Medical record retrieval services obtain copies of a person's medical records from hospitals, clinics and other providers on behalf of a law firm, insurer or other requester. They locate each provider, send the request with a valid authorization or subpoena, follow up until records arrive, pay copy fees, check what came back and deliver it.
What medical record retrieval services include
The scope of medical record retrieval services usually covers five jobs: locating the right provider and records office, sending each request, following up until the provider responds, paying the provider's copy fees, and checking the records for completeness before delivery. A retrieval service is an outside company that does these jobs for a requester.
Locating the provider is harder than it sounds. A clinic named in a client interview may have merged, moved its records to a parent health system, or handed release of information to a separate copy vendor. A hospital may keep imaging, billing and clinical records in three different departments with three different request addresses.
Sending the request means matching it to the provider's rules: their form or a general authorization, the delivery method they accept, and any prepayment they require. Following up means calling or writing on a schedule until the records arrive or the provider gives a reason they will not.
Copy fees are part of the work. When patients request copies of their own records, 45 CFR 164.524 on the eCFR limits the provider to a reasonable, cost-based fee covering only labor for copying, supplies, postage and, if agreed, preparing a summary. Requests made by a third party under an authorization or subpoena are not described by that paragraph, and state law can also apply, so a service should show each fee it passes through.
Quality checking closes the loop. The service compares what arrived with what was asked for, flags missing dates or record types, and sends a follow-up before calling the request complete.
Retrieval services for law firms and mass torts
Retrieval services for law firms and mass torts handle volume that a firm's own staff rarely can: many plaintiffs, each with many providers, all with deadlines set by a court or a settlement program. In mass tort work, a single case inventory can mean hundreds of requests running at once, each needing its own authorization and its own follow-up.
For a single injury case, the work is a handful of providers for one client. A service mainly saves staff time on follow-up calls. For a mass tort, the service also has to keep a clean link between each plaintiff, each provider and each document, because records filed under the wrong plaintiff create real problems later.
Three features matter more at volume. Batch intake lets the firm send a spreadsheet of plaintiffs and providers rather than one form at a time. Status reporting by plaintiff and by provider lets the case team see which files are ready. Consistent file naming, with plaintiff, provider and date range in each file name, keeps records findable.
In litigation, a request to a non-party provider may go out by subpoena instead of authorization. The Federal Rules of Civil Procedure, Rule 45 describes a subpoena that commands a person to produce designated documents in their possession, custody or control, and it requires the party or attorney who issues one to take reasonable steps to avoid imposing undue burden or expense on the person subject to it. Whether to use a subpoena or an authorization is the firm's decision.
What a retrieval service needs from you to start
A retrieval service needs four things from you to start: a signed authorization or other legal basis for each request, a list of providers with whatever contact details you have, the date range of records you want, and the delivery format you expect. Missing any one of them is the most common cause of a slow first week.
The authorization has to be valid when the provider reads it. 45 CFR 164.508 on the eCFR lists the core elements a valid authorization must contain. It also says an authorization is not valid once its expiration date has passed or when it is known to have been revoked. What a retrieval request's authorization should cover is explained in the guide to which authorization a records retrieval request needs.
The provider list can be rough. A name and a city is often enough for the service to find the records office. Add anything you know: the treating doctor, the dates of treatment, an account number from a bill.
The date range keeps the request narrow. "All records" invites delay and higher copy fees from a large hospital. A range such as "2022-03-01 to present" is easier to fulfill and to check.
The delivery format includes the file type, how files should be split and named, and whether you want billing records, imaging reports or images in separate files.
Why a first request comes back rejected
Most rejected first requests trace back to the starting materials, not to the service. The same section of 164.508 says an authorization is not valid if it has not been filled out completely for a required element, so a blank expiration line or a missing signature date can send the request straight back. A name that does not match the provider's chart, such as a maiden name or a missing middle initial, is another common cause. Give the service every name the patient has used and a date of birth.
Scope is a quieter cause. An authorization that names "Lakeside Hospital" may not reach records held by a separately owned imaging group in the same building. A date range that starts after the first visit leaves out the visit you most need. Read each authorization against the provider list before you send it, because a corrected form adds a second round of signatures and mailing to the timeline.
Finally, check who the authorization names as the recipient. If it names the law firm and the service will receive the records directly, ask the service whether that provider will accept it or whether a new form is needed.
What should a retrieval service deliver at the end?
A retrieval service should deliver the records themselves in an agreed file format, any certification of records the provider issued, and a status history for every request. Together these show what was received, from whom, when, and what is still outstanding or confirmed not to exist.
The records usually arrive as searchable PDF files, one per provider or per request, named in a consistent pattern. Ask whether the service applies OCR so the text can be searched, and whether it keeps the provider's original file alongside any processed copy.
A records certification is a statement from the provider's custodian about how the records were made and kept. The Federal Rules of Evidence, Rule 902, at paragraph (11), describes a custodian's certification for domestic business records. Not every request needs one, so say up front whether you do.
The status history is the record of the work. It lists the date each request was sent, each follow-up, each fee paid, the date records arrived and any problems. When a provider says it has no records, the history should include that response in writing.
Plan for what happens after delivery. Records from many providers usually need duplicate pages removed and missing visits found before anyone reviews them. Once records are in hand, Schema Care can read the billing statements and medical records in them into structured fields such as charges, balances and encounter dates, as the homepage list of supported documents shows.
How do retrieval services track each request?
Retrieval services track each request through a series of statuses, from sent to received, with a follow-up on a set schedule and a note for every contact with the provider. The client sees this as a status report, either a portal view or a regular report, showing where each provider stands.
Here is an example status report for one request covering five providers. The patient, providers and dates are fictional.
| Provider (example) | Sent | Last follow-up | Status | Next step |
|---|---|---|---|---|
| Lakeside Hospital | 2026-06-02 | 2026-06-23 | Fee invoice received | Pay fee; records expected after payment |
| Northfield Orthopedics | 2026-06-02 | 2026-06-16 | Records received, 210 pages | Quality check against date range |
| Northfield Imaging | 2026-06-02 | 2026-06-23 | Rejected: authorization lacks expiration date | Send corrected authorization to client for signature |
| Lakeside Physical Therapy | 2026-06-02 | 2026-06-30 | No response | Third follow-up call; escalate to practice manager |
| Riverbend Primary Care | 2026-06-02 | 2026-06-20 | No records for date range | Written no-records response filed |
A useful status report answers three questions at a glance: what is done, what is waiting on the provider, and what is waiting on you. The third question matters most, because a rejected authorization or an unpaid fee stops the clock until the client acts.
Ask how often follow-ups happen and what triggers an escalation. When a patient makes an access request, 45 CFR 164.524 requires the provider to act within 30 days after receipt, with one written extension of up to 30 more days. That gives a natural point for a firmer follow-up on such requests.
When a retrieval service is the wrong choice
A retrieval service is the wrong choice when the request is simple enough that its fee and lead time outweigh the work it saves. Common examples are a single provider the requester already knows, or a patient who can download their own records from a patient portal and forward them.
A single known provider is often quicker to handle directly. One letter, one fee and one follow-up call rarely justify onboarding a vendor, sending them authorizations and waiting for them to start.
A patient with portal access can often get visit notes, lab results and visit summaries the same day. Portal downloads may not include everything, such as imaging or older records, so a request may still be needed for those parts, but the portal can cover the bulk.
A firm with a few repeat providers and staff who know their records offices may also be better off in-house. The trade-offs between keeping retrieval inside the firm and sending it out are worked through in the guide to outsourcing medical records retrieval. Cost is the other side of the decision, and the comparison of medical record retrieval pricing models sets out how fees are usually structured.
When a service does fit, the next step is choosing one, and the guide on criteria for comparing medical record retrieval companies covers what to evaluate. Background on authorizations, business associates and protected health information sits in the HIPAA and PHI category.