“Can you review these medical records?” is one of the least specific instructions in litigation support. It covers at least five distinct deliverables, built differently, priced differently and used at different points in a case. Ordering the wrong one is the most common and most expensive mistake in this area — not because the work comes back badly done, but because it comes back being the wrong thing.
Here is what each deliverable actually is, what a good one looks like, and where outsourcing works cleanly.
The five deliverables
1. The medical chronology
A date-ordered table of every clinically relevant event in the record set, each row carrying a source citation — provider, document type, and Bates or page number.
This is the foundational deliverable. Everything else is derived from it, and a firm that commissions a narrative summary without first having a chronology is usually paying for the records to be read twice. Columns that earn their place:
| Date | Provider / facility | Event | Significance | Cite |
|---|---|---|---|---|
| 2024-03-11 | St. Aldate’s ED | Presents with lower back pain; reports no prior injury. | Contradicts 2022 chiropractic records at 0912. | PL0341 |
| 2024-03-19 | Dr. Okafor, ortho | MRI ordered. Notes “symptoms since MVA”. | First causation link in the record. | PL0388 |
The “significance” column is where the value sits and where cheap chronologies fall down. A transcription of the records into date order is a filing exercise. A chronology that flags the gap in treatment, the inconsistent history, the first appearance of a complaint and the date the plaintiff returned to work is a case document.
2. The narrative summary
Prose, written to be read start to finish by someone coming to the case fresh — new counsel, an expert, a mediator, an adjuster. Typically a few pages, organised by treatment episode or by body system.
Commission it after the chronology, from the same reviewer, and it costs very little extra. Commission it instead of the chronology and you have a readable document you cannot cite from.
3. Deviation or standard-of-care analysis
Identifying where care departed from what the records themselves indicate should have happened — an abnormal result not acted on, a consult ordered and never performed, a medication continued past a documented contraindication.
A crucial distinction: this is records-based flagging, not expert opinion. A properly scoped deviation review says “potassium of 6.2 reported 14:20, no intervention documented until 21:40”. It does not say the standard of care was breached. That is your expert’s job and your expert’s signature. Any provider offering the second thing should give you pause.
4. The billing audit
Line-by-line review of billed charges against the clinical record: unbundled codes, services billed but not documented, duplicate charges, charges post-dating discharge, upcoded levels of service. Output is a reconciliation schedule with a total of the questioned charges.
This is the most mechanical of the five and consequently the most outsourceable. It is also the one most often skipped in cases where the damages number came straight off the bills without anyone checking whether the bills match the chart.
5. The exhibit index and de-duplicated record set
Less glamorous, disproportionately useful. A clean, de-duplicated, properly paginated record set with an index by provider and date, so that nobody on your team ever again scrolls through four copies of the same discharge summary looking for the one with the handwritten annotation.
Do this first, before any substantive review. In a large record set the genuinely relevant clinical material is a small fraction of the total pages — the rest is duplicates, repeated flowsheets, administrative forms and re-faxed copies. Paying per page to review the same document four times is a real and avoidable cost.
The ordering that works
De-duplicate and index → chronology → then whichever of narrative, deviation flagging or billing audit the case needs. Each stage feeds the next, and the marginal cost of the later stages drops sharply once the chronology exists.
What separates a good review from a cheap one
Four things, consistently:
- Every row is cited. An uncited chronology cannot be used in a deposition, a demand or a motion. If the provider cannot produce Bates-level citations, they are producing notes, not a work product.
- Illegible and missing material is flagged, not skipped. Handwritten notes, poor scans and gaps in the production are the places cases turn. A good reviewer returns a list of what they could not read and what appears to be missing from the production. A weak one silently omits it, and you find out at deposition.
- Internal inconsistencies are surfaced. The history given in the ED that contradicts the history given to the orthopaedist three weeks later is exactly the kind of thing a careful human reader catches across a long document, and exactly the kind of thing a fast pass does not.
- Clinical vocabulary is handled correctly. Abbreviations, drug names, dosing units. A reviewer who does not recognise that a unit error has been transcribed will carry it forward into your chronology.
The HIPAA question, before anything leaves the building
This has to be settled before records are sent anywhere, and the answer depends on which side of the case you are on.
If your firm is acting as a business associate — the usual position when you act for a hospital, insurer, practice group or other covered entity and handle protected health information in doing so — then a vendor handling that PHI on your behalf is your subcontractor, must be covered by a business associate agreement, and under the HITECH-era rules carries direct liability for certain HIPAA obligations in its own right. The obligations flow down the chain; they do not stop at your firm.
If you are plaintiff-side, holding records obtained under your own client’s authorization, you are generally not acting as a business associate and the BAA framework does not apply in the same way. That is not a reason to skip the contracting. You still hold your client’s most sensitive information, you still owe confidentiality duties, and you should still have written terms covering security, retention, deletion and any onward sub-contracting.
For UK and EU firms there is a further layer: health data is special category data, and sending it to a country without an adequacy decision requires an appropriate transfer safeguard and a transfer risk assessment. We cover that ground in our piece on the ethics and compliance of outsourcing.
Where AI sits in this
Automated extraction has become genuinely useful for the first two stages. It de-duplicates well, it paginates and indexes well, and it produces a serviceable first-pass chronology from clean digital records.
It remains unreliable in exactly the places that matter: handwritten and poorly scanned notes, the significance judgement that turns a list of dates into a chronology, and the cross-document inconsistency that only shows up when one reader holds the whole record in mind. It will also, left unchecked, assert things the record does not say.
The defensible arrangement is machine-assisted extraction with human verification against source, and a named human responsible for the output. Which is the same answer as everywhere else in litigation support, for the same reason.
Briefing the work
Five things to send with the records, all of which take about ten minutes and save considerably more:
- The theory of the case in three lines. Causation, damages quantum, treatment gap, pre-existing condition — whichever it is. A reviewer who knows what is contested reads differently.
- The date range that matters, and whether pre-incident history is in scope. This alone frequently halves the page count.
- Which deliverable you want, named from the five above.
- A sample of a chronology your firm considers good. Worth more than any amount of written specification.
- Known gaps — providers you have subpoenaed but not received. It tells the reviewer what to expect to be missing, so the gap gets reported rather than quietly absorbed.
How the work is usually priced
Three models are common, and the right one depends on the record set rather than on preference.
- Per page — predictable, and appropriate for clean digital records. Insist that the page count is taken after de-duplication, or you are paying for the duplicates.
- Per hour — appropriate for messy, handwritten or mixed-quality sets where the page count tells you nothing about the effort. Ask for an estimate and a not-to-exceed.
- Per deliverable — a fixed price for a defined chronology or audit. Cleanest to budget against, but only works where the record set has been sized first.
Whichever model, the question to ask is what happens if the set turns out to be twice the size it looked. A provider who has a stated answer has been here before.