Blog · Law
Medical record retrieval services for law firms: what to hand off
What medical record retrieval services for law firms take over, what the firm still owns, and how to split intake, follow-up, review and trial prep.
By Tavrn Team · · 4 min read
Summarise with ChatGPT, Claude or Perplexity
Medical record retrieval services for law firms take over the request work. They send each provider the authorization, follow up, and deliver the records. The firm keeps what a vendor cannot own: a valid authorization [1], the choice of legal path, review of what arrives, and supervision of the vendor under the ethics rules [2].
What the service handles and what the firm keeps
A retrieval service does the repeat work on every request. The firm keeps the decisions. The table splits the work task by task.
Task | Retrieval service | Your firm |
|---|---|---|
Authorization | Checks it for missing elements before it goes out | Gets the client to sign a complete form [1] |
Provider list | Finds the right records contact at each provider | Supplies provider names, locations and dates of service from intake |
Scope | Sends the request as written | Decides which records, bills and images to ask for |
Follow-up | Chases each open request until it closes | Steps in when only the client can answer a question |
Review | Delivers records as each provider responds | Checks the file against the dates of service |
Trial use | Can ask the provider for a custodian certification | Decides what to offer and gives notice [8] |
Supervision | Follows the firm's written instructions | Makes reasonable efforts to keep the work in line with its duties [2] |
The split matters most at the edges. A service can chase a provider for weeks. It cannot decide that a missing visit does not matter to the case.
Your ethics duties stay with the firm
Handing off retrieval does not hand off responsibility. The ABA's comment to Model Rule 5.3 covers outside services directly. It says: "When using such services outside the firm, a lawyer must make reasonable efforts to ensure that the services are provided in a manner that is compatible with the lawyer's professional obligations." [2]
The comment lists what shapes that duty. One factor is "the terms of any arrangements concerning the protection of client information" [2]. It also says a lawyer "should communicate directions appropriate under the circumstances" [2].
In practice, that means three things:
- Put your instructions in writing: scope, who at the firm approves changes, and where records go.
- Know who at the vendor can open a client file.
- Keep the vendor's security documents and any BAA in the matter file.
Check your state's version of the rule.
What the service needs from you at intake
A request is only as good as the intake behind it. HIPAA lists the core elements of a valid authorization [1]. They include:
- A specific description of the information to be disclosed.
- Who may disclose it, and who may receive it.
- A description of each purpose.
- An expiration date or event.
- The patient's signature and the date.
A form is not valid if the expiration date has passed. It is also not valid if it "has not been filled out completely" [1]. Catch both before the request goes out.
Ask for bills as well as charts. HIPAA defines a provider's designated record set to include "the medical records and billing records about individuals" [3]. Name both on the request so neither is missed.
Which legal path the request takes
The firm picks the legal path. The service carries it out. Each path has its own paperwork and timing.
Path | What the provider needs | Timing |
|---|---|---|
Patient access request | A request from the patient, in writing if the provider requires it [4] | 30 days, plus one 30-day extension [4] |
Authorization | A valid authorization with every core element [1] | No federal deadline [4] |
Subpoena without a court order | Satisfactory assurance of notice to the patient or of a qualified protective order [5] | Set by the subpoena and court rules |
Court order | The order itself; the provider discloses only what it expressly allows [5] | Set by the order |
HIPAA's access rule allows 30 days plus one 30-day extension (45 CFR 164.524); requests under an authorization have no federal deadline [4]. That is why follow-up matters so much on authorization requests.
In federal court, a documents subpoena has one more step. Before it is served, "a notice and a copy of the subpoena must be served on each party" [6]. Tell your service which path each request is on, so it sends the right papers.
Checking the file when records arrive
A delivered file is not always a complete file. Review it against what the client told you at intake:
- Match every date of service to a record.
- Match the bills to the visits.
- Check that imaging reports and images both arrived, if you asked for both.
- Get a written statement when a provider says it has no records.
- Ask the service for its outreach history on any request that took longer than expected.
Gaps found early are easier to close. Send the service a follow-up request for the missing dates while the provider contact is still fresh.
Records you plan to use at trial
Some records need more than a copy. Under the Federal Rules of Evidence, records offered as business records must meet Rule 803(6), the exception for records of a regularly conducted activity [7]. The foundation can be shown by a custodian's testimony or by a certification that complies with Rule 902(11) [7].
Rule 902(11) adds a notice step. Before trial, "the proponent must give an adverse party reasonable written notice of the intent to offer the record" [8]. The record and certification must also be available for inspection [8].
If you need a certified copy, tell your service when the request goes out. Asking the provider again later adds another round of waiting. In state court, check the state's evidence code.
Where Tavrn fits
Tavrn requests, follows up and delivers medical records, bills and imaging from any US provider. Firms can start requests from Litify, SmartAdvocate, Clio, Smokeball, SharePoint or Dropbox.
Every open request is followed up automatically every 48 hours, and you see per-provider status and provider-stated dates live. Every outreach attempt on a request is logged.
Tavrn handles protected health information under HIPAA; a BAA is available on request. The details are on the security page.
What to do next
Write down which tasks your firm keeps and which ones you hand off, using the table above. Then test any service against your last ten matters. To see how Tavrn handles them, read about Tavrn for law firms.
Sources
- 45 CFR 164.508 - Uses and disclosures for which an authorization is required — eCFR
- Rule 5.3 Responsibilities Regarding Nonlawyer Assistance - Comment — American Bar Association
- 45 CFR 164.501 - Definitions — eCFR
- 45 CFR 164.524 - Access of individuals to protected health information — eCFR
- 45 CFR 164.512 - Uses and disclosures for which an authorization or opportunity to agree or object is not required — eCFR
- Rule 45. Subpoena — Legal Information Institute, Cornell Law School
- Rule 803. Exceptions to the Rule Against Hearsay — Legal Information Institute, Cornell Law School
- Rule 902. Evidence That Is Self-Authenticating — Legal Information Institute, Cornell Law School
