---
title: "Medical record retrieval API for health tech"
description: "Medical record retrieval API: one request under the patient’s authorization; imaging, pathology slides and charts from each provider, a webhook on every status change."
canonical: https://www.tavrn.ai/solutions/health-tech
updated: 2026-10-16
---

# Medical record retrieval as an API

The patient signs once. Imaging, pathology slides and charts are requested from each provider they have seen; a webhook fires on every status change.

**100,000+** provider requests · **425,000** provider organizations in Tavrn’s directory · **Every 48 hours** follow-up with each open provider

## What comes back from every provider

Network connectors return what a site publishes: C-CDA, FHIR, some PDFs. They rarely carry DICOM and do not carry slides, infusion flowsheets or bills.

Tavrn requests each record type from the provider that holds it, whether or not that provider is on a network.

- Clinical and consult notes
- DICOM images with the report
- Pathology reports, slides and blocks
- Labs from every lab and hospital
- Infusion and medication records
- Operative notes
- Itemized bills
- Scanned and legacy charts

## What you build on outside records

Four products that start when the outside chart arrives.

### Care navigation and second opinion

You build: Expert review after a serious diagnosis. Records: Slides, DICOM, Infusion records, Consult notes. What changes: The specialist reviews the original slides and images, not a summary of them.

### Clinical AI and chart review

You build: Chart review across every provider’s records. Records: Scanned charts, Faxed notes, Labs. What changes: The model reads the faxed and scanned pages too.

### Virtual specialty care

You build: Specialist care that begins by video. Records: Prior labs, DICOM, Medication records, Operative notes. What changes: Network treatment queries require a treating provider. Your request runs on the patient’s authorization alone.

### Trial matching and recruitment

You build: Eligibility screening from the outside documents. Records: Prior regimens, Pathology and biomarkers, Baseline scans, Organ-function labs. What changes: Each criterion is settled from the outside documents.

## One request per provider, status by webhook

Create a request per provider under the patient’s case, by API or spreadsheet, with the signed authorization attached. One authorization covers every US provider the patient has seen.

### One request per provider

Each request carries its own status, contact dates and any provider fee, passed through at cost under the approval threshold you set.

### Networks, then direct

Networks, records vendors and portals return about 63% of a patient’s visits; Tavrn requests the rest from each provider by fax, mail, email and phone.

### Follow-up until answered

Every open provider is contacted every 48 hours until it answers. A webhook fires on every status change, or poll the request.

### Delivery as providers respond

Records arrive as each provider responds. Download them with the same key, or take delivery by SFTP or in the Tavrn app.

Create a request:

```http
POST /v2/cases/{case_id}/retrieval-requests

{
  "patient": {
    "name": "Nora Bellamy"
  },
  "facility": {
    "name": "Cedars-Sinai"
  },
  "requested_records": [
    {
      "type": "medical_records"
    },
    {
      "type": "billings"
    }
  ],
  "auth_form": {
    "upload_id": "upl_8f2…"
  }
}
```

## Research on the patient’s authorization

Eligibility and long-term follow-up turn on outside documents: prior regimens and stop dates, pathology and biomarkers, baseline scans.

- **Authorization** — Research is not a named network purpose, so your requests run on the patient’s HIPAA research authorization, valid to the study’s end.
- **Cohort orders** — One request per cohort, one row per patient per provider.
- **Source documents** — Each record is the provider’s own chart, delivered as the provider produced it.

## Questions before you integrate

What a request returns, who may receive it, what it costs, and how it reaches your product.

## Do we get the images and slides, or only the reports?

Both are requested. Tavrn requests the imaging report and the DICOM study from the imaging center that holds it, and the pathology report, with slides or blocks, from the lab for your pathologist’s re-read.

## Do we need a treatment relationship with the patient?

No. Records are released to you under the patient’s signed HIPAA authorization, which names your organization and the purpose of use. Research and navigation requests do not depend on a treatment relationship.

## Can we request records for research rather than treatment?

Yes, when the patient’s authorization describes the study; it may run to the study’s end and combine with informed consent. Research is not among the reasons the national networks list for sharing records; your request runs on the patient’s authorization.

## How long does it take to get records back?

Each provider’s own clock. Tavrn follows up every 48 hours and shows each provider’s status on the request.

## What do providers charge for records, and who pays them?

Fees follow each state’s schedule. Tavrn pays each invoice and passes it through at cost.

## How do records and status updates reach our product?

Your product can order by API or by spreadsheet upload, get a webhook on every status change, and download the records with the same key or by SFTP.

## Can you request records from substance-use treatment programs?

Yes, on the patient’s written consent. A federally assisted substance-use program releases records to a third party on a consent that meets 42 CFR Part 2, naming the program, recipient, information and purpose. Tavrn requests them on that consent.

## Will Tavrn sign a BAA with our company?

A Business Associate Agreement is available on request and is reviewed with your team as part of the security review, alongside the documents on the trust center.

SOC 2 Type 1 and Type 2 reports, a HIPAA attestation, and Tavrn’s security policies are on the trust center, shared once a request is approved. More on the security page.

## Book a demo

See a request go out and the records come back.

[Book a demo](https://www.tavrn.ai/demo)