How to Automate Medical Records Follow-Up at a PI Law Firm

Medical records follow-up automation is usually sold as a way to make more calls. The more useful version of it starts earlier, with the question of what the provider owes you and by when.

A records request goes out. Three weeks pass. Somebody notices, calls the provider, waits on hold, is told the request is in process, and sets a reminder to try again next week.

That cycle repeats across every open matter in the firm, and it is almost entirely unscheduled. On the volume a typical caseload produces, set out in our breakdown of how many calls a PI case generates, it adds up to a substantial share of a case manager's week. The chase happens when a case manager remembers or when a demand deadline forces it, rather than on any fixed day, because nobody established what the provider actually owes and by when.

There is an answer to that, and it is more specific than most firms assume. Two different requests can produce the same set of records, they are governed differently, and only one of them puts the provider under a deadline at all.

That distinction decides everything downstream. It sets whether you have a date to hold a provider to, what the records are allowed to cost, and whether an unanswered request is a delay or a breach. It is also the piece most firms have never looked at, because the authorization form came with the intake packet and nobody revisited it.

Why a HIPAA authorization carries no deadline and a right-of-access request does

Precision matters here, because every later choice about medical records follow-up automation rests on which instrument you used. The request a plaintiff firm usually sends is an authorization: your client signs a HIPAA authorization, your office sends it to the provider, and the provider releases the records to you.

The alternative is a right-of-access request. Your client asks for their own records under 45 CFR 164.524, and may direct the provider to send a copy to someone else, including your firm.

One limit on the access route is worth knowing before you rely on it. The regulation excludes information compiled in reasonable anticipation of, or for use in, a legal proceeding, so a defense examination report is outside the right of access even though ordinary treatment records are not.

Those two instruments look similar in a case file and behave nothing alike. HHS sets out the difference in its own guidance comparing the two, and the three lines that matter read as follows.

An authorization permits, but does not require, a covered entity to disclose the records. A right-of-access request requires it, unless an exception applies.

An authorization carries no timeliness requirement. On a right-of-access request the covered entity must act no later than 30 days after receiving it, with one extension of no more than 30 days available if it tells the individual in writing why and when, and only one such extension is permitted.

An authorization has no limitation on fees. A right-of-access request is capped at the cost-based rate in the regulation.

Read that back against your own process and the implication is uncomfortable. If your firm sends authorizations, which most do, the provider is under no federal obligation to respond by any particular day, and your follow-up has been measured against a deadline that was never running.

What Ciox v. Azar changed about what a provider may charge your firm

The obvious response to all this is to route everything through the client's right of access. That works for the deadline and it stopped working for the money in 2020.

In Ciox Health, LLC v. Azar, decided in the District Court for the District of Columbia on 23 January 2020, the court vacated the 2016 guidance that had extended the capped patient rate to records directed to a third party. HHS published a notice confirming it, stating that the fee limitation now applies only to an individual's request for access to their own records, and that the right of access and its fee limits remain undisturbed where the individual is the recipient.

So the two instruments now split three ways rather than two. An authorization gives you no deadline and no fee cap.

A right-of-access request where the client receives the records gives you both. A right-of-access request directing the records to your firm gives you the deadline without the cap.

That last combination is the one worth knowing, because it is the only way to put a provider on a federal clock while the records still come straight to you, and the cost of it is that the provider may charge what it charges.

Which instrument you use is a decision each firm makes once. What follows from it is a cadence, and the cadence depends on one more variable.

State deadlines that run shorter than the federal 30 days

Federal law is not the only clock, and in several states it is not the binding one.

New York gives a provider 10 days from a written request to give the person the opportunity to inspect the records, under Public Health Law section 18, with copies to follow within a reasonable time. Washington requires a provider to act no later than 15 working days after receiving a written request, under RCW 70.02.080. Others track the federal 30 days exactly.

The practical rule is that the shortest applicable clock is the one your follow-up should be built against, and for a firm practicing in one state that is a single number somebody should write down once.

Two details are worth getting right when you look yours up. State deadlines often distinguish between making records available for inspection and producing copies, and those are different dates. Washington's figure also counts working days rather than calendar days, which pushes the real date out by roughly a week once weekends are counted.

For firms handling matters across state lines the number changes by matter, which is itself an argument for putting the cadence in a system rather than in a person's head.

A five-call follow-up schedule tied to the governing deadline

Once you know the date a provider owes you something, chasing stops being a judgment call, which is the point at which medical records follow-up automation has something to work with.

Day 3, confirm receipt. Not a status check, a confirmation that the request arrived, is legible, and names the right patient and date range. A rejected authorization that nobody knows was rejected is the most common cause of a request that sits for six weeks.

Day 10, first status check. Ask what stage the request is at and who is handling it, and record the name. Requests with a named handler move faster than requests belonging to a department.

Day 20, second check with the deadline named. State the date the clock expires and ask whether the provider expects to meet it. On a right-of-access request this is a real obligation and saying so changes the conversation.

Deadline day, the call that matters. On an access request, this is the day the provider either produced the records or owes a written extension naming a completion date. Ask for the extension in writing if it is claiming one.

Day 45, escalate past the records desk. Every provider has a privacy officer whose remit includes this. Where the clock has run and nothing has arrived, that is the next call rather than a fifth attempt at the same extension.

There is one further lever on an access request that firms rarely use. The right of access is enforced by the HHS Office for Civil Rights, and the individual whose records these are may file a complaint when a provider fails to meet it. Raising that possibility with a privacy officer tends to move a request faster than another call to the records desk, and it is available only because the client made the request rather than the firm.

Almost none of that is thinking work. It is five calls on five known days against a known deadline, which is exactly the kind of work medical records follow-up automation exists to carry.

What each call says matters as much as when it happens. Name the patient, the date of service range and the date the request was sent, and ask for the status of that specific request rather than for records generally. A request identified by patient name alone is the one that gets looked for and not found.

Three defects that get a records request rejected

No amount of medical records follow-up automation rescues a request that was defective when it left, so it is worth knowing how often the request itself was the problem.

Three defects account for most rejections. The date range is open-ended or wrong, so the provider either refuses it or returns a decade of unrelated history.

The scope says all records without naming what that covers, which invites a partial production the firm then has to chase a second time. The signature or date then fails the provider's own validity window, which many apply as internal policy rather than law.

The cheapest fix in this whole process is a review at the point the request goes out rather than at the point it comes back wrong. A request checked for those three things before it leaves takes a minute and saves a cycle of three to six weeks.

It also changes what a status call is for. If the request was clean on the way out, a provider saying it has nothing on file is a fact to escalate rather than a problem to re-solve.

When the request lands with a release-of-information vendor

A large share of provider records now move through an intermediary rather than the provider's own staff, and this changes who any medical records follow-up automation is actually calling.

The vendor is a business associate of the covered entity. It is working to the covered entity's contract, not to your deadline, and its phone system is built for volume rather than for a case manager asking after one request.

Two things follow. The status you get from the vendor is the status of its own queue rather than of the provider's obligation, so a request that is "with the vendor" has not necessarily been acted on by the party that owes the response.

The escalation path also runs back to the provider, because that is who the deadline binds. A vendor can be slow without the provider ever being in breach, and it can also be the reason a provider misses a date it was legally required to meet.

Ask one question on the first call that reaches the vendor: when did you receive this from the provider. The gap between the date you sent the request and the date the vendor received it is usually invisible, often large, and entirely the provider's to answer for.

Hold the provider's privacy officer in the file alongside the vendor's contact. A firm carrying only the vendor's number has no escalation route available to it at all.

Tell the client what is happening while this runs. A claimant who hears nothing for two months assumes the case has stalled, and the fix for that is the same communication discipline described in our note on client communication at PI firms.

How to measure records turnaround so the number is actionable

Medical records follow-up automation only pays for itself if somebody is watching the number it is supposed to move, and records turnaround is the metric most firms either do not keep or keep in a form that cannot be acted on.

The number worth tracking is days from request sent to records received, measured per request rather than per matter, since one matter commonly has six providers moving at six different speeds.

Measure from the date the request left your office rather than from the date somebody opened the task. Those two dates diverge more than firms expect, and the gap between them is work your own process owes, not the provider's.

Segment it three ways, because an unsegmented average hides everything useful. Split by instrument, since authorization requests and access requests are governed differently and should not be averaged together.

Split by whether an intermediary sat in the path, since those two populations behave differently enough that mixing them tells you nothing. Then split by provider, because a short list of custodians usually accounts for most of the delay, and that list is actionable in a way an average is not.

Then watch one more thing: the share of requests that received a response of any kind by the applicable deadline. That is the number that tells you whether the cadence is working, and it is the number that moves first when follow-up becomes systematic.

Two diagnostics fall out of the same data. A high rate of requests that go quiet after an initial acknowledgement usually means the follow-up is landing in a queue rather than with a named person. A high rate of requests returned incomplete usually means the scope on the authorization was written loosely, which is a drafting fix rather than a chasing one.

Neither shows up in a turnaround average, and both are cheaper to fix than the delay they cause.

How HelloCounsel works the provider queue

HelloCounsel is our own product, so this section describes what it does with the cadence above rather than arguing it suits every firm.

Counsel places the follow-up calls. It works provider phone trees, holds, reaches the records desk, asks the status question for a named request, and re-requests where the provider says it has nothing on file. The calls happen on the scheduled day rather than when somebody has a free afternoon.

Each call writes back to the case management system as a structured record against the matter, with the outcome, the next scheduled attempt and the transcript attached. That record is the difference between medical records follow-up automation you can audit and a dialler you have to trust. That record is what makes the segmentation above possible, since turnaround by provider and by instrument can only be computed if every attempt was logged.

Inbound provider calls run on the same agents, so a records clerk calling back about a request reaches something that can identify it and update the status rather than taking a message. Our note on handling medical provider calls covers that side in full.

For how the record itself lands on the matter, CMS write-back sets out what a usable call record has to carry.

Pricing is fixed monthly at $500, scoped to expected volume with 20% tolerance either way, with no per-minute billing and no setup fee. Direct integrations cover SmartAdvocate, Filevine, Litify, Lead Docket, and Clio, with custom builds for other systems. Across 25,000 calls and 500 hours of call time, firms working with HelloCounsel have seen a 48% improvement in call reception rates.

The limits are worth stating. It covers English and Spanish and stops there; it runs inside your case management system rather than replacing it, and firms tracking cases in spreadsheets are not a fit.

A one-month plan for putting the cadence in place

Three decisions and one list get a firm from ad hoc chasing to a schedule, and none of them requires buying anything first.

Decide which instrument you send, and write down why. Everything downstream in medical records follow-up automation, from the deadline you can cite to the fee you can dispute, follows from that one choice. Most firms will keep sending authorizations for the convenience of not involving the client each time, which is defensible as long as everyone understands no clock is running.

Write down the applicable deadline for the states you practice in, as a single reference somebody can check. For most firms this is one number.

Build the cadence into whatever already holds your tasks, so the day-3 and day-10 calls generate themselves rather than depending on memory. The workload argument for doing this sits in our note on reducing case manager workload.

Whether a person or a system places those calls is a separate decision, and our case for automating outbound calls at a PI firm sets out where the line usually falls.

Then pull the list of your ten slowest custodians from the last six months. That list is where the next month of effort belongs, and it is usually shorter than anyone expects.

Frequently asked questions

1. How long does a provider have to respond to a medical records request?

It depends on the instrument. A right-of-access request from the patient carries a federal 30-day deadline with one 30-day extension. An authorization from a law firm carries no federal timeliness requirement at all.

2. Does the 30-day HIPAA clock apply to the requests my firm sends?

Not to an authorization. The 30 days in 45 CFR 164.524 attaches to the individual's right of access, so it runs only where your client made the request.

3. Can my client direct records straight to our office?

They can. A right-of-access request may name a third party as the recipient, which keeps the deadline in place, though after Ciox the capped rate no longer applies once records go to anyone other than the client.

4. What changed after Ciox Health v. Azar?

The court struck down guidance that had stretched the capped patient rate beyond an individual's own request, so a provider may charge its ordinary rate when records go to your firm instead of to the client.

5. Do state deadlines override the federal one?

They sit alongside it, and the shorter one governs in practice. New York allows ten days for inspection and Washington fifteen working days, so a firm in either is working to a tighter schedule than the federal 30.

6. What should we do when a request sits with a records vendor?

Take it back to the provider. The vendor works to the provider's contract rather than to your deadline, and the obligation you are enforcing belongs to the provider rather than its contractor.