Blog · Law
Medical records for immigration and disability cases
Which compliant services retrieve records for immigration and disability cases? What a valid HIPAA authorization needs, what SSA, VA and USCIS expect, and what to ask a vendor.
By Tavrn Team · · 5 min read
Summarise with ChatGPT, Claude or Perplexity
Which compliant services retrieve records for immigration and disability cases? Any service that works from a valid, signed patient authorization, follows the HIPAA rules on what that form must say, and can show how it protects the records [1]. The case type changes what evidence matters. It does not change the release rules.
Why medical evidence carries these cases
Disability and immigration matters both turn on documents from treating providers. The deadlines and burdens differ, so the retrieval plan should differ too.
SSA calls medical evidence "the cornerstone of the disability determination" under both the title II and title XVI programs [2]. The claimant is responsible for providing evidence of the impairment and its severity [2]. SSA, with the claimant's permission, will help get evidence from the claimant's own medical sources [2].
The duty to disclose is broad. Under SSA rules, a claimant "must inform us about or submit all evidence known to you that relates to whether or not you are blind or disabled" [3]. That duty is ongoing and applies at each level of review [3].
Timing matters at the hearing stage. Written evidence must reach the administrative law judge no later than 5 business days before the scheduled hearing [4]. If it arrives late, the judge may decline to consider it unless an exception applies [4].
Veterans' disability claims follow a similar path. VA Form 21-4142 gives VA permission to get records from a non-VA source such as a private doctor or hospital [5]. Examples on the form page include medical treatment, hospital stays, psychotherapy and outpatient care [5].
What immigration matters ask of medical records
In asylum cases, the applicant carries the burden of proof [7]. Credible testimony "may be sufficient to sustain the burden of proof without corroboration" [7]. But the statute adds a condition. Where the trier of fact decides corroboration is needed, "such evidence must be provided unless the applicant does not have the evidence and cannot reasonably obtain the evidence" [6].
Waivers that turn on extreme hardship also lean on health records. USCIS lists health conditions and the availability and quality of needed medical treatment in the country of return as factors it weighs [8]. Its policy manual gives an example of an applicant who "provides medical documentation about his condition" to corroborate his statements [9].
What a valid authorization must contain
A HIPAA authorization is valid only if it has the core elements in 45 CFR 164.508(c) [1].
- A specific description of the information to be disclosed [1].
- Who may disclose it and who may receive it [1].
- The purpose of each disclosure; "at the request of the individual" is enough when the patient starts the request [1].
- An expiration date or event [1].
- The patient's signature and date, or a personal representative's signature with a description of their authority [1].
- Statements on the right to revoke and the risk of redisclosure, in plain language [1].
Two record types need extra care. Psychotherapy notes need their own authorization for almost any disclosure [1]. That matters for asylum psychological evaluations and for mental-health disability claims. Substance use disorder treatment records under 42 CFR Part 2 need a written consent that meets that rule's own element list [12].
Four legal routes to the same record
A records request can rest on different legal bases. Each one has a different trigger and a different clock.
Route | Who signs or issues it | What the provider must do | Rule |
|---|---|---|---|
Patient authorization | Patient or personal representative | May disclose what the form describes, to whom it names [1] | 45 CFR 164.508 |
Patient access request | Patient | Must act within 30 days, with one extension of no more than 30 days [10] | 45 CFR 164.524 |
Directed access request | Patient, naming a third party | Must send the copy to the person the patient designates in a signed, written request [10] | 45 CFR 164.524(c)(3) |
Subpoena or court order | Court, tribunal or party | May disclose under an order, or under a subpoena with notice or a protective order assurance [11] | 45 CFR 164.512(e) |
Under a court or tribunal order, the provider may disclose only what the order expressly authorizes [11]. A subpoena without an order needs satisfactory assurance that the patient got notice or that the requester sought a qualified protective order [11]. For most immigration and disability work, a signed authorization is the simpler path.
What to ask a retrieval vendor
"Compliant" should mean something you can check. Ask each vendor these questions and ask for the document behind each answer.
- Does it handle PHI under HIPAA, and will it sign a BAA? HHS describes a business associate agreement as the written arrangement in which a business associate agrees to appropriately safeguard the information [13].
- How are records protected? Ask about encryption at rest and in transit, sign-in controls and audit reports.
- Is every outreach attempt logged? A log shows what was sent, when, and to whom.
- Does it check the authorization before sending? Compare the form against the 164.508 element list above [1].
- Where do records land? Records should arrive in the case file, not in an inbox someone has to sort.
How Tavrn fits
Tavrn retrieves medical records from any US provider: one authorization in, complete record out, via platform, integration or API [14]. To start, Tavrn needs a signed patient authorization and what you know about the provider: name, location, and the dates of service if you have them [14].
Tavrn handles protected health information under HIPAA; a BAA is available on request [14]. Records are encrypted at rest and in transit, and every outreach attempt on a request is logged [14]. SOC 2 Type 1 and Type 2 reports, HIPAA attestation and security policies are on the trust center [15]. Firms can start requests from Litify, SmartAdvocate, Clio, Smokeball, SharePoint or Dropbox [14].
What to do next
Check your authorization template against the 164.508 element list before the next request goes out. Then compare vendors on the questions above. Read how records requests work on the FAQ, or review Tavrn's controls on the security page.
Sources
- 45 CFR 164.508 - Uses and disclosures for which an authorization is required — eCFR
- Disability Evaluation Under Social Security, Part II - Evidentiary Requirements — Social Security Administration
- 20 CFR 404.1512 - Responsibility for evidence — eCFR
- 20 CFR 404.935 - Submitting written evidence to an administrative law judge — eCFR
- About VA Form 21-4142 — U.S. Department of Veterans Affairs
- 8 U.S. Code 1158 - Asylum — Legal Information Institute, Cornell Law School
- 8 CFR 208.13 - Establishing asylum eligibility — eCFR
- Policy Manual, Volume 9, Part B, Chapter 5 - Extreme Hardship Considerations and Factors — U.S. Citizenship and Immigration Services, 2026-10-02
- Policy Manual, Volume 9, Part B, Chapter 4 - Extreme Hardship Determinations — U.S. Citizenship and Immigration Services, 2026-10-02
- 45 CFR 164.524 - Access of individuals to protected health information — eCFR
- 45 CFR 164.512 - Uses and disclosures for which an authorization or opportunity to agree or object is not required — eCFR
- 42 CFR 2.31 - Consent requirements — eCFR
- Business Associates — HHS Office for Civil Rights
- Frequently asked questions — Tavrn
- Security at Tavrn — Tavrn
