TL;DR
- A canvass confirms that treatment happened and where. Records retrieval obtains the actual charts.
- Canvassing exchanges no protected health information, so it needs no HIPAA authorization. Retrieval pulls clinical records and requires a signed release.
- Pull records before you canvass and you pay retrieval fees to facilities that never treated the claimant.
- Canvass first. Retrieve only on confirmed hits, scoped to the facilities the canvass verified.
What Each Process Actually Does
Medical canvassing is a desktop survey that contacts hospitals, clinics, and pharmacies inside a defined radius around a claimant to confirm one thing: whether treatment happened, and if so, where and on what dates. The canvasser never pulls a chart, reads a diagnosis, or asks what was treated. The output is a list of confirmed facilities and dates of service, plus the negatives, meaning the facilities in radius that reported no record at all. A documented "no treatment" across every facility is itself a finding, not a dead end.
Because the inquiry stops at existence and timing, no protected health information changes hands. A facility confirming that a claimant visited on a given date discloses nothing about diagnoses, test results, or billing, so it needs no signed release to answer (LCS Record Retrieval). Canvassing operates inside HIPAA by design, not around it.
Records retrieval is the opposite end of the same workflow. You go to the custodian of records at a confirmed facility and request the full clinical file, including physician notes, imaging reports, lab results, surgical and discharge summaries, and billing documentation (recordrs.com). Every one of those documents is PHI, so a signed HIPAA authorization, a court order, or a properly served subpoena must be in hand before a custodian can produce anything (lexitaslegal.com).
One distinction decides which needs authorization and which comes first: a canvass moves a yes or no, retrieval moves the contents of the visit itself.
How HIPAA Applies Differently to Each
Whether HIPAA governs a request comes down to whether the inquiry produces protected health information. A canvass asks a facility one question: did this person receive treatment here, and on what dates? A confirmed date and provider name fall outside protected clinical content, so no PHI changes hands and no signed authorization is required (legalcopyservices.com). When the canvass returns a "no," there is no PHI at all, because the claimant was never a patient at that facility (intertelinc.com).
Records retrieval sits on the other side of that line because it asks for the chart itself. Treatment notes, diagnoses, imaging reports, and billing detail all qualify as PHI under federal law, and a custodian cannot release any of it without a valid signed authorization (lexitaslegal.com). A compliant release names the patient, describes the records and purpose, and carries an expiration date. Without it, your only paths are a court order or a properly served subpoena.
Reading a canvass as a workaround gets the logic backward. Compliance is built into what the inquiry is allowed to ask, and the line is clear: the moment a canvasser asks for a diagnosis or a test result, the request needs the same authorization a records request does.
| Step | PHI exchanged? | HIPAA authorization required? |
|---|---|---|
| Medical canvass (yes/no) | No | No |
| Records retrieval (full records) | Yes | Yes, signed release required |
A canvass gathers what you can without consent. Retrieval handles everything that needs it, scoped to the facilities the canvass confirmed.
Why Canvassing Comes First in the Investigation Sequence
Experienced adjusters order a canvass the moment a claim shows one of three patterns, and they order it before the file picks a direction. Soft-tissue and other subjective injuries top the list because no imaging exists to verify them independently. A strained back or a whiplash complaint leaves nothing for you to corroborate from inside the chart, so the first question worth answering is whether the claimant saw a provider at all, and where. A canvass settles that without touching a single clinical note.
Claimant memory gaps trigger the second referral pattern. When the insured cannot give you an accurate treatment history, you cannot scope a records request, because you do not know which custodians to contact. A canvass frames the inquiry as fact-finding rather than suspicion, which matters when you reopen the file later. It builds the facility list the claimant could not, and it does so without implying you doubt them.
Suspected misrepresentation is the third pattern, and it cuts both ways. Avoidance of diagnostic procedures or statements that shift between recorded interviews are the usual indicators. A canvass can confirm no wrongdoing as cleanly as it surfaces fraud, which is why running it early protects the carrier from baking an assumption into the file too soon. Findings that arrive before the claim direction hardens prevent the downstream rework that comes from chasing the wrong theory.
A clean canvass returns a confirmed facility list scoped to where the claimant lives and where the injury allegedly happened, with dates of service, provider identity with NPI numbers, and a treatment timeline you can lay against the loss date. Prior-claim history and earlier treatment for similar injuries come back too — the detail that separates a pre-existing condition from an incident-related one.
None of that requires a HIPAA release, because none of it touches PHI. Filing a records request before the canvass returns means guessing at custodians and authorizing releases you may never use. The canvass tells you exactly where to send the authorization, and on which claims an authorization is worth filing at all.
When Records Retrieval Follows a Positive Canvass Hit
A confirmed treatment location hands you a decision, not an automatic records pull. Once a canvass returns a verified facility, you have three ways to escalate, and the right one depends on whether the claimant cooperates and how contested the claim is.
The default path is an authorization request. You send the claimant a signed HIPAA release naming the confirmed facilities, then forward it to each custodian of records. A compliant authorization carries the patient's full name, date of birth, a clear description of the records and their purpose, and an expiration date. Minor errors like a missing signature or wrong provider detail get the request rejected, so adjusters who rush this step lose days to resubmission.
The second path applies when the claimant refuses to sign or the matter is already in litigation. Here you obtain records through a court order or a properly served subpoena. Some custodians will only produce records on a subpoena that carries a judge's signature, so plan for that friction in adversarial claims.
The third path skips retrieval altogether for now. A positive hit at a facility the claimant denied visiting, or a treatment date that contradicts the loss timeline, often reads as a referral signal for surveillance or SIU rather than a clean chart request. You may want surveillance findings or a recorded statement in hand before you tip your interest by filing requests.
Build your timeline around custodian reality. HIPAA gives providers up to 30 days to respond, and some states impose shorter windows. Hospitals typically return records in 10 to 15 business days, while clinics and private practices run faster but less predictably. Without active follow-up, many requests stretch to several weeks, so treat the authorization date as the start of a managed queue, not a finished task.
The Cost and Timing Consequences of Getting the Sequence Wrong
Pulling records before you canvass means paying custodians who have no record of your claimant. Every retrieval request carries a fee and an administrative tail, and a request filed against a facility where treatment never occurred returns nothing useful while still consuming both. A claimant moves, treats out of state, or names a facility that turns out to be wrong, and you have committed days of follow-up to a custodian contact that was never going to resolve.
The delays compound because unproductive requests do not fail fast. A custodian sitting on the standard HIPAA response window can take up to 30 days before confirming there is nothing to send, and hospitals run 10 to 15 business days even when records exist. Blind retrieval spends that window on facilities a canvass would have eliminated in the scoping phase. A prior canvass narrows the request list to verified treatment locations, so the retrieval fees and the wait both attach only to facilities that actually hold something.
Litigated claims carry a sharper version of the same risk. Incomplete canvassing before opposing counsel enters discovery means you may not know the full treatment history when records start moving, and damaging pre-existing conditions or contradictory evidence can surface after they are already in opposing counsel's hands. Discovering a prior injury at the wrong moment changes your settlement posture after the leverage has already shifted away from you. A complete canvass establishes the treatment timeline and distinguishes pre-existing from incident-related conditions before a single records request is filed, which is exactly when that knowledge is worth the most.
The escalation order also protects your budget on every other front. Each step beyond the canvass adds cost and intrusiveness, and a canvass ordered after surveillance and authorizations are already in motion often confirms what those later steps could have skipped.
Where Canvassing Sits in the Modern Claims Workflow
The decision to canvass is rarely the hard part. The bottleneck shows up after it, when a single claim fans out into dozens of separate facility contacts across a geographic radius, each on its own phone tree, each resolving on its own schedule.
The fan-out turns canvassing into a throughput problem. Every hospital, urgent care, specialty clinic, and pharmacy in the target radius needs a separate inquiry, and each one returns a confirmed treatment, a documented negative, or an unresolved contact you have to chase. Human-only canvassing hits a ceiling here. A caller can only work so many facilities at once, so the per-canvass cost climbs and the calendar stretches as volume rises. Ontellus and most established providers still run canvassing as a human-staffed service, which is why turnaround often gets settled in contract negotiation rather than published as a committed SLA.
Superunit attacks the outreach layer specifically. Its medical canvassing runs the parallel contacts that a human team works sequentially, so dozens of facilities in a radius get reached at once instead of one after another. Capacity here is not tied to how many callers you have on a given day, which removes the staffing volatility that drags canvass turnaround during high-volume periods.
The scoping logic stays the same regardless of who runs it. You still map the radius, build the facility list, and log every response with timestamps and verbatim language. How fast that list clears is what changes, and a faster clear means records requests get filed against confirmed custodians sooner.
FAQs
Can a canvass be used as a substitute for records retrieval? No. A canvass confirms whether and where treatment occurred, but it never pulls the clinical content inside the chart. Once you need diagnoses, treatment notes, or billing detail to evaluate the claim, you have to order records retrieval against the facilities the canvass confirmed.
Does canvassing require patient consent or a HIPAA authorization? No. A canvass asks a yes-or-no question about whether treatment happened, which produces no protected health information, so no signed release is required. The moment an inquiry reaches for diagnoses, test results, or any clinical record, it crosses into PHI and a signed HIPAA authorization or subpoena becomes mandatory.
How long does a canvass take compared to records retrieval? A canvass resolves faster because each facility only has to confirm or deny treatment, though a single claim can involve dozens of parallel contacts each closing at its own pace. Records retrieval runs longer. Hospitals typically take 10 to 15 business days, and HIPAA gives custodians up to 30 days to respond to a valid request.
What happens if a canvass returns no treatment found? A confirmed "no record" across every facility in radius is itself a finding, not a dead end. When a claimant alleges injury but no facility in the area treated them, that documented negative directly contradicts the claim. You log it with timestamps and outreach method, because a verbal negative without written backup will not hold up.
Can I order a canvass and records retrieval simultaneously? You can, but you usually shouldn't. Ordering both at once means filing retrieval requests against facilities that may have no record of the claimant, which wastes custodian fees and time on unproductive contacts. The canvass exists to scope the retrieval, so running them in parallel discards the savings that correct sequencing produces.