Key Takeaways
- Admissibility starts at retrieval - medical records must be obtained using litigation‑appropriate authorizations and processes to withstand courtroom scrutiny.
- Courts are increasingly strict - records missing proper authorizations, chain of custody, or authentication can expose law firms to significant downstream risk.
- Misuse of the Patient Right of Access - using PROA requests or automated portal scraping may lead to improper authentication, broken chain of custody, and ultimately inadmissible records.
- Incomplete EMRs are a hidden liability - portal-accessed records often omit critical elements of the legal medical record, jeopardizing expert opinions and admissibility.
In litigation,
medical records are foundational evidence. Yet too often, firms focus on how fast records are delivered instead of how defensible those records are once challenged. As courts increase scrutiny of the provenance of records, law firms face growing risks when medical records are obtained through shortcuts that sacrifice compliance for speed.
Admissibility begins long before a record is produced. It starts at the point of retrieval.
The Hidden Risk in Modern Medical Record Retrieval
The record retrieval industry has changed rapidly, with some providers prioritizing automation, scale, and speed over legal rigor. While this may appear efficient on the surface, these practices can expose law firms to significant downstream risk when records are introduced into evidence.
Courts are increasingly focused on:
- Whether records were obtained using litigation-appropriate authorizations
- Whether the chain of custody is verifiable
- Whether records have been properly authenticated
- Whether the production represents the complete legal medical record, not just an electronic extract
If any of these elements are missing, even highly relevant medical records may be ruled inadmissible, regardless of their accuracy.
Misuse of the Patient Right of Access
One of the most concerning trends in record retrieval is the misuse of the Patient Right of Access (PROA) under HIPAA.
HIPAA grants patients the right to access their own medical records for personal use and continued treatment. It does not grant third parties a shortcut to obtain records for litigation. Federal courts have reinforced this distinction, including in
Ciox Health, LLC v. Azar, which clarified that PROA cannot be used to circumvent established litigation record-retrieval requirements.
Despite this precedent, some vendors rely on patient authorizations intended solely for personal access to scrape records directly from electronic portals. In certain circumstances, these providers are not fully verifying the authorization and release details included on the same, resulting in records that often lack custodial affidavits, proper authentication, and clear documentation of how, and from whom, the records were obtained.
The legal risk is substantial. Multi-million-dollar verdicts can be lost if medical records are excluded due to improper authorization and authentication. When records are deemed inadmissible, the damage often is irreversible.
Incomplete Records are a Silent Liability
Another critical issue is the completeness of those records. Electronic medical records (EMRs) accessed through portals frequently exclude key components of the legal medical record, including:
- Diagnostic imaging and associated metadata
- Pathology slides and reports
- Amendments, addenda, and audit trails
- Records from ancillary providers
What looks complete may be anything but. These gaps create opportunities for opposing counsel to challenge both admissibility and any expert opinions that might have been built on incomplete data.
Questions Every Firm Should Be Asking
To protect their cases, firms should ask record retrieval providers:
- Are records obtained through methods appropriate for litigation, not through personal access?
- Can affidavits and custodial testimony be provided if records are challenged?
- Are the records complete legal medical records, or partial EMR extracts?
- How is chain of custody documented and preserved?
If these questions cannot be answered clearly, the retrieval method already presents a risk.
The Bottom Line
Medical records are not a commodity. Treating them as such by prioritizing speed over compliance can quietly undermine even the strongest of cases. At Lexitas, we believe record retrieval should strengthen the litigation process, not complicate it. Reliable medical records keep cases moving forward and help attorneys litigate with confidence.
Author Bio: Denise Huber is President of the Records Division at Lexitas, where she leads record retrieval operations supporting litigation teams nationwide. She brings extensive experience in medical record compliance, retrieval standards, and evidentiary best practices, helping legal teams mitigate risk and support defensible case preparation.
