How to compare vendors for retrieving outside records

To compare options for retrieving outside records for hospitals and surgical practices, use one test set. Check how each channel finds outside providers. Ask whether it delivers files as well as reports and records each follow-up. Compare exchange networks, portals, direct requests, and retrieval services against the same record list.

Start with the record set

Start with the care task, not a channel's label. List the outside sites, document types, date range, and the people who will review the returned records. Mark whether the team needs a report, the original image files, or both. Use the same request list when you compare each route.

A 2005 study covered 1,614 primary-care visits in 32 clinics. Clinicians reported missing clinical information in 13.6% of visits. In 52.3% of these reports, clinicians believed the information was outside their clinical system but within the United States. [3] This was a study of selected clinics, not a national estimate. [3] Use it as context for the work of finding outside information, not as a measure of any one channel.

For a surgical consult or pre-op review, make the request list explicit. Ask the care team whether it needs outside images, imaging reports, operative notes, pathology reports, and medication lists. Do not treat a report as a substitute for the image files if the care team needs to review the images.

A 2017 retrospective study at one trauma center examined 370 transferred patients who had CT scans. Seventy-four patients (20.0%) had a CT repeated; outside CT images were unavailable in 31 of those 74 cases (42%). [4] Those results describe one trauma-center cohort, not every surgical practice. [4] They do show why image availability and image readability belong in a retrieval test. [4]

The 2005 systematic review covered 22 studies and 3,755 patients. It found prescription medication-history errors in up to 67% of cases. [5] When medication lists matter to the visit, ask how the request captures the current list and its source date. The review does not establish that any retrieval channel prevents those errors. [5]

Compare the channel, not the label

Use a shared set of provider locations and record types to compare routes. Ask the same questions about coverage, follow-up, file delivery, and traceability for each.

TEFCA's public page says, “TEFCA is designed to support exchange for any purpose, but that purpose must be indicated in each request for data.” [1] For your evaluation, ask whether a specific provider participates and whether the requested image is available through the route.

In 2025, 76% of U.S. non-federal acute care hospitals engaged in all four measured exchange domains: sending, receiving, finding, and integrating information. [2] That measure describes hospital activity across the four domains. [2] It does not tell you whether a particular outside provider has a specific patient's image or note. [2] Check for that provider and record type in your own evaluation.

Use one checklist for every option

Write down the answer for each channel or service. A checklist makes gaps visible before they become a handoff problem.

1. Coverage outside networks: Which outside hospitals, clinics, imaging centers, and surgical practices can the route reach when they are not available through an exchange network? What does the team do when a provider is not covered?
2. Images and reports: Can the route return original image files as well as the radiology report? Which file types and related notes can it deliver? How does the recipient know that all requested parts arrived?
3. Follow-up cadence: Who owns follow-up after the first request? What is the planned cadence for unanswered, incomplete, or misrouted requests? What happens when the provider asks for a correction or more information?
4. Delivery into existing work: Can the records reach the EHR, an approved SFTP location, or an API? Ask which file types, patient identifiers, and status details arrive with the files. Name the person who will confirm that the destination is correct.
5. Outreach audit log: Ask for a log that shows each outreach attempt, its date, destination, channel, response, and next action. Ask how the team can review an exception or confirm that a requested provider was contacted.
6. Privacy and security review: Ask whether the service acts as a business associate, whether it will enter a business associate agreement (BAA), and what security materials are available for review. If you use a SOC 2 report in your review, check its scope, period, and noted exceptions with your security team.

Confirm the legal basis for each request

Separate a treatment disclosure from an individual's access request or a use that needs a valid authorization. Under 45 CFR 164.506(c)(2), “A covered entity may disclose protected health information for treatment activities of a health care provider.” [6] Section 164.508(a)(1) gives the general rule for authorization, except where another part of the HIPAA rules permits or requires the use or disclosure. [7] Ask privacy counsel which route applies to the request, who is making it, and what records it covers.

An individual's access request follows a different rule. Under 45 CFR 164.524(b)(2), the covered entity must act on the request no later than 30 days after receiving it. [8] The rule allows one extension of no more than 30 days when its conditions are met. [8] This is a deadline for a covered entity's response to an individual's access request. [8] It is not a schedule for a provider-to-provider request or a retrieval service.

Under 45 CFR 164.504(e)(2)(i), the contract must state the business associate's allowed and required uses and disclosures of protected health information. [9] Ask how the BAA describes the work, who may handle the records, and how the service documents the request path. Bring state-law and facility-policy questions to the privacy team rather than assuming one rule covers every situation.

Where Tavrn fits

Tavrn retrieves medical records from any US provider: one authorization in, complete record out, via platform, integration or API. In Tavrn's own analysis, networks, records vendors and portals return about 63% of a patient's visits. Separately, 37% of a patient's record sits outside every network and portal combined. For coverage outside networks, Tavrn requests the rest from each provider by fax, mail, email and phone.

For follow-up cadence, every open request is followed up automatically every 48 hours. For the outreach audit log, every outreach attempt on a request is logged. For the BAA review, Tavrn handles protected health information under HIPAA; a BAA is available on request.

What to do next

Use the same record list and checklist with your HIM, clinical operations, and privacy teams. Read about hospitals and clinics or book a demo.

Sources

1. Trusted Exchange Framework and Common Agreement (TEFCA) — Office of the National Coordinator for Health Information Technology, 2026-09-03
2. Electronic Health Information Exchange by Hospitals — Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology, 2026-02-11
3. Missing clinical information during primary care visits — JAMA, 2005
4. Rate and Reasons for Repeat CT Scanning in Transferred Trauma Patients — The American Surgeon, 2017
5. Frequency, type and clinical importance of medication history errors at admission to hospital: a systematic review — CMAJ, 2005
6. 45 CFR 164.506 — Uses and disclosures to carry out treatment, payment, or health care operations — Electronic Code of Federal Regulations, 2026-10-22
7. 45 CFR 164.508 — Uses and disclosures for which an authorization is required — Electronic Code of Federal Regulations, 2026-10-22
8. 45 CFR 164.524 — Access of individuals to protected health information — Electronic Code of Federal Regulations, 2026-10-22
9. 45 CFR 164.504 — Uses and disclosures: Organizational requirements — Electronic Code of Federal Regulations, 2026-10-22