For health systems
Medical record retrieval for health systems
Tavrn retrieves outside medical records for hospitals, health systems and clinics: the notes, imaging, pathology and labs a patient’s other providers hold, requested from any US provider on one signed HIPAA authorization and delivered to HIM for the chart. Networks, release-of-information vendors and portals first, then fax, mail, email and phone, with follow-up every 48 hours until the records arrive.
Where health systems use it
New-patient intake and referral review
Outside notes, imaging and labs from the referring and prior providers, requested when the referral lands so the first visit starts from the record.
Tumor board and transplant evaluation
Pathology reports with slides and blocks, imaging with the DICOM, operative notes and infusion records from every center that treated the patient before yours.
Transfer center
The prior record from each facility a transferred patient has been through, on one authorization.
Prior authorization and payer documentation
The outside documentation a payer requires before it approves care, requested from the provider that holds it, with a documented no-records statement where nothing exists.
Continuity of care
Care management teams that need the visits outside your system: the 37% of a patient’s record that sits outside every network and portal, requested directly from each provider.
Retrieval, not release of information
Tavrn is the requesting side
Release-of-information outsourcing hands a hospital’s own records desk to a vendor that answers inbound requests. Tavrn does the opposite job: it obtains the outside records your clinicians, HIM and payers need from the providers who hold them, including the ones that answer through Datavant/Ciox, MRO, Verisma or Sharecare, on those vendors’ own portals and payment rails.
Record types
What comes back, and how it is usually held
Networks carry documents and rarely images; they never carry slides, blocks, paper charts or bills. Each record type is requested the way its custodian releases it.
| Record type | Where it usually sits | How Tavrn requests it |
|---|---|---|
| Clinical and consult notes | Health-data networks, provider portals, the HIM department | Network or portal first; fax, mail or phone outside them |
| Imaging reports and DICOM | Reports on networks; images with the imaging center or radiology department | Report through the network; images on disc or by exchange, ingested on arrival |
| Pathology reports, slides and blocks | The laboratory or pathology department that cut them | Requested from the lab; slides and blocks shipped to your institution |
| Laboratory results | Networks, reference labs and the ordering provider | Network or portal first, then the lab or provider directly |
| Operative and procedure notes | The hospital or surgery center HIM department | Requested from HIM, often through its release-of-information vendor |
| Medication and infusion records | Infusion centers, pharmacies and the treating practice | Requested directly; pharmacy records on the same authorization |
| Itemized bills | The provider’s billing office, separate from HIM | Requested from billing as its own record type |
| Scanned and legacy charts | Paper or scanned files at small practices and closed facilities | Fax, mail and phone, followed up every 48 hours |
| Behavioral-health and substance-use records | The treating program, under 42 CFR Part 2 | Requested with the Part 2-compliant consent (42 CFR 2.31) on file |
Request channels
Every route a custodian answers on
Across Tavrn’s requests, networks, records vendors and portals return about 63% of a patient’s visits; the other 37% are requested directly from each provider.
| Channel | Who answers on it | What Tavrn does |
|---|---|---|
| Health-data networks | Health systems and practices on an exchange network | Queries the network for the patient’s documents and attaches them to the request |
| Release-of-information vendors | Hospitals that outsource release to Datavant/Ciox, MRO, Verisma or Sharecare | Files, pays and tracks the request on the vendor’s own portal and payment rails |
| Provider portals | Health systems with their own request portal | Submits and tracks the request on the portal; every contact is logged |
| Fax | Most independent practices and imaging centers | Sends the authorization and request the same day; re-sends on follow-up |
| Custodians that require paper, closed or legacy facilities | Mails the request and ingests discs and paper returns | |
| Phone | Every custodian, to confirm receipt and follow up | Confirms receipt, follows up every 48 hours in business hours, escalates a stalled request |
Status model
One status per provider request
Each provider on a patient is its own request with its own status and contact log, shown on the Tavrn platform and reported on every change by integration or API webhook.
| Status | What it means | What HIM sees |
|---|---|---|
| Received | The authorization and provider details are in and the request is queued to go out the same day | The request on the patient’s case with its provider and record types |
| Processing | The request is with the custodian; receipt is confirmed and follow-up runs every 48 hours | Each contact logged with date, channel and outcome |
| Action required | The custodian needs something from you: a provider invoice above your approval threshold, a missing contact, or an issue with the request | A question to answer on the platform; the request resumes once answered |
| Completed | The delivery was checked against the request: pages, date range and record types | Searchable records with a cover page, organised by provider and date of service, or a documented no-records statement |
| Cancelled | The request was withdrawn before the custodian released records | The request closed with its contact history kept on the record |
Legal basis
Authorization under HIPAA, for every use
Network exchange runs under a treatment purpose of use. Tavrn works from the patient’s written authorization, which reaches providers outside every network and covers the uses treatment exchange does not.
- 45 CFR 164.508 — the patient’s authorization
- A valid authorization names the recipient, describes the information and its purpose, and carries an expiration and the patient’s signature. One signature covers every US provider the patient has seen; a research authorization can run to the end of the study.
- 45 CFR 164.524 — the right of access
- A patient requesting their own records must be answered within 30 days, with one 30-day extension. Requests under an authorization have no federal deadline; state law sets its own rules, which is why follow-up every 48 hours matters.
- 45 CFR 164.512 — disclosures without authorization
- HIPAA lets a provider release records without consent only in listed cases, such as a court order or a subpoena with the required assurances (164.512(e)). Tavrn requests on the patient’s authorization, which the custodian can honor directly.
How it works
From authorization to the chart
- 01
Send the authorization
The patient’s signed HIPAA authorization plus the provider’s name, location and dates of service, entered on the Tavrn platform, uploaded in bulk, or sent by API.
- 02
Every provider is requested the same day
Networks, records vendors and portals first; fax, mail, email or phone for each provider outside them. One authorization covers every provider on the patient.
- 03
Followed up until it arrives
Receipt is confirmed with the records department, then every open request is followed up every 48 hours. A provider that stalls is escalated to Tavrn’s retrieval team, who work it by hand.
- 04
Checked and delivered to HIM
Pages, date range and record types are checked against the request. Records arrive searchable (OCR), with a cover page, organised by provider and date of service, in the Tavrn app, by SFTP or over the API, for HIM to file to the chart.
Coverage
Any US provider, from one authorization
100,000+
provider requests processed through Tavrn
500+
organizations, from solo practices to national organizations
425,000
provider organizations in the directory, all 50 states and DC
Security
Controls for sensitive medical records
Protected health information, handled under HIPAA and audited for SOC 2.
Security detailsFAQ
Outside-record retrieval, answered
Book a demo
See an outside-records request go out and the record come back
Trusted by 500+ organizations, coast to coast.