Blog · Technology
Hospital release-of-information outsourcing: how to compare options
How to judge hospital release-of-information outsourcing, including newer automated and AI-based services, against HIPAA's access clock, the BAA, Part 2 records and disclosure logs.
By Tavrn Team · · 5 min read
Summarise with ChatGPT, Claude or Perplexity
Hospital release-of-information outsourcing works when the vendor can meet your HIPAA duties, not just your queue. Compare vendors, including newer AI-based services, on four things. Can they meet the 30-day access clock [1]? What does the business associate agreement let them do with records [2]? How do they handle substance use disorder records [3]? What do they log [4]?
What release of information covers
Release of information (ROI) is the work of answering requests for a patient's records. Each request type follows a different rule. A vendor has to sort requests by type at intake, because the clock and the checks change.
Request type | Rule | Deadline | What intake must check |
|---|---|---|---|
Patient's own access request | 45 CFR 164.524 [1] | 30 days, plus one extension of up to 30 days with written notice [1] | Form and format requested [1] |
Patient-directed copy to a third party | 45 CFR 164.524(c)(3) [1] | Same as access [1] | Signed in writing; names the recipient and where to send it [1] |
Disclosure under an authorization | 45 CFR 164.508 [6] | No federal deadline | Core elements present; not expired or revoked [6] |
Substance use disorder program records | 42 CFR 2.31 [3] | Set by the request type | Consent elements under Part 2 [3]; required notice sent with the records [7] |
Three ways to run ROI
Most hospitals pick one of three models. The choice decides who touches the records and who you have to audit.
Model | Who processes requests | Who handles PHI for you | What stays with the hospital |
|---|---|---|---|
In-house | Hospital HIM staff | No outside party | All of it |
Full outsourcing | Vendor staff, on site or remote | The vendor, as a business associate [5] | Policies, oversight and the access duty [1] |
Software or automation from a vendor | Hospital staff, helped by vendor tools | The vendor, if its tools store or send records [5] | The work, plus vendor oversight |
The access duty does not move with the work. HIPAA says "the covered entity must act on a request for access no later than 30 days after receipt of the request" [1].
What the business associate agreement must say
An ROI vendor that handles records on your behalf is a business associate [5]. HIPAA sets the terms its contract must contain [2]. Read these clauses first:
- Permitted uses. The contract must establish what the vendor may do with the records [2]. The vendor must agree not to "use or further disclose the information other than as permitted or required by the contract or as required by law" [2].
- Access and accounting. The vendor must make records available for access requests and supply what you need for an accounting of disclosures [2].
- Acting for you. If the vendor carries out one of your HIPAA duties, it must follow the rules that apply to you for that duty [2].
- Subcontractors. Any subcontractor that handles the records must agree to the same restrictions [2]. HHS says those downstream subcontractors are also business associates [5].
- Termination. At the end of the contract, the vendor must return or destroy the records if it can [2].
Questions for automated and AI-based services
Newer services add software to intake, review and delivery. The rules do not change. Ask each vendor to show how its tools apply them.
- Authorization checks. An authorization is not valid if it has expired, is missing a core element or has been revoked [6]. Ask how the tool flags each defect and who reviews the flag.
- Psychotherapy notes. HIPAA requires an authorization for any use or disclosure of psychotherapy notes, with narrow exceptions [6]. Ask how the tool finds them and holds them back from a general release.
- Part 2 records. A written Part 2 consent must name the patient and the recipient [3]. It must describe the information "in a specific and meaningful fashion" [3]. Each disclosure under that consent must carry a written notice of the Part 2 rules [7]. Ask how records from a Part 2 program are tagged and routed.
- Model training. Ask whether the contract lets the vendor use your records to train or tune models. If it does not say, the vendor may only use records as the contract permits [2].
- Model providers. If the service sends records to an outside AI provider, that provider is a subcontractor. It must agree to the same restrictions [2].
- Human review. Ask which steps a person checks before records leave, and how errors are corrected.
Measure the vendor against the clock
Ask for turnaround data by request type, not one average. A 2018 study of 83 top-ranked US hospitals called their records departments as a simulated patient [8]. Of 81 hospitals that gave release times, 6 gave ranges past their state's deadline [8].
The same study found forms that did not match what staff said. Only 44 hospitals (53%) offered the entire record on their forms. All 83 said by phone that they could release it [8]. A vendor that runs your forms should keep them current and in line with policy.
OCR has made timely access an enforcement priority. It announced its Right of Access Initiative in 2019 [9]. The aim was "to support individuals' right to timely access to their health records" [9].
Logs, accounting and records retention
Patients can ask for an accounting of disclosures made in the six years before the request [4]. That accounting must include disclosures to or by business associates [4]. Some disclosures are left out. Two examples are releases to the patient and releases under an authorization [4].
For each listed disclosure, the accounting needs the date and who received the records [4]. A vendor's logs should capture both, along with what was sent. Your HIPAA documentation must be kept for six years from the date it was created, or the date it was last in effect if later [10]. Confirm the vendor's logs and your copies will last that long.
Where Tavrn fits
ROI is about records leaving your hospital. Your care teams also need records coming in from other providers. Tavrn works on that side. It serves teams that need outside medical records to do their work: health systems and clinics, clinical research sites, healthcare startups, insurers, and law firms [11].
Tavrn handles protected health information under HIPAA; a BAA is available on request [11].
What to do next
Score each ROI option against the tables above before you sign. To see how Tavrn brings outside records into your hospital, read Tavrn for hospitals and clinics.
Sources
- 45 CFR 164.524 - Access of individuals to protected health information — eCFR
- 45 CFR 164.504 - Uses and disclosures - organizational requirements — eCFR
- 42 CFR 2.31 - Consent requirements — eCFR
- 45 CFR 164.528 - Accounting of disclosures of protected health information — eCFR
- Business Associates (HIPAA guidance) — U.S. Department of Health and Human Services, Office for Civil Rights
- 45 CFR 164.508 - Uses and disclosures for which an authorization is required — eCFR
- 42 CFR 2.32 - Notice and copy of consent to accompany disclosure — eCFR
- Assessment of US Hospital Compliance With Regulations for Patients' Requests for Medical Records — JAMA Network Open (Lye et al.), 2018-10-05
- OCR Settles Five More Investigations in HIPAA Right of Access Initiative — U.S. Department of Health and Human Services, Office for Civil Rights
- 45 CFR 164.530 - Administrative requirements — eCFR
- Medical record retrieval FAQ — Tavrn
