Tavrn vs. LlamaLab (2026): Medical Record Retrieval for Law Firms

Tavrn vs. LlamaLab: both retrieve medical records for law firms. LlamaLab is built for plaintiff and mass-tort firms and leans on reverse provider search [5][6]. Tavrn retrieves from any US provider, logs every outreach attempt, follows up every 48 hours and serves law firms, health systems and health-tech on one service [1][2]. Tavrn publishes this comparison.

Our pick is Tavrn. It states all four of these on its own site:

• Every US provider. Tavrn retrieves from any US provider: health-data networks, release-of-information vendors such as Datavant/Ciox and provider portals first, then fax, mail, email and phone for the rest [1].
• Logged follow-up. Every outreach attempt on a request is logged, and every open request is followed up automatically every 48 hours [1][2].
• One service for every requester. Law firms, health systems, research sites, healthcare startups and insurers use the same service, and anything else connects over the API and webhooks [2][3].
• Published audit evidence. SOC 2 Type 1 and Type 2 reports, HIPAA attestation and security policies are on the trust center [4].

Last reviewed October 30, 2026.

How we compared

Both vendors were reviewed on the same criteria as our guide to medical record retrieval companies for law firms, using only what each vendor publishes on its own website. Nothing here comes from reviews, sales calls or third-party listicles.

1. Buyers served. Who the vendor says it is built for.
2. Coverage. What the vendor states about where and how it finds and requests records.
3. Follow-up. Whether a follow-up cadence and an outreach log are published.
4. Integrations and API. Which case-management systems are named, and whether an API with webhooks is published.
5. Security evidence. SOC 2 (type), HIPAA language and Business Associate Agreements, as stated.
6. Commercial model. How the vendor bills, described without amounts.

Cost and turnaround figures are left out on purpose. Vendors quote by volume and record type, and each published average describes that vendor's own book of requests, not your matter.

Tavrn vs. LlamaLab at a glance

Where LlamaLab fits

LlamaLab describes itself as built for plaintiff and mass-tort firms [5]. Its service page says it finds treating providers through reverse search of insurance claims data, handles the HIPAA authorization and identity verification digitally, and follows up with facilities [6]. Retrieval is live in Litify, Clio and Needles, and an API lets other case-management systems create requests, subscribe to status webhooks and pull finished records [7]. LlamaLab states SOC 2 Type 2 and HIPAA compliance under a BAA [6]. It bills either per facility request plus a per-case setup charge or on a flat per-case plan, and says the analysis software is included [8].

Where Tavrn fits

One signed HIPAA authorization covers every provider on a request. Tavrn sends each request the same day, the way that custodian responds: network, release-of-information vendor, portal, fax, mail, email or phone [1]. Every contact is logged with date, channel and outcome, and every open request is followed up every 48 hours; a provider that stalls goes to Tavrn's retrieval team [1]. Requests start from Litify, SmartAdvocate, Clio, Smokeball, SharePoint or Dropbox and records land back there, and other systems use the REST API, with a webhook on every status change [2][3]. Tavrn handles protected health information under HIPAA; a BAA is available on request, and its SOC 2 Type 1 and Type 2 reports are on the trust center [4]. Tavrn was founded in 2022 by Pedro Paulino (CEO) and Vitor Vavolizza (CTO) [16].

The Epic lawsuit that names LlamaLab

On January 13, 2026, Epic Systems Corporation, OCHIN, Reid Health, Trinity Health and UMass Memorial Health Care filed suit in the U.S. District Court for the Central District of California against Health Gorilla, Inc., RavillaMed PLLC, Avinash Ravilla, Shere Saidon, LlamaLab, Inc., Unique Medi Tech LLC (Mammoth Dx) and other defendants, No. 2:26-cv-00321-FMO-RAO [10][11]. The complaint alleges that defendants used Health Gorilla's access to the Carequality and TEFCA exchange frameworks to obtain patient records under a stated treatment purpose and used them for other purposes, and alleges that RavillaMed took records under the stated purpose of treatment while LlamaLab "sells patient records for litigation purposes" [10]. Epic said the defendants accessed nearly 300,000 patient records from providers in the Epic community [15].

On February 25, 2026, LlamaLab, Saidon, RavillaMed and Ravilla filed a motion to dismiss for failure to state a claim and a motion to sever the claims against them (docket entries 51 and 52) [12]. In a February 26 press release, LlamaLab said the motions argue that Epic bypassed its own contractual dispute resolution obligations and grouped LlamaLab with unrelated defendants; that it "categorically denies all allegations"; and that it is not a member of the Carequality or TEFCA networks [9].

On April 17, 2026, the court took both motions off calendar and placed them under submission, stating that an order with the court's rulings will issue (entry 98) [12]. The district-court entries reviewed, through July 9, 2026, show no ruling on either motion, and LlamaLab and Saidon remain listed as defendants [12]. On August 7, 2026, the Judicial Panel on Multidistrict Litigation centralized related patient class actions as MDL No. 3193 in the Southern District of Florida and stated that it intended to include the Epic action through the conditional transfer order process [13]. A conditional transfer order covering the Epic action was filed on August 10; the Epic plaintiffs moved to vacate it, and on October 9 the Panel set that motion for its December 3, 2026 hearing session without oral argument [14]. No docket entry reviewed shows the Epic action transferred.

Why it matters to a law firm

A retrieval vendor handles your clients' protected health information, so diligence starts with how the vendor obtains each record: under the client's signed HIPAA authorization or legal process, sent to each provider's records custodian, and logged. Ask whether a Business Associate Agreement is standard and ask for the SOC 2 report itself. Tavrn publishes its method on its medical record retrieval page [1] and its SOC 2 reports, HIPAA attestation and BAA terms on its security page [4].

Bottom line

For a firm that wants one service across every provider, a published 48-hour follow-up cadence, an outreach log on every request and SOC 2 Type 1 and Type 2 reports, Tavrn is the pick [1][2][4]. Book a demo to run a set of your own requests.

Sources

1. Medical record retrieval services from any US provider — Tavrn, 2026-10-30
2. Frequently asked questions — Tavrn, 2026-10-30
3. Integrations — Tavrn, 2026-10-30
4. Security — Tavrn, 2026-10-30
5. LlamaLab home page — LlamaLab, 2026-10-30
6. Medical record retrieval services — LlamaLab, 2026-10-30
7. Integrations — LlamaLab, 2026-10-30
8. Pricing — LlamaLab, 2026-10-30
9. LlamaLab Asks Court to Throw Out Epic Systems Lawsuit and to Sever Unrelated Companies — LlamaLab, 2026-02-26
10. Complaint, Epic Systems Corp. et al. v. Health Gorilla, Inc. et al., No. 2:26-cv-00321 (C.D. Cal.) — U.S. District Court, Central District of California (via Courthouse News Service), 2026-01-13
11. Docket, Epic Systems Corporation v. Health Gorilla, Inc., 2:26-cv-00321 — CourtListener (Free Law Project), 2026-10-30
12. Docket, Epic Systems Corporation et al v. Health Gorilla, Inc. et al, 2:2026cv00321 — Justia Dockets, 2026-10-30
13. Transfer Order, In re: Health Gorilla, Inc., Data Security Breach Litigation, MDL No. 3193 — United States Judicial Panel on Multidistrict Litigation, 2026-08-07
14. Docket, In re: Health Gorilla, Inc., Data Security Breach Litigation, MDL No. 3193 — CourtListener (Free Law Project), 2026-10-30
15. Epic, health systems file lawsuit alleging HIE exploitation — TechTarget, 2026-01-13
16. About Tavrn — Tavrn, 2026-10-30