Medical chronology for personal injury attorneys: HIPAA records, Rule 26 disclosures, and what it costs

For PI and med-mal attorneys, paralegals and nurse consultants · ~7 min read · quotes from 45 CFR 164.524, FRCP 26 and FRE 803

Step one: getting the records — the HIPAA right of access

Everything downstream depends on getting a complete record set quickly. The federal floor is the HIPAA Privacy Rule's right of access, and its language is unambiguous:

"an individual has a right of access to inspect and obtain a copy of protected health information"

45 CFR § 164.524(a)(1)

The clock is the part that matters on a two-year limitations calendar:

"the covered entity must act on a request for access no later than 30 days after receipt"

45 CFR § 164.524(b)(2)(i)

"the covered entity may extend the time for such actions by no more than 30 days"

45 CFR § 164.524(b)(2)(ii)

Thirty days, extendable once — sixty at the outside. Many states are shorter (and where state law is stricter, it controls). The Rule also settles the format argument that used to produce boxes of paper:

"The covered entity must provide the individual with access to the protected health information in the form and format requested by the individual, if it is readily producible in such form and format"

45 CFR § 164.524(c)(2)(i)

Ask for a searchable PDF or the native EHR export, and the provider must supply it if it can. That single request line saves the OCR step later.

What the provider can charge

For a patient's own request the fee is deliberately narrow:

"the covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of: (i) Labor for copying the protected health information requested by the individual, whether in paper or electronic form; (ii) Supplies for creating the paper copy or electronic media if the individual requests that the electronic copy be provided on portable media; (iii) Postage, when the individual has requested the copy"

45 CFR § 164.524(c)(4)

One caution: that fee limit protects the patient's access request. Since Ciox Health v. Azar (D.D.C. 2020) vacated the third-party-directive extension of the fee cap, records requested under a HIPAA authorization to be sent straight to your office are priced under state law instead — which is why many firms now have the client make the access request and forward the copy. Either way, the cost of the records themselves is usually small next to the cost of reading them.

Step two: disclosing them — Rule 26

Once the records are in, they are almost certainly documents you "may use to support" the claim, and Rule 26 brings them into initial disclosure without waiting for a request:

"a copy—or a description by category and location—of all documents, electronically stored information, and tangible things that the disclosing party has in its possession, custody, or control and may use to support its claims or defenses, unless the use would be solely for impeachment"

Fed. R. Civ. P. 26(a)(1)(A)(ii)

Scope, in turn, is bounded by proportionality — and the proportionality factors are exactly where an organised, paginated record set pays for itself when the other side pushes for "every record since birth":

"Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party's claim or defense and proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties' relative access to relevant information, the parties' resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit."

Fed. R. Civ. P. 26(b)(1)

The expert's "facts or data considered"

The chronology's most under-appreciated job is in Rule 26(a)(2)(B). A retained expert's written report must contain, among other things:

"(ii) the facts or data considered by the witness in forming them;"

Fed. R. Civ. P. 26(a)(2)(B)(ii)

A chronology that cites the document and page for every entry is that list, in a form opposing counsel can test at deposition. A chronology that doesn't cite pages is an invitation to a Daubert-flavoured cross-examination about what the expert actually read.

Step three: getting them admitted — FRE 803(4) and 803(6)

Medical records come in under two hearsay exceptions, and both reward a record set where any entry can be traced to its source page. Statements in the history are admissible if the statement:

"(A) is made for — and is reasonably pertinent to — medical diagnosis or treatment; and (B) describes medical history; past or present symptoms or sensations; their inception; or their general cause."

Fed. R. Evid. 803(4)

The chart itself comes in as a business record, provided:

"(A) the record was made at or near the time by — or from information transmitted by — someone with knowledge; (B) the record was kept in the course of a regularly conducted activity of a business, organization, occupation, or calling, whether or not for profit; (C) making the record was a regular practice of that activity; (D) all these conditions are shown by the testimony of the custodian or another qualified witness, or by a certification that complies with Rule 902(11) or (12) or with a statute permitting certification; and (E) the opponent does not show that the source of information or the method or circumstances of preparation indicate a lack of trustworthiness."

Fed. R. Evid. 803(6)

Element (D) is why the production set should stay grouped by provider with continuous page numbers: each custodian's certification under Rule 902(11) then maps cleanly onto one contiguous, numbered block of the production, and the chronology's citations point into it.

What the chronology step costs

US medical-record review services publish their rates, and on the 2026 rate cards we track (RRR Health Tech, MedSum Legal) chronology and expert-opinion tiers run roughly $25–$50 per hour. At a reading pace of 50–100 pages an hour, a 1,000-page record set is ten to twenty hours — several hundred dollars before anyone has formed a view on liability, and paid again if the set is supplemented. In-house, the same hours come out of a paralegal's or nurse consultant's week.

Per-document pricing changes the shape of that cost. One complete chronology and summary is one unit whatever the page count; a paginated, indexed production set is four. Put your own page count into the free cost calculator to see the two side by side.

What a chronology built for US practice looks like

• Every line cited. Date, provider, event, and the document and page it came from — so it doubles as the Rule 26(a)(2)(B)(ii) "facts or data considered" trail and survives cross-examination.
• Grouped by provider, continuously paginated. Emergency department, primary care, imaging, physical therapy, each in its own block, page numbers running across the whole set so a citation is unambiguous. Firms that Bates-stamp apply their own prefix in their production tool; the numbering underneath is already continuous.
• Pre-existing conditions surfaced, not buried. The prior history the defence will find anyway, listed up front with its source pages, so causation is argued from the record rather than discovered at deposition.
• Gaps flagged. Missing date ranges and providers referenced but not produced — the shortlist for your next 164.524 request.
• Counsel review before use. An AI-assisted draft is a starting point. The judgment about what it means for breach, causation and damages stays with the attorney.

Quotations are from 45 CFR § 164.524, the Federal Rules of Civil Procedure and the Federal Rules of Evidence as published by the Legal Information Institute (Cornell) and the eCFR; state rules and state medical-records statutes vary and may be stricter — check the current text for any matter where precise compliance matters. General information for legal professionals, not legal advice.