Blog · Law
What do third party medical record companies do?
Third party medical record companies come in two kinds. One works for the provider, the other for the requester. What each does, the HIPAA rules behind them, and how to evaluate one.
By Tavrn Team · · 4 min read
Summarise with ChatGPT, Claude or Perplexity
Third party medical record companies are outside firms that handle medical records for someone else. There are two kinds. Release-of-information vendors work for the hospital or clinic and answer requests as its business associate [1]. Retrieval companies work for the requester, such as a law firm, and send requests under the patient's signed authorization [4].
Two kinds of third party medical record companies
The key difference is who hires the company. That choice sets which HIPAA rule applies and what the company owes you.
Release-of-information vendor | Medical record retrieval company | |
|---|---|---|
Works for | The provider (a covered entity) | The requester: a law firm, insurer, research site or health system |
HIPAA role | Business associate of the provider [1] | Works for the requester; the provider releases under the patient's authorization [4] |
Main job | Logs requests, checks them, copies and releases records | Prepares requests, sends them, follows up, collects what comes back |
Contract that governs it | Business associate agreement with the provider [2][3] | Service agreement with the requester |
Where you meet it | Its name is on the letter or portal that answers you | You hire it to send the request |
One request often passes through both. A retrieval company sends the request. The hospital's release-of-information vendor answers it.
Release-of-information vendors work for the provider
A release-of-information vendor is a business associate. HIPAA defines that as a person who creates, receives, maintains or transmits health information "on behalf of" a covered entity [1]. HHS lists covered entities as health plans, health care clearinghouses, and health care providers who send health information electronically in covered transactions [2].
The provider must sign a business associate agreement before it shares records with the vendor [2]. HHS says the agreement must "describe the permitted and required uses and disclosures" of the information by the vendor [2]. The full list of required terms is in 45 CFR 164.504(e) [3].
For a paralegal, this means the vendor speaks for the provider. It decides if a request is complete. It can send a request back if a required element is missing.
Retrieval companies work for the requester
A retrieval company works for you, not the provider. A law firm is not a health plan, clearinghouse or provider, so the business associate rule is not what lets records move to it [1]. The patient's signed authorization is.
HIPAA lists the core elements of a valid authorization in 45 CFR 164.508(c)(1) [4]. It must contain at least:
- A specific description of the information to be released.
- The name of the person or class of persons allowed to release it.
- The name of the person or class of persons who will receive it.
- A description of each purpose. "At the request of the individual" is enough when the patient starts the request.
- An expiration date or event.
- The patient's signature and the date [4].
The rule also requires notice statements, such as the patient's right to revoke the authorization in writing [4]. An authorization that is not filled out completely is not valid [4]. A good retrieval company checks each element before the request goes out.
Three legal routes a request can take
A law firm can get records through three routes. Each has its own rule and its own clock.
Route | Rule | What the provider must do | Deadline |
|---|---|---|---|
Patient authorization | 45 CFR 164.508 [4] | May release what the authorization describes | No federal deadline [9] |
Patient directs a copy to a third party | 45 CFR 164.524(c)(3)(ii) [5] | Must send the copy to the person the patient names | 30 days, plus one 30-day extension [5] |
Subpoena without a court order | 45 CFR 164.512(e)(1)(ii) [6] | May release if it gets the required written assurances | None set in this rule [6] |
The second route is a form of the patient's own right of access. The rule says the request "must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy" [5]. A provider must act on it within 30 days. It may take one extension, with a written reason [5].
Subpoenas work differently. Without a court order, the provider needs written proof that the patient got notice, or that a qualified protective order was sought [6].
How to evaluate a retrieval company
Vendor names change faster than the questions you should ask. Use these questions to compare any retrieval company.
- Authorization handling. Does it check each core element before sending? Does it use the provider's own form when the provider asks for one?
- Provider coverage. Can it reach small clinics, imaging centers and billing offices, not only large hospital systems?
- Follow-up. How often does it contact a provider that has not answered? Is every attempt logged?
- What it collects. Medical records only, or also billing records and images?
- Where records land. Does delivery go into your case management system, or into one more inbox?
- Security. Can it share security reports and sign a business associate agreement when you need one?
- Honesty about time. Does it give historical turnaround figures with their limits, or promise a date it cannot control?
Ask for answers in writing. Compare them in a table like the one above.
Where Tavrn fits
Tavrn is a medical record retrieval company, so it sits on the requester side. Tavrn requests, follows up and delivers medical records, bills and imaging from any US provider [8]. To start, a firm needs a signed patient authorization and what you know about the provider: name, location, and the dates of service [7].
Firms can start requests from Litify, SmartAdvocate, Clio, Smokeball, SharePoint or Dropbox [7]. Every open request is followed up automatically every 48 hours, and every outreach attempt on a request is logged [7]. Tavrn handles protected health information under HIPAA; a BAA is available on request [7].
What to do next
Map your open requests to the three routes above. Check that each authorization has all six core elements. To see how a retrieval request works for a law firm, read about Tavrn for law firms.
Sources
- 45 CFR 160.103 - Definitions — eCFR
- Business Associates Frequently Asked Questions — HHS Office for Civil Rights
- 45 CFR 164.504 - Uses and disclosures: Organizational requirements — eCFR
- 45 CFR 164.508 - Uses and disclosures for which an authorization is required — eCFR
- 45 CFR 164.524 - Access of individuals to protected health information — eCFR
- 45 CFR 164.512 - Uses and disclosures for which an authorization or opportunity to agree or object is not required — eCFR
- Frequently asked questions — Tavrn
- Tavrn - medical record retrieval — Tavrn
- Medical record retrieval for hospitals and clinics — Tavrn
