Skip to content

Blog · Technology

Which ROI vendors give requesters a portal to track requests?

Which ROI vendors give requesters a portal to submit and track medical record requests? What a good requester portal does, what HIPAA requires of it, and how to judge one.

By Tavrn Team · · 4 min read

Summarise with ChatGPT, Claude or Perplexity

A blank browser window with a folder sliding into it, above a progress track running from a provider building to an open file folder, one checkpoint highlighted

Which ROI vendors give requesters a portal to submit and track medical record requests? It depends on the provider and the release-of-information (ROI) company it uses, and the forms and release formats behind any portal vary from provider to provider [1]. The useful test is what the portal shows a requester, not whether it exists.

What a requester portal is

A requester portal is the web front door a provider, or the ROI company working for it, offers to people who ask for records. Law firms, insurers, other providers and patients use it to upload a request, attach the authorization and check where the request stands.

When an outside company runs release of information for a provider, it handles protected health information on that provider's behalf. HIPAA calls that company a business associate: a person who "creates, receives, maintains, or transmits protected health information" for a regulated function on behalf of a covered entity [2]. The portal is part of that arrangement. The provider still owns the compliance program.

Why requesters want one

Requests stall when the requester cannot see what is happening. A 2018 study of 83 top-ranked US hospitals found that what records departments said on the phone often did not match their own authorization forms [1]. On the forms, only 44 hospitals (53%) gave patients the option to request the entire medical record, while all 83 said by phone that they could release it [1].

Formats were just as inconsistent. Online patient portals were listed as a release format on 33 forms (40%) but mentioned in only 21 calls (25%) [1].

A good portal fixes the information gap first. It shows the provider's current form, the formats it can release in and the status of each request in one place.

What HIPAA requires behind the portal

The portal is an intake channel. The rules that govern the release sit underneath it, and they differ by request type.

Request type

Rule

Deadline

What the portal should check

Patient's own access request

45 CFR 164.524 [3]

30 days, plus one extension of up to 30 days with notice [3]

Written request if the provider requires one; form and format requested [3]

Patient-directed copy to a third party

45 CFR 164.524(c)(3) [3]

Same as access [3]

Signed in writing, names the designated person and where to send the copy [3]

Disclosure under an authorization

45 CFR 164.508 [4]

No federal deadline

Core elements present, not expired, not revoked [4]

For access requests, HIPAA says the provider "must act on a request for access no later than 30 days after receipt of the request" [3]. It may extend once, by no more than 30 days, if it gives the individual a written reason and a completion date within the first 30 days [3].

The provider must also release records "in the form and format requested by the individual, if it is readily producible in such form and format" [3]. A portal that only delivers paper, or only one file type, can put that rule at risk.

For authorization-based requests, the regulation lists defects that make an authorization invalid: an expiration date that has passed, an authorization "not filled out completely", one known to have been revoked, or material information known to be false [4]. Catching those at upload saves a rejection letter weeks later.

Information blocking applies too

For electronic records, the federal information blocking rule also applies. It defines information blocking as a practice "likely to interfere with access, exchange, or use of electronic health information," and for a provider the test is that it "knows that such practice is unreasonable" [5]. HIM teams should review portal steps that add friction without a clear reason, such as extra forms or channels that only accept paper, with that definition in mind.

How to judge a requester portal

Ask these questions of any ROI service, whether you are choosing one for your facility or using one as a requester:

  1. Intake. Does the portal show the provider's current authorization form and check required elements before the request is accepted [4]?
  2. Status. Can the requester see received, in review, processing and released states, with dates, without calling?
  3. Clock. Does it record the date of receipt, so the 30-day access window and any extension notice can be tracked [3]?
  4. Format. Can it release in the electronic formats the provider can readily produce [3]?
  5. Third-party copies. Does it separate patient-directed requests from authorization-based ones, since the rules differ [3][4]?
  6. Audit trail. Is every step logged, so the provider can answer a complaint with records instead of memory?
  7. Agreement. Is the business associate agreement in place and current [2]?

A portal that passes all seven gives requesters fewer reasons to call and gives HIM staff a defensible record of each release.

When your clinic is the requester

Hospitals and clinics also request records. Care coordination, referrals and transitions of care all depend on outside charts, and each outside provider has its own ROI process and portal, or none.

Tavrn works on that requesting side. Tavrn retrieves medical records from any US provider: one authorization in, complete record out, via platform, integration or API [6]. Every open request is followed up automatically every 48 hours, and every outreach attempt on a request is logged [6]. Tavrn handles protected health information under HIPAA; a BAA is available on request [6].

What to do next

If your team spends time chasing outside records across many provider portals, read the FAQ on how requests, follow-up and delivery work, or book a demo to see a request from intake to delivery.

Sources

  1. Assessment of US Hospital Compliance With Regulations for Patients’ Requests for Medical Records — JAMA Network Open (Lye et al.), 2018-10-05
  2. 45 CFR 160.103 - Definitions (business associate) — eCFR
  3. 45 CFR 164.524 - Access of individuals to protected health information — eCFR
  4. 45 CFR 164.508 - Uses and disclosures for which an authorization is required — eCFR
  5. 45 CFR 171.103 - Information blocking — eCFR
  6. Medical record retrieval FAQ — Tavrn

Frequently asked questions

Does a requester portal change a provider's HIPAA deadline?

No. A patient's own access request must be acted on within 30 days, with one extension of up to 30 more days, however it arrives [3]. Requests sent under a signed authorization have no federal deadline.

Can a provider refuse a request because the authorization is missing an element?

An authorization that is not filled out completely, has expired or has been revoked is not valid under HIPAA [4]. A good portal checks for these defects at intake, before the request joins the queue.

Is an ROI vendor a business associate?

A company that receives or transmits protected health information on a provider's behalf for a HIPAA-regulated function meets HIPAA's definition of a business associate [2]. The provider's business associate agreement governs what the vendor may do with the records.

Keep reading