Blog · Law
Medical records retrieval companies for lawyers: how to choose
How medical records retrieval companies for lawyers work, the four main approaches compared, the HIPAA rules behind every request, and what to ask a vendor before you sign.
By Tavrn Team · · 4 min read
Summarise with ChatGPT, Claude or Perplexity
Medical records retrieval companies for lawyers send the request to each provider on a matter, follow up until the records arrive, and deliver them to the firm. They work in one of four ways. The right fit depends on which providers your clients see, how follow-up works, and where the records land.
What a retrieval company does for a law firm
A retrieval company takes over the request work a paralegal would otherwise do by hand. The work is the same on every matter, whoever does it:
- Check that the authorization is valid. HIPAA lists core elements, such as a specific description of the records and the person they go to [2].
- Find the right custodian. At a hospital, medical records, bills and imaging may sit with different departments.
- Send the request with the signed authorization and any form the provider requires.
- Follow up until the provider sends records or confirms it has none.
- Deliver the records and file them to the matter.
Steps 2 and 4 take the most time. A request sent to the wrong department waits until someone notices. A request with no follow-up can wait much longer.
The four main approaches compared
Most firms use one of these approaches, or a mix. The table compares how each one handles the work. It compares approaches, not named vendors.
Approach | Who chases the provider | Which providers it reaches | Status you can see | Where records land |
|---|---|---|---|---|
In-house staff | Your paralegals, by phone and fax | Any provider, if staff have the time | Whatever staff track by hand | Wherever staff file them |
Traditional retrieval service | The vendor's staff | Most providers, depending on the vendor | Portal or email updates | Files you download and file |
Provider-side portal | The provider's own release team | Only providers that use that portal | Status inside that portal | That portal |
Network queries plus outreach | Automated network queries, then outreach to the rest | Networks first, then providers by fax, mail, email and phone | Live status per provider | Often your case management system |
Network queries alone are not enough. In Tavrn's own analysis of its requests, networks, records vendors and portals return about 63% of a patient's visits. That means 37% of a patient's record sits outside every network and portal combined. Any approach you choose needs a plan for that last part.
The rules behind every request
The legal path a request takes decides how long a provider has to answer and what paperwork it needs.
- Patient access requests. HIPAA says "the covered entity must act on a request for access no later than 30 days after receipt of the request" [1]. The provider may extend that once, by no more than 30 days, with a written reason [1].
- Authorizations. A request made under the client's authorization has no federal deadline. Follow-up does most of the work here.
- Psychotherapy notes. A provider must get an authorization for almost any use or disclosure of psychotherapy notes [2]. Plan for a separate form.
- Substance use disorder records. Records covered by 42 CFR Part 2 need a written consent that includes the patient's name and a specific description of the information [3].
- Subpoenas. A subpoena without a court order works only if the provider receives satisfactory assurance about notice to the patient or a qualified protective order [4].
A good retrieval company knows which path each request is on. It also catches a missing element before the provider rejects the request.
Security and confidentiality checks
Your client's records are protected health information, so the vendor's safeguards matter as much as its speed.
HHS explains that a business associate gives "satisfactory assurances, in the form of a contract or other written arrangement" that it will safeguard the information [5]. HHS calls this a business associate agreement, or BAA [5]. Ask whether the vendor will sign one.
Then ask for proof, not promises:
- A current SOC 2 report, and who may see it.
- How records are encrypted, both stored and in transit.
- How staff sign in, and who at the vendor can open a file.
- Whether every outreach attempt on a request is logged and visible to you.
Questions to ask before you sign
Bring these to every vendor call. The answers show how much of the chase stays with your staff.
- Turnaround. Ask for the full spread of completion times, not one average. Ask how hospitals compare with small practices.
- Follow-up. Ask how often an open request is followed up, and by which channels.
- Dead ends. Ask what happens when a provider says it has no records or rejects the authorization.
- Record types. Ask whether bills, imaging and accident reports come with the medical records.
- Coverage. Test the vendor against your ten most difficult providers.
- Integrations. Ask whether requests start from your case management system, such as Litify, SmartAdvocate, Clio or Smokeball.
- Electronic access. Ask how the vendor handles providers that slow electronic requests. ONC defines information blocking as a practice "likely to interfere with the access, exchange, or use of electronic health information" [6]. ONC also says a practice that blocks automation technologies could fall under those rules [6].
How Tavrn approaches retrieval
Tavrn retrieves medical records from any US provider: one authorization in, complete record out, via platform, integration or API. Its directory lists around 425,000 provider organizations across all 50 states and DC.
Requests go to the provider the same day. Every open request is followed up automatically every 48 hours, and Tavrn requests the rest from each provider by fax, mail, email and phone. Every outreach attempt on a request is logged.
Firms can start requests from Litify, SmartAdvocate, Clio, Smokeball, SharePoint or Dropbox. Tavrn retrieves medical records, billing records, radiology images, accident reports and insurance coverage from any US provider.
On timing, the vast majority of records are back within two to three weeks of the request going out, and provider processing time is most of that. Historically, 62% within 30 days; 83% within 60. Tavrn does not promise a date for a given provider.
What to do next
List the providers your last ten matters waited on longest. Use them to test any vendor you are considering. To see how Tavrn handles them, read about Tavrn for law firms.
Sources
- 45 CFR 164.524 — Access of individuals to protected health information — eCFR, Office of the Federal Register, 2026-10-01
- 45 CFR 164.508 — Uses and disclosures for which an authorization is required — eCFR, Office of the Federal Register, 2026-10-01
- 42 CFR 2.31 — Consent requirements — eCFR, Office of the Federal Register, 2026-10-01
- 45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required — eCFR, Office of the Federal Register, 2026-10-01
- Business Associates — U.S. Department of Health and Human Services, Office for Civil Rights, 2026-07-30
- Information Blocking — Assistant Secretary for Technology Policy / ONC, HHS, 2025-12-19
