- An attorney request for medical records typically travels under a HIPAA authorization signed by the client, though a patient's own access request directed to the firm is a second route.
- HIPAA gives providers 30 days to act on a patient's access request, with one 30-day extension, and the federal fee limit applies only to a patient's request for their own records.
- Requests stall at predictable points: a defective authorization, the wrong department or vendor, an unpaid prepayment invoice, and records that arrive incomplete.
- Track every request with the provider, record types, dates, status, invoice, and next follow-up date, and check completeness before closing it.
- Request early, use the provider's preferred channel, follow up on a schedule, and pay invoices quickly to keep the demand on track.
The demand letter is drafted, the damages summary is ready and the client is calling every week to ask when it will go out. Then someone notices that the MRI report from the imaging center never arrived, and the demand sits for another month while the firm chases one missing document.
That scene repeats across personal injury practices because medical records are the raw material of a PI claim. Treatment notes prove the injury, itemized bills prove the specials and imaging reports connect the crash to the diagnosis, and none of it can be summarized or argued until it is in the file.
Getting records looks simple from outside. The firm sends a signed authorization, the provider sends copies, and the case moves on, but in practice each attorney request for medical records passes through a records department, a release-of-information vendor or a portal, an invoice, and often several follow-up calls before the complete set arrives.
Multiply that by every provider on every case, and records retrieval becomes one of the largest sources of delay in pre-litigation work. A firm that handles it well starts requests early, sends them through the right channel, tracks each one to completion, and never lets a request go quiet.
What routes can a PI firm use to request medical records?
Requests from a plaintiff firm rely on one of three legal routes, and the route affects timing, fees and what the provider is obliged to do.
| Records route | Who signs or issues it | Timing rules | Fee rules |
|---|---|---|---|
| HIPAA authorization | The client signs an authorization naming the firm as recipient | No federal deadline; state law may set one | Set by state law, not the federal patient-access limit |
| Patient access request directed to the firm | The client requests their own records and directs an electronic copy to the firm | 30 days, plus one 30-day extension | Federal patient fee limit does not apply to third-party directives |
| Subpoena or court order | Issued in litigation, with the notice or assurances HIPAA requires | Set by the subpoena and court rules | Set by state law and court rules |
The HIPAA authorization is the workhorse of pre-litigation. Under 45 C.F.R. 164.508, a valid authorization must describe the information to be disclosed, name who may disclose it and who may receive it, state the purpose, include an expiration date or event and carry the client's signature and date.
The second route comes from the patient's own right of access. 45 C.F.R. 164.524 generally requires a provider to act on an individual's request within 30 days, with one 30-day extension if the provider explains the delay in writing.
The fee rules changed after a 2020 court decision. According to the Department of Health and Human Services, the federal fee limitation now applies only to an individual's request for access to their own records, and the right to direct records to a third party is limited to electronic copies of an electronic health record.
State law adds its own rules on top. California's Evidence Code section 1158, for example, requires providers to make records available within five days after an attorney presents a written authorization signed by the patient before a lawsuit is filed, and it sets out the reasonable costs that may be charged.
Subpoenas become the main tool once a case is in litigation. HIPAA permits disclosure in response to a subpoena when the requesting party provides the notice or protective-order assurances described in 45 C.F.R. 164.512(e), and the provider's records custodian will look for those assurances before producing anything.
Which records and bills does a PI case need?
The list of providers grows as treatment goes on, and each one needs its own request. For a typical motor vehicle case, the set includes:
| Provider type | What to request | Why the case needs it |
|---|---|---|
| EMS and ambulance | Run report and bill | Documents the scene, the complaints and the first treatment |
| Emergency department | ER records, imaging and itemized hospital bill | Connects the injury to the incident and starts the specials |
| Primary care and specialists | Office notes, referrals and bills | Shows diagnosis, treatment plan and ongoing symptoms |
| Imaging centers | Radiology reports, films if needed and bills | Provides objective evidence of injury |
| Physical therapy and chiropractic | Treatment notes, attendance records and bills | Shows the course and consistency of care |
| Pharmacy | Prescription history and costs | Supports medication expenses and treatment intensity |
Prior records can matter as much as current ones. If the client was treated for the same body part before the incident, the insurer will find out, and the firm is better served by knowing first, so ask clients about earlier treatment during onboarding and decide with the attorney whether to request those records.
The provider list itself should come from the client early and be updated at every check-in. A firm that collects names and dates during case opening can send most authorizations in the first week instead of discovering providers months later.
What should an attorney request for medical records include?
An attorney request for medical records that the provider can process without calling back is a request that moves. Missing details are among the most common reasons a records department sets a request aside, so the package should be complete the first time:
- A valid authorization: Every core element required by HIPAA, a signature date close to the request date and any state-specific language the provider's jurisdiction requires.
- Exact record types: Medical records, itemized bills, imaging reports, the films themselves if needed, and billing or records affidavits where the case will need them.
- Dates of service: A date range that starts at the incident and runs through the present, so the provider doesn't stop at the first visit.
- Delivery instructions: The format the firm wants, usually electronic, and where to send it, including a fax number or portal account if the provider requires one.
- Contact details: A named person at the firm and a direct number or email for questions about the request or the invoice.
Bills deserve their own line in every request. Itemized billing can come from a separate department or vendor than the clinical records, and a request that asks only for "records" may produce treatment notes with no charges, which leaves the damages summary incomplete.
Keep a template for each common provider type, such as hospitals, imaging centers, chiropractors and physical therapy clinics. Their processes differ, and a template that already reflects what each one needs saves a round trip on every new case.
Some providers insist on their own authorization form. Keep copies of those forms for the providers the firm deals with most, and have the client sign them at onboarding alongside the firm's standard authorization, so a rejected form doesn't add a week to the request.
Why do medical records requests stall?
Records requests rarely fail outright. They stall, and a stalled request looks identical to a request in progress until someone checks on it.
The authorization is the first weak point. An expired authorization, a missing element, a signature that doesn't match or a form the provider won't accept sends the request back, sometimes without a clear explanation of what was wrong.
Routing is the second. Hospitals and health systems frequently send release-of-information work to outside vendors or portals, and a request sent to the wrong department, the wrong fax number or the old vendor can sit untouched for weeks.
Payment is the third. A large number of providers and vendors send an invoice and wait for prepayment before releasing anything, and if the invoice lands in a general inbox or waits for approval, the records wait with it.
The last stall happens at the finish line. Records arrive, someone marks the request complete and only later does a paralegal notice that the dates of service stop short, the bills are missing or the imaging report belongs to a different visit, and the request has to start again.
Some stalls come from changes on the provider side. Practices close, merge into larger systems or switch release-of-information vendors, and the old fax number keeps accepting requests that nobody reads, so a request that hasn't moved in two weeks deserves a call to confirm the provider's current process.
Providers don't always meet their own deadlines either. HHS has announced dozens of enforcement actions under its Right of Access Initiative, including a $200,000 civil money penalty in March 2025 against an academic medical center that took more than two years to provide complete records to a patient's personal representative.
How should a PI firm track every records request?
Tracking is what turns records retrieval from a memory exercise into a process. Every attorney request for medical records should live as its own item in the case management system, with the provider, the record types requested, the date sent, the channel used, the current status, any invoice and the date of the next follow-up.
The next follow-up date matters most. A request without one is a request nobody is watching, and a simple rule, such as following up seven days after sending and every seven days after that until the records arrive, prevents requests from going quiet.
Status should reflect what actually happened. "Sent" is not the same as "received by provider," and "invoice received" is not the same as "invoice paid," so a short set of status values that match the real steps of the process gives managers an honest picture of where each request stands.
Completeness checks close the loop. Before marking a request done, compare what arrived against what was requested: the right patient, the right provider, the full date range and both records and bills, and reopen the request immediately if anything is missing.
Reporting turns the tracker into a management tool. A weekly view of open requests by age, by provider and by case manager shows which providers are slowest, which cases are waiting on records before a demand can go out and where follow-up has slipped.
Give every request a named owner as well. When records belong to "the team," a request that needs a decision, such as approving a large invoice or choosing whether to escalate a provider that has missed its deadline, can sit for days while each person assumes someone else is handling it.
How can a firm speed up medical records retrieval?
Speeding up an attorney request for medical records comes mostly from removing delays the firm controls. The provider's own pace is harder to change, but the time before a request is sent, the time a request sits unfollowed and the time an invoice waits for payment are all within the firm's reach.
Start requests at signing. Collect provider names and dates during intake and onboarding, send authorizations for providers the client has already seen right away and add new providers as treatment continues, rather than waiting until treatment ends to request everything at once.
Use the provider's preferred channel. If a hospital routes requests through a portal or a release-of-information vendor, send them there; a faxed request to a records department that no longer handles them will be found weeks later, if at all.
Follow up on a schedule and call when written follow-up stalls. A phone call confirms that the request was received, surfaces problems such as a rejected authorization or an unpaid invoice and gives the firm a name and an expected date to note in the file.
Pay invoices the day they arrive. Route records invoices to a person who can approve them quickly, and log the payment date in the tracker so the follow-up call can confirm that the provider received it.
For records the client can get faster, consider a patient-initiated request. Some patients can download their records from a provider portal in minutes, and the firm can ask the client to share them while the formal request for certified copies or bills continues.
Keep the client informed while records are outstanding. Clients notice when the case seems stalled, and a short update explaining which provider the firm is waiting on, and what it is doing about it, prevents the anxious calls that pull case managers away from the follow-up work itself, a theme our guide to improving client communication covers in more depth.
See HelloCounsel follow up on a medical records request
We'll show you how HelloCounsel calls a provider about an open records request, confirms the status and invoice, and writes the update and next follow-up date to your case file. Book a medical records follow-up demo
Who should make records follow-up calls?
Following up on each attorney request for medical records is some of the most repetitive work in a PI firm. Each call follows the same pattern: reach the right department, give the patient and request details, ask for the status, note the expected date or the problem and schedule the next call.
When case managers make these calls between everything else, follow-up slips first, because a records call can always wait until tomorrow. As per our estimate, case managers spend 50+ hours a week on routine calls, and provider follow-up is a large share of that time at firms with heavy caseloads.
The volume adds up quickly. As a working planning assumption, we estimate about four follow-up calls per open request per month, so a firm with 300 open requests is looking at roughly 1,200 records calls a month, and our guide to reducing case manager workload covers how to free that time.
That pattern makes records follow-up a strong fit for call automation, as our comparison of AI systems for medical provider calls explains. Decisions about payments, disputes with providers and anything requiring legal judgment should stay with the firm's staff, with clear rules for when the agent hands a request back.
How HelloCounsel handles medical record follow-up
HelloCounsel builds AI voice agents for plaintiff personal injury firms.
Its Medical Records workflow covers the repetitive work between sending an attorney request for medical records and receiving a complete response.
The agent can submit requests by email, fax or existing retrieval portals such as Datavant, MRO, and ChartSwap, or take over follow-up on requests the firm has already sent. It calls providers, checks portals and monitors inboxes and faxes, following each provider's stated callback window until the request is resolved, and it tracks records, invoices and billing and records affidavits that arrive separately.
Before a request is closed, the agent checks the patient, provider, and dates of service and flags missing records or discrepancies. When a provider requires prepayment, it obtains the invoice and creates a payment task for the firm, since the agent doesn't handle the firm's card details, and every interaction, status change, and next task is written back to the matter in case management systems such as Filevine.
Firms using HelloCounsel have seen 15 days cut from record turnaround, though results depend on how responsive each provider is. Firms typically start with follow-up only on 10 to 20 live requests, review real activity and then expand, and pricing is custom, based on call and case volume rather than seats. Hard-copy mail isn't supported; portal access uses credentials the firm provides and exceptions such as stalled providers or material discrepancies are routed back to the firm's team.
Medical records request checklist
Before sending any attorney request for medical records, and again before closing it, run through the same short list:
- The authorization is signed, dated, unexpired and includes every required element
- The request names records, itemized bills, imaging and any affidavits the case needs
- The date range runs from the incident through the present
- The request goes to the provider's current department, vendor or portal
- A next follow-up date is set in the case management system
- Any invoice is routed for same-day approval and payment
- Received records are checked against the request before the item is closed
A firm that applies this checklist to every attorney request for medical records will still wait on slow providers, but it will stop losing weeks to problems of its own making. Those weeks add up across a caseload, and they are the difference between demands that go out on schedule and demands that wait on one missing report.
Talk through your records backlog with HelloCounsel's founders Talk with HelloCounsel's founders about how many record requests your team has open, where they stall, and which follow-up calls an AI voice agent could take on. Book a call with HelloCounsel's founders about medical records
Frequently asked questions
1. How does an attorney request medical records for a client?
The attorney sends the provider a HIPAA authorization signed by the client, naming the firm as recipient and describing the records, purpose, and expiration. The client can also request their own records and direct an electronic copy straight to the firm.
2. How long does a provider have to respond to a medical records request?
Under HIPAA, a provider must act on a patient's access request within 30 days, with one 30-day extension. Requests under an authorization follow state law, and some states set shorter windows, such as California's five days for written attorney requests.
3. Can providers charge attorneys for medical records?
Yes. The federal fee limit applies only to a patient's request for their own records, so copies sent to an attorney under an authorization are priced under state law, which may set per-page rates, clerical charges, or other reasonable costs.
4. What should a medical records request include?
Include a valid HIPAA authorization, the specific record types such as records, itemized bills and imaging, the full date range, the delivery format and destination, and a named contact at the firm who can answer any questions about the request.
5. Why do medical records requests take so long?
Common causes include a rejected authorization, a request sent to the wrong department or vendor, an unpaid prepayment invoice and records that arrive incomplete. Regular follow-up calls catch these problems early instead of weeks after the request was first sent.
6. Can AI help with medical records follow-up?
Yes. An AI voice agent can call providers, check portals, track invoices and affidavits, confirm completeness, and write each update to the case file, while payments, provider disputes, and any decisions that need legal judgment stay with the firm's staff.
Share this article
