---
title: "Medical record retrieval for health systems"
description: "Outside medical records for hospitals and clinics: one HIPAA authorization, any US provider, networks, ROI vendors, fax and phone, delivered to HIM by app, SFTP or API."
canonical: https://www.tavrn.ai/medical-record-retrieval/for-health-systems
updated: 2026-10-29
---

# Medical record retrieval for health systems

Tavrn retrieves outside medical records for hospitals, health systems and clinics: the notes, imaging, pathology and labs a patient’s other providers hold, requested from any US provider on one signed HIPAA authorization and delivered to HIM for the chart. Networks, release-of-information vendors and portals first, then fax, mail, email and phone, with follow-up every 48 hours until the records arrive.

Part of [Medical record retrieval](https://www.tavrn.ai/medical-record-retrieval) · [Hospitals and clinics overview](https://www.tavrn.ai/solutions/hospitals-clinics)

## Where health systems use it

- **New-patient intake and referral review** — Outside notes, imaging and labs from the referring and prior providers, requested when the referral lands so the first visit starts from the record.
- **Tumor board and transplant evaluation** — Pathology reports with slides and blocks, imaging with the DICOM, operative notes and infusion records from every center that treated the patient before yours.
- **Transfer center** — The prior record from each facility a transferred patient has been through, on one authorization.
- **Prior authorization and payer documentation** — The outside documentation a payer requires before it approves care, requested from the provider that holds it, with a documented no-records statement where nothing exists.
- **Continuity of care** — Care management teams that need the visits outside your system: the 37% of a patient’s record that sits outside every network and portal, requested directly from each provider.

## Tavrn is the requesting side

Release-of-information outsourcing hands a hospital’s own records desk to a vendor that answers inbound requests. Tavrn does the opposite job: it obtains the outside records your clinicians, HIM and payers need from the providers who hold them, including the ones that answer through Datavant/Ciox, MRO, Verisma or Sharecare, on those vendors’ own portals and payment rails.

[How medical record retrieval works](https://www.tavrn.ai/medical-record-retrieval)

## What comes back, and how it is usually held

Networks carry documents and rarely images; they never carry slides, blocks, paper charts or bills. Each record type is requested the way its custodian releases it.

| Record type | Where it usually sits | How Tavrn requests it |
| - | - | - |
| Clinical and consult notes | Health-data networks, provider portals, the HIM department | Network or portal first; fax, mail or phone outside them |
| Imaging reports and DICOM | Reports on networks; images with the imaging center or radiology department | Report through the network; images on disc or by exchange, ingested on arrival |
| Pathology reports, slides and blocks | The laboratory or pathology department that cut them | Requested from the lab; slides and blocks shipped to your institution |
| Laboratory results | Networks, reference labs and the ordering provider | Network or portal first, then the lab or provider directly |
| Operative and procedure notes | The hospital or surgery center HIM department | Requested from HIM, often through its release-of-information vendor |
| Medication and infusion records | Infusion centers, pharmacies and the treating practice | Requested directly; pharmacy records on the same authorization |
| Itemized bills | The provider’s billing office, separate from HIM | Requested from billing as its own record type |
| Scanned and legacy charts | Paper or scanned files at small practices and closed facilities | Fax, mail and phone, followed up every 48 hours |
| Behavioral-health and substance-use records | The treating program, under 42 CFR Part 2 | Requested with the Part 2-compliant consent (42 CFR 2.31) on file |

## Every route a custodian answers on

Across Tavrn’s requests, networks, records vendors and portals return about 63% of a patient’s visits; the other 37% are requested directly from each provider.

| Channel | Who answers on it | What Tavrn does |
| - | - | - |
| Health-data networks | Health systems and practices on an exchange network | Queries the network for the patient’s documents and attaches them to the request |
| Release-of-information vendors | Hospitals that outsource release to Datavant/Ciox, MRO, Verisma or Sharecare | Files, pays and tracks the request on the vendor’s own portal and payment rails |
| Provider portals | Health systems with their own request portal | Submits and tracks the request on the portal; every contact is logged |
| Fax | Most independent practices and imaging centers | Sends the authorization and request the same day; re-sends on follow-up |
| Mail | Custodians that require paper, closed or legacy facilities | Mails the request and ingests discs and paper returns |
| Phone | Every custodian, to confirm receipt and follow up | Confirms receipt, follows up every 48 hours in business hours, escalates a stalled request |

## One status per provider request

Each provider on a patient is its own request with its own status and contact log, shown on the Tavrn platform and reported on every change by integration or API webhook.

| Status | What it means | What HIM sees |
| - | - | - |
| Received | The authorization and provider details are in and the request is queued to go out the same day | The request on the patient’s case with its provider and record types |
| Processing | The request is with the custodian; receipt is confirmed and follow-up runs every 48 hours | Each contact logged with date, channel and outcome |
| Action required | The custodian needs something from you: a provider invoice above your approval threshold, a missing contact, or an issue with the request | A question to answer on the platform; the request resumes once answered |
| Completed | The delivery was checked against the request: pages, date range and record types | Searchable records with a cover page, organised by provider and date of service, or a documented no-records statement |
| Cancelled | The request was withdrawn before the custodian released records | The request closed with its contact history kept on the record |

## Authorization under HIPAA, for every use

Network exchange runs under a treatment purpose of use. Tavrn works from the patient’s written authorization, which reaches providers outside every network and covers the uses treatment exchange does not.

### 45 CFR 164.508 — the patient’s authorization

A valid authorization names the recipient, describes the information and its purpose, and carries an expiration and the patient’s signature. One signature covers every US provider the patient has seen; a research authorization can run to the end of the study.

### 45 CFR 164.524 — the right of access

A patient requesting their own records must be answered within 30 days, with one 30-day extension. Requests under an authorization have no federal deadline; state law sets its own rules, which is why follow-up every 48 hours matters.

### 45 CFR 164.512 — disclosures without authorization

HIPAA lets a provider release records without consent only in listed cases, such as a court order or a subpoena with the required assurances (164.512(e)). Tavrn requests on the patient’s authorization, which the custodian can honor directly.

## From authorization to the chart

1. **Send the authorization** — The patient’s signed HIPAA authorization plus the provider’s name, location and dates of service, entered on the Tavrn platform, uploaded in bulk, or sent by API.
2. **Every provider is requested the same day** — Networks, records vendors and portals first; fax, mail, email or phone for each provider outside them. One authorization covers every provider on the patient.
3. **Followed up until it arrives** — Receipt is confirmed with the records department, then every open request is followed up every 48 hours. A provider that stalls is escalated to Tavrn’s retrieval team, who work it by hand.
4. **Checked and delivered to HIM** — Pages, date range and record types are checked against the request. Records arrive searchable (OCR), with a cover page, organised by provider and date of service, in the Tavrn app, by SFTP or over the API, for HIM to file to the chart.

## Any US provider, from one authorization

- **100,000+** provider requests processed through Tavrn
- **500+** organizations, from solo practices to national organizations
- **425,000** provider organizations in the directory, all 50 states and DC

## Controls for sensitive medical records

Protected health information, handled under HIPAA and audited for SOC 2.

- HIPAA compliance
- SOC 2
- BAA
- SSO
- Audit trail

[Security details](https://www.tavrn.ai/security)

## FAQ

## What is outside-record retrieval for a health system?

Obtaining the records a patient’s other providers hold: the notes, imaging, pathology and labs from the hospitals, practices, imaging centers and labs the patient saw before reaching you. It starts with the patient’s signed HIPAA authorization and ends when each custodian releases the complete record. Tavrn does this from one authorization for any US provider and delivers to HIM.

## Is this release-of-information outsourcing?

No. Release-of-information outsourcing hands your own records desk to a vendor that answers inbound requests. Tavrn is the requesting side: it obtains outside records from other providers on your behalf, and when that provider uses a release-of-information vendor such as Datavant/Ciox, MRO, Verisma or Sharecare, Tavrn files, pays and tracks the request on the vendor’s own rails.

## What legal basis does Tavrn request records under?

The patient’s written authorization under 45 CFR 164.508, naming your organization and the purpose of use; one signature covers every US provider the patient has seen. Requests under an authorization have no federal deadline (the 30-day clock in 45 CFR 164.524 applies to a patient’s own access request), so Tavrn confirms receipt and follows up every 48 hours.

## How does this fit Epic or our other EHR workflows?

Tavrn delivers records to the Tavrn app, by SFTP to your document system, or over the API with a webhook on every status change. From there HIM files them to the chart the way it files any outside record today; no EHR-vendor connector is required. Each delivery is searchable (OCR), with a cover page, organised by provider and date of service.

## Can Tavrn retrieve behavioral-health and substance-use records?

Yes, with the right consent. Records from a substance-use program covered by 42 CFR Part 2 need a Part 2-compliant consent (42 CFR 2.31) rather than the HIPAA authorization alone; Tavrn requests them with that consent on file, and other behavioral-health records on the patient’s authorization.

## Can we use it for prior authorization and other payer documentation?

Yes. The outside documentation a payer requires before approving care is requested from the provider that holds it, on the patient’s authorization. Where the provider has nothing on file, Tavrn returns a documented no-records statement, so the gap is on the record.

## What arrives, and in what form?

Charts and treatment records, imaging reports with the DICOM, pathology reports, labs, operative notes, infusion records, itemized bills and scanned legacy charts arrive as searchable (OCR) files with a cover page, organised by provider and date of service; pathology slides and blocks are shipped physically from the lab. Every delivery is checked for pages, date range and record types.

## How long does outside-record retrieval take?

The custodian sets the pace. Tavrn sends every request the same day, confirms receipt and follows up every 48 hours until the records arrive, escalating a stalled provider to its retrieval team. Tavrn does not promise a date for a given provider; the state of every request is visible on the platform at any time.

## See an outside-records request go out and the record come back

Trusted by 500+ organizations, coast to coast.

[Book a demo](https://www.tavrn.ai/demo)