Medical Record Retrieval for Lawyers: A PI Firm's Guide

The demand is ready except for one provider. The PT clinic sent the treatment notes but not the bill. The ER sent the bill but not the imaging report. And the orthopedist hasn't answered at all.

Every PI paralegal knows this week. This guide covers medical record retrieval for lawyers from the first request to the last missing page. You'll get the three ways to request records and the deadline and fee rules for each, what a HIPAA authorization has to say, a follow-up schedule, and how to check that the file is complete before the chronology starts.

What Is Medical Record Retrieval?

Medical record retrieval is the work of requesting, tracking and collecting a client's medical records and bills from every provider who treated them. For a PI firm, it's the step before the chronology and the demand. A record you never received can't support the claim, and the adjuster will notice the visit you didn't document.

Retrieval ends when you have a complete set: every provider, every date of service, the records and the bill for each. What happens next, the chronology and the summary, is covered in our medical record chronology template and medical record summary guide.

Build the Provider List Before You Send Anything

You can't request records from a provider you don't know about. Most missing records trace back to an incomplete provider list, not a slow provider. Build the list from several sources, because each one catches what the others miss.

• The client interview: every place they went, including urgent care, a chiropractor and a telehealth visit.
• Discharge papers: ER and urgent care instructions often name the follow-up provider.
• Referrals in the notes: each record you receive names the next provider. Read for "referred to" and "follow up with."
• Pharmacy history: the prescriber on each fill is a provider, even if the client forgot the visit.
• Health plan statements: the client's explanation of benefits lists every provider who billed their insurer.
• Imaging centers: an MRI is often done at a separate facility with its own records and its own bill.

Update the list every time a new record arrives. A new name in a note is a new request. Our post on how paralegals cut demand letter prep time covers tracking this kind of list without a spreadsheet nobody updates.

Prior Records: When to Ask for Treatment Before the Accident

The adjuster will look for a pre-existing condition. If your client had back pain three years before the crash, the carrier may find it before you do. Asking for prior records lets you see it first and address it in the demand on your terms.

Keep the request narrow. Ask for prior treatment of the same body parts, from the providers the client names, for the period your case needs. Describe that period in the authorization. A request for "all records, ever" takes longer, costs more, and hands you pages you'll have to read.

Talk to the client before you ask. They may remember a prior visit you can request directly. And if a prior condition was made worse by the accident, that's part of the damages, not a reason to hide the history. How you handle it in the letter is a decision for the attorney.

Three Ways to Request a Client's Medical Records

Most firms use one route for everything. There are three, and federal rules treat them differently. Which one you pick changes the deadline you can hold the provider to and the fee rule that applies.

	HIPAA authorization	Client's own access request	Client-directed copy to the firm
Who sends it	The firm, with the client's signed authorization	The client	The client, in a signed written directive naming the firm
Federal rule	45 CFR 164.508	45 CFR 164.524	45 CFR 164.524, as limited by the 2020 Ciox ruling
What it covers	What the authorization describes	The client's records	An electronic copy of the client's electronic health record
Federal response deadline	None in HIPAA; check state law	30 days, plus one 30-day extension with written notice	Same as an access request
HIPAA fee limit	Doesn't apply; state law and provider policy	Reasonable, cost-based fee only	Doesn't apply since 2020
Best for	Most requests, bills and non-electronic records	A slow provider, when the client can help	Electronic records from a large health system

The 2020 ruling matters for your costs. In Ciox Health v. Azar, a federal court limited the client-directed route to an electronic copy of an electronic health record. HHS's notice on the ruling says the patient-rate fee limit now applies only to a patient's own access, not to records sent to a third party like your firm.

So the cheapest route on paper isn't always the cheapest in practice. Some firms have the client request the records directly, then forward them. That keeps the client's access rights and the 30-day clock in play. It also adds a step, and the client has to follow through. These are federal rules. Your state may add deadlines, fee caps or forms, so check them before you rely on any of this.

What Must a HIPAA Authorization Include?

A valid HIPAA authorization must describe the records, name who may disclose them and who receives them, state the purpose, and set an expiration date or event. The client signs and dates it. It also needs three notice statements, and it must be written in plain language. A missing element gives the provider a reason to reject it.

Here's the list, from 45 CFR 164.508(c). Check your form against it once, then reuse it.

• The records: described specifically, such as "all records and itemized bills for dates of service from 09/12/2025 to present."
• Who discloses: the provider, by name.
• Who receives: your firm, by name.
• The purpose: "at the request of the individual" is enough when the client starts it.
• Expiration: a date or an event.
• Signature and date: if a personal representative signs, a description of their authority.
• Right to revoke: a statement that the client can revoke in writing.
• No conditioning: a statement about whether treatment or payment can depend on signing.
• Redisclosure: a statement that disclosed records may be redisclosed and no longer protected by the rule.

Write the description of the records with the demand in mind. "Any and all records" sounds complete, but some providers read it narrowly and send only the visit notes. Name what you need: office notes, imaging reports, therapy notes, orders, referrals and itemized bills. If you need images themselves, not just the reports, ask for them separately. Radiology departments often treat images as a different request.

Some providers insist on their own form. Send theirs too when they do. Arguing about forms costs more time than signing a second one.

Why Providers Reject Records Requests

A rejected request is the slowest kind, because you usually find out weeks later. Most rejections come from a handful of fixable problems. Check for them before the request goes out, not after the provider sends it back.

The problem	The fix
The authorization expired	Use an expiration event tied to the case, such as resolution of the claim, and track the date if you use one
The records aren't described specifically	Name the record types and the dates of service you need
The wrong entity is named	Use the provider's legal name; hospital groups often bill under a different name than the sign on the building
Someone else signed for the client	Describe the signer's authority, such as a parent of a minor or a court-appointed representative, and attach proof
The provider wants its own form	Send it with yours; don't argue
The fax was unreadable	Send a clean PDF, and confirm receipt by phone

Keep one master authorization that passes all of these, and reuse it. Every custom edit is a new chance for a rejection.

Records and Bills: Ask Both Departments

The most common gap in a PI file isn't a missing provider. It's a provider whose records arrived without the bill, or the other way around. At many facilities, medical records and billing are different departments. A request to one doesn't reach the other.

Ask for both, by name, from every provider. Facility charges usually come on a UB-04 and professional charges on a CMS-1500. You need itemized charges for each date of service to prove the specials.

Provider	Request these records	And this bill
Ambulance	Patient care report (run report)	Itemized transport bill
Emergency department	Triage, physician notes, orders, discharge instructions	Facility bill and separate physician bill
Radiology	Imaging reports; images on request	Facility and reading radiologist bills
Physical therapy	Initial evaluation, daily notes, re-evaluations, discharge summary	Itemized bill by visit
Specialist	Consult notes, procedure notes, referrals out	Itemized professional bill
Pharmacy	Prescription history printout	Receipts or pharmacy statement

How Long Does Medical Record Retrieval Take?

It depends on the route, the provider and the state. When a patient requests their own records, HIPAA gives the provider 30 days, plus one 30-day extension if it explains the delay in writing. HIPAA sets no deadline for disclosures under an authorization. In practice, retrieval takes as long as your follow-up allows.

The rule is in 45 CFR 164.524(b)(2). For authorizations, check whether your state sets its own response time. Either way, put the request date on your calendar the day it goes out.

A Follow-Up Schedule That Keeps Requests Moving

Requests rarely fail at the provider. They fail in your office, when nobody follows up. A simple schedule fixes most of it. Adjust the days to your state and your providers.

1. 1Day 0: send and log. Send the request with the authorization. Log the provider, the department, the date and how it went out.
2. 2About a week in: confirm receipt. Call and confirm they have it and the authorization is accepted. Ask for a reference number.
3. 3Pay fast. If they send an invoice first, pay it the day it arrives. An unpaid invoice stops the clock on your side.
4. 4Every week or two: check status. Same contact, same reference number. Note every answer.
5. 5When it stalls: change routes. Escalate to the records supervisor, or have the client make an access request with its 30-day clock.

The log does a second job. If a carrier later questions a gap, you can show when you asked and what the provider said. Our records-to-settlement workflow shows where retrieval sits in the whole demand timeline, and how long a demand letter takes shows why retrieval is usually the longest wait.

Should You Use a Record Retrieval Company?

Use a record retrieval company when a case has many providers, out-of-state facilities, or more requests than your staff can follow up on. The company sends the requests and chases them. Before you sign, ask how they report status, how they pass through provider fees, and what security terms cover the records.

Retrieval companies don't remove the work on your side. Someone still collects the authorization, tells the company which providers exist, and checks what comes back. They're a capacity tool, not a substitute for knowing the file.

• Status: Can you see each request's status without calling?
• Fees: Do they pass provider fees through at cost, or mark them up?
• Bills: Do they request itemized bills as well as records, by default?
• Delivery: Do you get searchable PDFs, organized by provider?
• Security: Who can access the records, where are they stored, and which subcontractors touch them?

The same evaluation questions apply to review vendors. Our guide to choosing a medical record review service covers them, and our HIPAA guide for PI firms covers the security side.

How to Check the Records You Got Back

A package arriving doesn't mean the request is complete. Before you close it, run these checks. Each one is yes or no.

• Dates match: every date of service on the bill has a matching note in the records.
• Referrals land: every referral or order in the notes has a record from the provider it went to.
• Imaging is complete: every study ordered has a report.
• Pages are whole: no missing page numbers, cut-off scans or blank fax pages.
• The right patient: name and date of birth match on every page.

A gap in treatment can mean the client stopped going. It can also mean a record never came. Before you explain a gap to the adjuster, confirm it's real.

Completeness matters most when the demand has a deadline. A time-limited policy limits demand sent with records missing gives the carrier a reason to say it couldn't evaluate the claim.

Where Lexyno Fits

Lexyno doesn't retrieve records. It starts once they arrive. Medical Summary extracts dates, providers, diagnoses, procedures and charges from the records into events, each tied to its source page. The treatment calendar flags gaps over 30 days, which is often the first sign a record is missing.

Your team can review, correct or remove any event, and the same events feed the demand letter. Our guide to AI medical chronology explains how the extraction works, and our guide to medical record review covers the reading that comes next. Plans are on the pricing page.

The Demand Is Only as Complete as the Records

Medical record retrieval is slow, manual and easy to put off. It's also where most weak demands start. Pick the right route, use an authorization that can't be rejected, ask for the bills, follow up on a schedule, and check what comes back.

A visit you never requested is a visit the adjuster gets to ignore.

When the records are in, start the letter from our PI demand letter template, or try Lexyno on one case from your own file, free. For what to send once the file is complete, see our guides to the demand letter to the insurance company, each section of the letter, and a finished car accident sample.