Blog · Law
Medical records copy services: what they do and how to choose
What medical records copy services do, who they work for, which HIPAA rules govern each release, and what to ask before you send one a request.
By Tavrn Team · · 5 min read
Summarise with ChatGPT, Claude or Perplexity
Medical records copy services copy patient records and send them to the person allowed to receive them. Some work for the hospital or clinic and answer its record requests. Others work for the requester, such as a law firm or insurer. Either way, each release still needs a legal basis, most often a signed HIPAA authorization [1].
Two kinds of copy service
The first question is who the service works for. That decides what it controls and which rules bind it.
A provider-side copy service runs release of information for a hospital or clinic. HIPAA calls a person who handles protected health information on behalf of a covered entity a business associate [2]. HHS says a covered entity may share that information with a business associate if it gets written assurances, in a business associate agreement, that the vendor will protect it [3]. The vendor works the provider's request queue under the provider's rules.
A requester-side service works for the party that needs the records. That could be a law firm, an insurer, a clinic chasing outside records, or a research site. It prepares the request, finds the right records custodian, sends the request, follows up and delivers the records. It does not control the provider's queue. Its value is in getting a complete, correct request into that queue and keeping it moving.
Question | Provider-side copy service | Requester-side retrieval service | Your own staff |
|---|---|---|---|
Works for | The hospital or clinic | The law firm, insurer or other requester | You |
Controls | Processing and release at that provider | Request quality, routing and follow-up | Request quality and follow-up |
HIPAA role | Business associate of the provider | Acts on your request and the authorization | Depends on your organization |
Covers many providers | No, only its own clients | Yes | Yes, one request at a time |
What you can see | What the provider shares back | Status across every provider on a matter | What your team tracks by hand |
Many requests touch both kinds. A law firm's retrieval service sends the request, and a provider-side vendor at the hospital processes it.
What a request needs before any copy is made
A copy service cannot fix a bad authorization. HIPAA lists the core elements a valid authorization must contain [1]:
- A description of the information to be disclosed, in "a specific and meaningful fashion."
- Who may make the disclosure.
- Who may receive the records.
- The purpose of each disclosure. "At the request of the individual" is enough when the patient starts the request.
- An expiration date or expiration event.
- The patient's signature and the date. A personal representative must describe their authority to act.
The form must also tell the patient of their right to revoke it in writing [1]. A provider must treat an authorization as invalid if the expiration date has passed, if a required element is left blank, if it knows the form was revoked, or if it knows material information on the form is false [1]. Check for each one before a request goes out.
Three legal routes to the same records
Most third-party requests use an authorization, but it is not the only route. Each one runs on different rules.
Route | Who starts it | What the provider needs | Rule |
|---|---|---|---|
HIPAA authorization | Patient signs; you send | A valid form with every core element | 45 CFR 164.508 [1] |
Patient's access request | The patient | A request from the patient; timing rules apply | 45 CFR 164.524 [4] |
Subpoena without a court order | The party in the case | Satisfactory assurance of notice or a qualified protective order | 45 CFR 164.512(e) [6] |
The patient's own access request
Under the access rule, a provider must act on a patient's request no later than 30 days after it receives it [4]. It may take one extension of up to 30 more days if it tells the patient the reason in writing [4]. The patient can also direct the copy to someone else. That request must be in writing, signed by the patient, and clearly identify the person and where to send the copy [4].
That third-party route is narrower than the text of the rule suggests. In 2020, a federal court in Ciox Health v. Azar limited it to "a copy of an electronic health record ... in an electronic format," HHS says in its notice on the ruling [5]. Under that ruling, a patient's request to send paper records to a third party falls outside this route.
Subpoenas and court orders
A provider may release records under a court order, limited to what the order covers [6]. A subpoena without a court order needs more. The provider must get satisfactory assurance that the patient was given notice, or that the parties sought a qualified protective order [6]. For notice, that means a written statement showing a good-faith attempt to notify the patient, enough detail about the case to object, and that the time to object has passed with no objection pending [6]. In federal cases, a person answering a subpoena must produce documents as they are kept in the ordinary course of business, or organize and label them to match the request [7].
What to ask a copy service before you use it
The questions differ by side, but they come down to completeness, follow-up and security.
- Who do you work for? A provider's vendor answers to that provider. A retrieval service answers to you.
- How do you find the right custodian? Records for one patient often sit with several facilities, billing offices and imaging centers.
- How often do you follow up? Ask for a fixed cadence, not "as needed."
- What do I see while I wait? Per-provider status matters more than one matter-level date.
- How is the data protected? Ask about encryption, sign-in and how outreach is logged.
- How do records come back? Into your case management system, a secure download, or a file transfer.
Where Tavrn fits
Tavrn is a requester-side medical record retrieval service. Tavrn retrieves medical records from any US provider: one authorization in, complete record out, via platform, integration or API [9]. To start, Tavrn needs a signed patient authorization and what you know about the provider: name, location, and the dates of service if you have them [8].
Requests go to the provider the same day, and every open request is followed up automatically every 48 hours [9]. Firms can start requests from Litify, SmartAdvocate, Clio, Smokeball, SharePoint or Dropbox [9]. Tavrn handles protected health information under HIPAA; a BAA is available on request [8]. Records are encrypted at rest and in transit, and every outreach attempt on a request is logged [8].
What to do next
Check your authorization form against the six core elements before the next request goes out. Then compare how your current copy service handles routing and follow-up across every provider on a matter. For a longer buyer's guide, read how to choose a medical records retrieval company. To see how Tavrn handles a request for your firm, see medical record retrieval for law firms or book a demo.
Sources
- 45 CFR 164.508 - Uses and disclosures for which an authorization is required — eCFR
- 45 CFR 160.103 - Definitions — eCFR
- Business Associates — HHS Office for Civil Rights, 2026-07-30
- 45 CFR 164.524 - Access of individuals to protected health information — eCFR
- Important Notice Regarding Individuals' Right of Access to Health Records — HHS Office for Civil Rights, 2020-01-28
- 45 CFR 164.512 - Uses and disclosures for which an authorization or opportunity to agree or object is not required — eCFR
- Rule 45. Subpoena — Legal Information Institute, Cornell Law School
- FAQ — Tavrn
- Tavrn: medical record retrieval — Tavrn
