To compare medical record retrieval companies, score each one on the same five criteria: provider coverage, turnaround speed, status reporting, security, and pricing clarity. Weight the criteria by what your work needs, ask every company the same questions, check their security terms in writing, and test them on a small batch before signing a long contract.
Criteria for comparing medical record retrieval companies
The criteria for comparing medical record retrieval companies are coverage, speed, reporting, security and pricing clarity. Coverage is where they can get records, speed is how long it takes, reporting is how well you can see progress, security is how they protect the records, and pricing clarity is whether you can predict the bill.
What a retrieval company does day to day, from locating providers to checking what comes back, is described in the guide to what medical record retrieval services include. This post assumes you already want one and need to choose.
Weight the criteria before you talk to anyone. A firm with a mass tort inventory across many states may put coverage first. A firm with trial dates may put speed first. A firm whose clients include health care providers may put security first. Writing the weights down early keeps a polished sales call from reshaping your priorities.
Score each company from 1 to 5 on each criterion, multiply by the weight, and add the results. Here is an example scorecard for three fictional companies. The names, scores and weights are invented for illustration.
| Criterion | Weight (example) | Example Co. A | Example Co. B | Example Co. C |
|---|---|---|---|---|
| Coverage | 25% | 5 | 3 | 4 |
| Speed | 20% | 3 | 4 | 5 |
| Reporting | 20% | 4 | 5 | 2 |
| Security | 20% | 4 | 4 | 3 |
| Pricing clarity | 15% | 2 | 4 | 5 |
| Weighted score | 100% | 3.75 | 3.95 | 3.75 |
In this example, Example Co. B wins narrowly without leading on coverage or speed, because it has no weak criterion. Example Co. A and Example Co. C tie, but for opposite reasons: A covers more providers but bills unpredictably, while C is fast and clear on price but reports poorly. A tie like that is a signal to ask which weakness your team can live with.
Score from evidence, not claims. A sample status report, a fee schedule and a copy of the contract are better inputs than a slide that says "nationwide" or "fast".
Scoring a trial batch
A trial batch turns the scorecard from a guess into a measurement. Pick ten to twenty real requests that look like your usual work, including at least one hard provider, such as a large hospital system or a practice that has closed. Send the same set to each finalist if your clients' authorizations allow it, or split the set evenly if they do not.
Record the same facts for every request: the date it was sent to the company, the date the company sent it to the provider, every status update, the date records arrived, the invoice and whether the records matched the date range asked for. Those facts fill four of the five scorecard rows directly. Security is the one row the trial cannot measure, so score it from the documents described below.
Rescore after the trial and compare with the scores from the sales calls. A large drop on any criterion tells you more than the totals do. A company that scored 5 on reporting from its sample report but sent no updates during the trial has shown you what the next year will look like.
Questions to ask a medical chart retrieval company
The questions to ask a medical chart retrieval company on a sales call should produce answers you can check later: documents, sample reports, written fee schedules and named contacts. Ask every company the same list so the answers can go straight into the scorecard.
Here is a question list grouped by criterion.
Coverage
- Which states and provider types do you request from regularly?
- How do you find a provider that has closed, merged or moved its records?
- Do you handle imaging, billing and pharmacy records, or clinical notes only?
Speed
- What is your typical time from request to delivery, and how do you measure it?
- Do you offer rush handling, what does it cost, and what does it change?
- How soon after we send an authorization does the first request go out?
Reporting
- Can we see a sample status report with the client details removed?
- How often do you follow up with a provider that has not responded?
- How do you tell us that something is waiting on us, such as a new authorization?
Security
- Will you sign a business associate agreement where one applies, and what written safeguard terms do you give clients that are not covered entities?
- Who on your staff can open our files, and how is that controlled?
- How are records delivered to us, and how long do you keep them afterwards?
Pricing
- What is your fee for each request, and what is passed through from the provider?
- Are there charges for follow-ups, failed requests, certifications or rush handling?
- What is the minimum term, and how do we end the contract?
Write down who answered and when. If an answer changes between the call and the contract, the notes show it.
How do retrieval companies differ in coverage and speed?
Retrieval companies differ in coverage and speed mainly by their footprint and their relationships. National companies can request from providers anywhere but may route every request through a central team. Regional companies cover fewer states but may know local records offices well enough to get faster answers.
Provider relationships matter because records offices vary. Some respond quickly to a known requester, some route requests to their own copy vendor, and some only accept their own forms. A company that already knows a provider's form, fee and preferred delivery method avoids a rejected first attempt.
Speed has two parts the company controls and one it does not. It controls how fast the first request goes out and how often it follows up. It does not control how quickly the provider responds. When a patient makes a request for their own records, 45 CFR 164.524 on the eCFR sets a 30-day window after receipt for the provider to act, with one written extension of up to 30 days. Be wary of turnaround promises that sound faster than the provider can be made to move.
Rush handling usually means priority follow-up, phone calls instead of letters, and sometimes paying a provider's expedite fee. Ask what the company does differently for a rush and what it cannot change.
When you score coverage and speed, ask for the company's own figures on recent work for providers like yours, and record whether they gave a measured number or an estimate.
What security should a record retrieval company prove?
A record retrieval company should prove its security with documents: a business associate agreement when it works on behalf of a covered entity, written terms on who can access records and how, and a clear description of how files reach you and when they are deleted. A sales promise is not proof.
Whether a business associate agreement applies depends on who the company works for. Under 45 CFR 160.103 on the eCFR, a business associate is a person who creates, receives, maintains or transmits protected health information on behalf of a covered entity for a regulated function, or who provides listed services to a covered entity that involve such information. A retrieval company hired by a hospital or health plan may meet that definition. One hired by a law firm on a patient's authorization may not. General background on business associate agreements is collected in the HIPAA and PHI category.
Where an agreement does apply, 45 CFR 164.504 on the eCFR, at paragraph (e)(2), lists what it must contain. Among other terms, the business associate must use appropriate safeguards, report uses or disclosures not allowed by the contract, make sure its subcontractors agree to the same restrictions, and return or destroy the information at termination if feasible. Read the company's agreement against that list.
Access controls are the second check. Ask who can open your clients' records, whether access is limited to staff working on your requests, and whether you can get a record of who opened what. Ask for the answers in the contract or a written policy.
Delivery and retention are the third. Ask how records are sent to you, whether through a portal, a secure link or another method, and how long the company keeps copies after delivery. Get the deletion schedule in writing.
The same document check applies to any vendor that will hold patient records, including the software you use after retrieval. Schema Care, for example, states on its compliance section that it accepts no real patient data until a BAA is signed, and every paid plan includes one.
Retrieval company red flags and contract mistakes
The main red flags when comparing retrieval companies are vague fees, no regular status reporting, and contract terms that renew automatically or are hard to exit. Each one shifts cost or risk to you in a way that is easy to miss when the sales call goes well.
Vague fees show up as a single per-request price with exceptions buried later: extra charges for follow-ups, for requests the provider rejects, for certifications or for pass-through copy fees with a markup. Ask for a written fee schedule that covers every charge you might see, and compare it with a real invoice from the trial batch. How these fees are usually structured is set out in the guide to medical record retrieval cost.
No status reporting means you learn about a problem only when a deadline is close. A company that cannot show a sample status report, or that reports only when records arrive, scores low on reporting no matter how fast it claims to be.
Auto-renewing terms are a contract mistake more than a red flag. A one-year term that renews unless cancelled within a short window can lock you in after a poor trial. Look for a clear notice period, a way to end the contract for poor performance, and a promise to return or delete your records when it ends.
Two other mistakes are common. The first is signing before testing. Send a small batch of real requests to your top two companies and score the results against your scorecard. The second is comparing price alone. A cheap company that loses a month on a rejected authorization can cost more than a careful one. Whether to use a company at all, or keep the work inside your firm, is the subject of the guide to outsourcing medical records retrieval.