How HEDIS Medical Record Review Works Each Season

HEDIS medical record review is the part of a health plan's quality reporting where staff pull a sample of member charts from provider offices and read them for evidence that a service or result happened. It applies to hybrid measures, runs from winter into late spring, and ends with abstraction, an overread and the plan's June submission.

What HEDIS medical record review measures

HEDIS medical record review measures care that claims data cannot show on its own. HEDIS is NCQA's set of health plan performance measures, and most of it is reported from claims and enrollment data. A smaller group, the hybrid measures, lets a plan add evidence found in a sample of members' medical records.

The NCQA HEDIS overview says HEDIS includes "more than 90 measures across 6 domains of care" and that more than 235 million people are enrolled in plans that report HEDIS results. Most of those measures never require a chart.

NCQA's October 2025 special report, Results for Measures Leveraging Electronic Clinical Data for HEDIS, explains the difference. It describes the Administrative Method as reporting from "claims for health care services and enrollment files". It then says some measure concepts cannot be evaluated using administrative data alone, so plans "pull a systematic sample of medical records and review information manually", which NCQA calls the Hybrid Method. The same report says the hybrid method calculates performance on a sample of 411 records.

The reason is simple. A claim shows that a visit happened. It often does not show the blood pressure reading taken at that visit, or the result of a test done elsewhere. When the measure depends on a value or a note, the chart is where the proof sits.

Which measures still use the hybrid method

The same NCQA report lists eight measures that still allowed hybrid reporting as of HEDIS measurement year (MY) 2025: Lead Screening in Children; Weight Assessment and Counseling for Nutrition and Physical Activity for Children and Adolescents; Prenatal and Postpartum Care; Blood Pressure Control for Patients with Diabetes; Controlling High Blood Pressure; Glycemic Status Assessment for Patients With Diabetes; Transitions of Care; and Care for Older Adults.

That list is shrinking. NCQA's HEDIS ECDS reporting page says NCQA "announced a planned transition to remove the Hybrid method by MY 2029" and that the MY 2029 endpoint remained unchanged after measure-specific pathways were refined in January 2026. Until then, chart review remains part of each season for plans that use it.

The HEDIS season timeline

The HEDIS season timeline runs from the end of the measurement year to the June submission. NCQA sets the submission dates; each plan schedules its own sampling, chart retrieval, abstraction and overread to fit inside them. Charts for measurement year 2026 are reviewed in the first half of 2027.

The table below combines NCQA's published dates with an example of how a plan might schedule its internal steps. Rows marked "NCQA" come from the NCQA HEDIS MY 2026 data submission timeline. Rows marked "example" are an illustration, not a rule, and each plan sets its own.

The NCQA rows are fixed for everyone. The example rows show why provider offices hear from plans most often between February and April: that window is what is left between sampling and the deadline.

HEDIS chart retrieval from provider offices

HEDIS chart retrieval is the step where a plan, or a vendor working for it, collects the sampled members' records from provider offices. It happens in four main ways: on-site visits, remote access to the office's EHR, fax, and secure upload. Most plans use all four, depending on the office's size and systems.

On-site retrieval. A retrieval specialist visits the office with a list of members and dates, pulls the relevant pages from paper charts or the EHR, and scans or prints them. This suits offices with many sampled members.

Remote EHR access. The office grants the plan's staff read-only access to its EHR for the season, so they can find and save the records themselves. It saves office staff time but requires an access agreement and account setup.

Fax. The plan sends a request listing the member, date of birth and the records needed, and the office faxes them back. Fax remains common for small offices with few sampled members.

Upload. The office uploads records to a plan or vendor portal. Upload keeps page order and quality better than fax.

Offices often ask whether they need the patient's permission. The HIPAA Privacy Rule defines health care operations in 45 CFR 164.501 on the eCFR to include "conducting quality assessment and improvement activities", and 45 CFR 164.506 on the eCFR sets out when one covered entity may disclose records to another for that entity's health care operations. Whether a given request fits is a question for the office's privacy officer.

What counts as proof in a HEDIS chart?

Proof in a HEDIS chart is documentation that ties a specific member to a specific service or result on a date inside the window the measure allows. An abstractor needs to see who the patient was, what was done or measured, when, and who recorded it. The measure's specification decides which of those details are required.

NCQA publishes the exact rules for each measure in its technical specifications for health plans, which its blood pressure measures page promotes as a volume in the NCQA store. This post does not restate them, because they change each year and differ by measure. The four elements below are what abstractors look for across measures.

Member identity. Each page should carry the patient's name and a second identifier, usually a date of birth. A page with only a first name, or a page separated from its header, may not count.

The service or the value. The note must show the service itself, such as a screening, a test result or a counseling note, not only a plan to do it. An order for a lab test is not a result.

The date. The date of service must fall inside the measurement period the specification sets. Undated entries, or entries dated only by a fax header, cause problems.

The author. A signature and credentials on the note show who recorded it. When the specification says anything about who may document the evidence, this is the detail the abstractor checks against it.

A fictional example: for a member listed as Jordan Ellis, born 07/22/1958, member ID H00419382 (all values made up), the abstractor finds a progress note dated 09/18/2026 with a recorded result, the patient's name and date of birth in the header, and a signed provider name. That page answers all four questions. A lab printout for the same patient with no date in the body answers only two.

HEDIS abstraction errors that fail overread

HEDIS abstraction errors are mistakes an abstractor makes when recording what a chart proves, and the overread exists to catch them. An overread is a second, independent review of a sample of abstracted charts. The errors it finds most often are a wrong date window, a missing result, and evidence that belongs to a different member.

Wrong date window. The abstractor records a result from December of the year before the measurement year, because the note was filed in the current year's folder. The service happened, but not in the window.

Missing result. The chart says "A1c ordered" or "BP checked", and the abstractor counts it as done. Without the value, the evidence is incomplete for any measure that needs one.

Wrong member. Two family members share a last name and an address, and a page from one chart is filed in the other. The abstractor credits the wrong person. Checking the date of birth on every page used as evidence prevents this.

Copied-forward text. EHR templates sometimes carry text from an earlier visit into a new note. A finding that appears word for word across several visits may describe the first visit, not the current one.

Unreadable pages. A faxed page with a value that could be a 7 or a 1 should not be guessed. The abstractor should flag it for the overread or request a clearer copy.

Every one of these is an error of reading, not of judgment, which is why a second reader catches them. The principles behind sending uncertain values to a person instead of accepting them are covered in the human review category. Schema Care applies the same idea to medical records it reads: encounter dates, problem lists, allergies and vitals each come back with a confidence score, and a reviewer confirms the uncertain ones on the highlighted page, as the human review workflow shows.

How can providers make HEDIS review easier?

Providers make HEDIS review easier by keeping each chart complete, dated and identifiable, and by answering chart requests quickly and in the format asked. A prompt, complete response means fewer follow-up calls during the busiest weeks of the season and fewer charts sent twice.

Answer the request as written. Send the records for the member, date of birth and date range listed, with the request letter on top. Extra pages slow the abstractor and do not help the measure.

Keep results with the note. When a test is done elsewhere, file the result where the next visit note can refer to it, with its date. A result mentioned only in passing ("labs fine") gives the abstractor no value or date to record.

Put identifiers on every page. EHR printouts usually do this. Scanned outside records often do not, so stamping or labelling them at intake helps.

Name one contact. A single person who handles quality requests can see that three plans asked for the same patient and prepare the chart once.

Log what you sent. Record the requester, the date and the pages. When the same plan asks again later, the log shows what is already with them.

HEDIS is one of several reasons a plan asks for charts. Risk adjustment coders read charts for a different purpose, explained in the section on risk adjustment chart review at a health plan. Medicare medical review asks for records with a fixed deadline, and the Medicare ADR checklist covers how to answer one. A commercial plan's audit is different again, and the guide to responding to a payer records audit walks through it.