder. It contains:

  1. An incident intake form — date, flight, responding clinician, whether the passenger is an established patient.
  2. A classification decision box — designated record set, yes or no, with the privacy officer's initials.
  3. An artifact inventory with location and media type for each item.
  4. The computed destruction date, entered the day the file opens.
  5. A device attestation for the responding clinician.
  6. A disclosure log for anything released to airlines, insurers, or counsel.
  7. A slot for the vendor certificate of destruction.

Ten minutes of setup converts an ambiguous event into a governed file with an end date. Without it, the artifacts sit in four places for six years, get missed in your next risk analysis, and surface during discovery in a form you cannot explain.

If your broader document set needs the same treatment — retention schedule, disposal policy, risk analysis, workforce attestations — automating the compliance document set gets you a consistent baseline you can then tailor to your state's chart rules. Start with the shredding and storage vendors, though: get the BAAs executed before the next bin goes out, and record the certificate when it comes back.