Medical record retrieval is the step where a claim stops running on assumptions. A canvass tells you a claimant was treated somewhere. The records tell you what was actually diagnosed, when, and by whom. That is what a compensability decision, an apportionment argument, or a fraud referral finally rests on.
It is also the step most likely to sit open for months while nobody can say why.
TL;DR
Medical records retrieval is the process of obtaining a claimant's or plaintiff's actual medical charts from the providers who treated them. It requires a signed HIPAA authorization or a subpoena — unlike a medical canvass, which only confirms whether and where treatment happened.
The 30-day HIPAA deadline nearly every guide cites applies to patients requesting their own records under 45 CFR § 164.524. It does not apply to third-party requests made under a § 164.508 authorization — the kind carriers, TPAs, and law firms actually send. Those carry no federal deadline at all.
In practice: 7–14 days from a small practice, 30–60 from a hospital system, and 90 days or more from a large integrated system. Cost is a per-request retrieval fee plus per-page copying charges, and since Ciox Health, LLC v. Azar (2020) the federal fee caps no longer protect third-party requesters. The single largest variable in your timeline is not the provider. It is how often somebody follows up.
What Medical Records Retrieval Is, and What It Isn't
Records retrieval is the act of requesting, chasing, obtaining, and verifying a complete set of medical records from a specific provider for a specific person over a specific date range.
It gets confused with three neighbouring things, and the distinction matters because each has a different legal basis and a different price:
| Process | What you get | What it requires | Typical cost basis |
|---|---|---|---|
| Medical canvass | Whether, when, and where treatment occurred | Nothing — no PHI is disclosed | Per location contacted |
| Records retrieval | The actual charts, notes, imaging reports, billing | Signed authorization or subpoena | Per request + per page |
| Record summary / review | A narrative or chronology built from the charts | The records already in hand | Per page or per hour |
| IME | An independent physician's opinion | Scheduling and examination | Per examination |
The sequence matters. Canvassing first, retrieval second, examination last, because each step narrows the expense of the next. We covered the ordering logic in detail in medical canvassing vs. records retrieval vs. IME; the short version is that retrieving records from forty providers because you don't know which one treated the claimant is the most expensive possible way to answer a question a canvass answers for a fraction of the cost.
Retrieval is also not a single transaction. It is a campaign. That framing explains most of what goes wrong with it.
What You Need Before You Can Request Anything
There are exactly three lawful routes to another person's medical records, and picking the wrong one restarts your clock.
A HIPAA authorization signed by the patient. This is the workhorse for claims work. Under 45 CFR § 164.508, a valid authorization has to contain six elements: a description of the information to be disclosed, who is authorized to disclose it, who is authorized to receive it, the purpose, an expiration date or triggering event, and the patient's signature and date. Miss one and the provider is entitled to reject it. Many will, after sitting on it for three weeks first.
A subpoena or court order. Slower and more expensive, but it does not depend on the claimant's cooperation. Some providers, particularly large systems and behavioural health facilities, will insist on one regardless of what authorization you hold.
A state-specific form. Several states, and a great many individual health systems, require their own release form rather than a generic one. This is the single most common avoidable rejection: a technically valid HIPAA authorization returned because the custodian wants their own paperwork.
Two categories of record carry extra protection almost everywhere and need explicit, separate consent: substance use disorder treatment records under 42 CFR Part 2, and mental health or psychotherapy notes. A general authorization does not reach them. If your claim involves either, plan for a second request.
The Six Steps of a Retrieval Request
- Identify the provider precisely. Not "the orthopedist in Tampa," but the legal entity name, the correct location, and the fax number the records department actually monitors. Practices merge, relocate, and rebrand constantly, and a request sent to a closed location simply vanishes.
- Confirm who the custodian is. The treating physician does not control record release. The custodian does, and at a hospital that is the Health Information Management department, not the clinic you called.
- Submit with the right paperwork. Correct authorization or subpoena, correct form, correct date range, correct channel. Most providers still prefer fax.
- Follow up. Repeatedly. This is the step that determines your turnaround, and it is the step almost every workflow under-resources.
- Receive and pay. Records arrive with an invoice for retrieval and copying. Payment is often a precondition of release.
- Verify completeness. Check the date range you asked for against the date range you received. Partial productions are extremely common and, if unnoticed, quietly undermine whatever decision you build on them.
Step 6 gets skipped under time pressure more than any other, and it is the one that costs the most later. A chart that stops six weeks before the date you actually needed is worse than no chart, because it looks like an answer.
Who the Records Custodian Is, and Why They Control Your Timeline
A medical records custodian is the person or department legally responsible for maintaining and releasing a provider's records. At a solo practice it may be the office manager. At a hospital it is the HIM department. Increasingly, and this is the layer most requesters never learn about, it is an outsourced release-of-information vendor working under contract to the provider.
That third case changes your economics. An outsourced ROI vendor has its own fee schedule, its own turnaround targets, and no relationship with you. It processes requests in the order received and has no particular incentive to expedite yours.
Knowing which of the three you are dealing with before you send the request is worth more than any amount of chasing afterward. It tells you what form to use, what fee to expect, and whether a phone call will accomplish anything at all.
How Long It Actually Takes
Here is where most guidance on this topic is confidently wrong.
The widely repeated rule is that HIPAA gives a provider 30 days, extendable once by 30 more. That rule is real, and it lives at 45 CFR § 164.524. But it governs an individual's right to access their own records. The requests carriers, TPAs, and law firms send are third-party disclosures under § 164.508, and the regulation sets no response deadline for those at all. The authorization specifies an expiration date; it does not specify how fast the provider has to act.
So the honest answer is that there is no federal clock on your request. Some states impose their own deadlines, typically 15 to 30 days, and those do bind. Absent a state rule, you are relying on the custodian's workload and your own persistence.
| Provider type | Typical turnaround | Why |
|---|---|---|
| Small practice (1–5 providers) | 7–14 days | One person handles it; a phone call reaches them |
| Urgent care | 10–20 days | Often centralized across locations |
| Imaging centre | 10–21 days | Reports fast; actual studies slower |
| Hospital system | 30–60 days | HIM department queue, frequently outsourced |
| Large integrated system | 60–90+ days | High volume, strict process, no expediting |
| Behavioural health / SUD | 45–90+ days | 42 CFR Part 2 consent, often needs a subpoena |
Six months is not a horror story; it is a normal outcome at a large integrated system when nobody chases the request. And the reason is unglamorous. A request that receives one follow-up call every two weeks sits behind every request that receives one every other day, because queue position at a busy HIM department is substantially a function of who is asking.
What It Costs
A retrieval invoice has two or three components:
A retrieval or processing fee, generally $20–75 per request, charged by the provider or its ROI vendor.
Per-page copying charges, capped by state statute in most states, typically structured as a higher rate for the first tranche of pages and a lower rate thereafter. A 300-page hospital chart can produce copying charges well in excess of the retrieval fee.
Certification or affidavit fees, where you need a custodian-of-records affidavit for litigation use.
The federal fee caps do not help you here. In Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020), the court held that the fee limitation at 45 CFR § 164.524(c)(4), including the $6.50 flat-fee option for electronic copies, applies only to an individual requesting their own records, not to requests to transmit records to a third party. Providers and ROI vendors are therefore free to charge more than cost on the requests claims organizations actually make. That ruling is a large part of why third-party retrieval costs what it does.
One pricing detail worth pinning down in any vendor contract: most vendors bill for attempts, not successes. If 45% of requests ultimately produce records, a quoted per-request fee understates your real cost per obtained chart by more than double. Ask how "successful retrieval" is defined, in writing, before volume ramps.
Where Retrieval Breaks Down
Across claims organizations the same four failures recur, and none of them are really about the provider.
Inconsistent follow-up. The dominant cause of long timelines. Follow-up is unglamorous, easy to defer, and invisible until a file is 90 days old.
No status visibility. A requester who cannot see that nothing has happened cannot escalate. Silence from a vendor reads identically to silence from a provider, and the file ages either way.
Wrong paperwork, discovered late. A rejected authorization often surfaces three weeks in, and the clock restarts from zero.
Unverified completeness. Partial records accepted as complete. The most expensive failure, because it is the one nobody catches.
Notice that three of the four are follow-up and communication problems rather than access problems. The records were always obtainable. The process just didn't push.
And yes, fax. Healthcare still runs on it, and any retrieval operation that cannot originate, receive, and confirm faxes at volume is working with one hand tied. Phone reaches a human, fax satisfies the custodian's process, email carries the authorization. A serious retrieval workflow uses all three, per provider, depending on what that provider actually responds to.
How Superunit Handles Records Retrieval
Superunit automates medical canvassing and records retrieval with AI agents working by phone, fax, and email. The effect is scale without staffing: outreach and follow-up run across every open file at once, and the cost of doing that is the same at four hundred requests as at forty.
AI does not make a hospital HIM department move faster. Nothing does; that queue is set by their staffing and their process. What changes is the cadence on your side. An agent can re-contact every open request every other day rather than every second week.
Every contact attempt is also logged and transcribed, so "we're still waiting on the facility" becomes a timestamped record of who was called, when, and what they said. For a claims manager holding a 60-day-old file, that is the difference between escalating and hoping.
Where Human Investigators Still Win
Automation is the wrong tool for several parts of this work, and pretending otherwise wastes everyone's time.
Subpoena practice needs a person. Negotiating with a custodian who has decided to be difficult needs a person. Anything requiring physical presence, in-person credentialing, or judgment about a genuinely ambiguous record set needs a person. And where a client's master service agreement restricts AI involvement, which is common enough among large carriers to plan around, the work has to run through a human team regardless of capability.
The realistic division is that agents carry the volume and the cadence, and humans carry the exceptions and the escalations. Most retrieval work is volume and cadence.
Why Superunit Runs the Canvass First
Retrieval is the second step, not the first. Sending requests to every provider in a radius because you don't know which one treated the claimant is how retrieval budgets get consumed without producing answers.
Because Superunit runs both services, the canvass comes first — starting at $1.50 per location, roughly $45 for a standard 30-facility canvass — to establish where treatment actually happened. Records then get requested only from the providers that returned a hit, and the same parallel outreach that removes the headcount ceiling on canvassing carries the follow-up after it.
How to Evaluate a Retrieval Vendor
Most vendor comparisons in this category turn on price per request, which is the least useful number available. Five questions separate vendors more reliably:
How is "successful retrieval" defined, and do you bill attempts or successes? Get it in writing. This single definition can double or halve your effective cost per obtained chart, and it is where invoice disputes originate.
What is your follow-up cadence, and can I see it? Weekly follow-up and every-other-day follow-up produce materially different turnaround on the same request. A vendor who cannot state their cadence does not have one.
How do I get status without asking? If checking on an open request requires an email from your team, your team is the status system. Proactive reporting on no-movement files is worth more than a marginally lower fee, because it is what lets you escalate before a file is 90 days old.
Do provider fees pass through at cost, or are they marked up? Retrieval fees and statutory copying charges are the larger part of many invoices. A low headline rate with marked-up pass-throughs is more expensive than a higher rate at cost.
What is the audit trail? For anything heading toward litigation, you need to show what was requested, when, from whom, and what came back. Vendors vary enormously here, and the gap only becomes visible in a deposition.
Two structural questions matter at volume. Ask whether pricing changes between 40 requests a month and 400. A vendor whose model is staffed by headcount will price the second tier much higher, and one whose model isn't, won't. And ask about coverage outside your core geography, including Puerto Rico and international providers, which routinely appear in claims files and routinely stall vendors who have no process for them.
Frequently Asked Questions
Do I need a signed authorization for records retrieval? Yes. An authorization meeting the six requirements of 45 CFR § 164.508, a subpoena, or a court order. There is no route to a third party's medical records without one of the three. A medical canvass requires none of them, because it discloses no PHI.
Does HIPAA's 30-day rule apply to my request? Almost certainly not. The 30-day rule at 45 CFR § 164.524 covers an individual requesting their own records. Third-party requests under an authorization have no federal deadline. Check your state — many impose one of 15 to 30 days.
Why do some providers demand a subpoena when I already have an authorization? Providers may impose stricter requirements than HIPAA's floor, and many do as a matter of policy, particularly large systems and behavioural health facilities. It is their prerogative, and arguing rarely moves it faster than complying.
What does records retrieval cost? A retrieval fee of roughly $20–75 per request plus state-capped per-page copying charges, and certification fees where an affidavit is needed. The federal fee caps do not apply to third-party requests after Ciox v. Azar.
Can AI retrieve medical records? AI can prepare and submit requests, follow up across phone, fax, and email, and report status. It cannot compel a provider to respond faster than that provider's process allows. The gain is in cadence and coverage, not in the provider's speed.
What is a records custodian? The person or department legally responsible for releasing a provider's records: an office manager at a small practice, the HIM department at a hospital, or an outsourced release-of-information vendor. The custodian, not the treating physician, controls whether and when your request is fulfilled.
Sources
- Individuals' Right under HIPAA to Access their Health Information, 45 CFR § 164.524 — HHS.gov
- 45 CFR § 164.524 — Access of individuals to protected health information (eCFR)
- Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020)
- Federal Court Strikes Down HIPAA Fee Limitations for Third-Party Medical Records Requests — Dinsmore