HIPAA Compliant AI Medical Record Review

Medical record review is HIPAA-regulated work no matter who is doing it — a paralegal building a chronology, a physician reviewer writing an opinion, a payer nurse checking medical necessity, a QA analyst abstracting a chart.

Hathr.AI reads those records inside AWS GovCloud, under a FedRAMP High authorization boundary, with a signed BAA on every HIPAA compliant plan. Output accuracy is measured at 97% in production.

Start a free 7-day trial→ See pricing

measured production accuracy: 97%
pages in one workflow: 100,000
signed BAA, accepted at signup: Every plan

Hathr.AI Blue padlock icon tilted diagonally to show Hathr.AI's security and privacy commitments. — Illustration of Hathr.AI output: a dated chronology with page-level citations, an onset conflict and a treatment gap surfaced, and handwritten sources flagged rather than silently filled in.

Mapped to the frameworks your reviewer will ask about

HIPAA HITECH FedRAMP High NIST 800-53 NIST 800-171 42 CFR Part 2 38 CFR

42 CFR Part 2 and 38 CFR matter for behavioral health and substance abuse records. Hathr.AI's 38 CFR also supports U.S. Military Veterans' records for QSOs and other healthcare providers.

What is Hathr.AI for medical record review?

Hathr.AI is a HIPAA-compliant AI platform that reads complete medical record productions and returns cited, dated output — chronologies, summaries, abstractions and direct answers to questions asked against the file. It runs Anthropic's Claude models inside AWS GovCloud rather than commercial cloud, and every HIPAA-compliant plan includes a signed Business Associate Agreement accepted electronically at signup.

It is used by law firms, litigation-support companies, independent medical examiners, payer utilization teams, and provider-side QA and HIM departments — anyone whose job starts when a few thousand pages of somebody else's records land in their inbox.

Definition

“Medical record review” means four different jobs. Worth separating, because the tool that fits one may not fit another: retrieval (getting records from custodians), preparation (making them searchable and citable), review (turning them into a chronology or an opinion), and interrogation (answering questions against them afterward). Hathr.AI does the last three. It does not do retrieval.

1 · Retrieval Get the records from custodians Not Hathr

2 · Preparation Searchable, citable, handwriting read Hathr

3 · Review Chronology, summary, abstraction Hathr

4 · Interrogation Answer questions against the file Hathr

Why consumer AI fails a medical record review compliance check

The blocker is never capability. It is the contract and the environment.

Consumer AI plans — ChatGPT Free, Plus and standard Team; Claude Free, Pro, Max and Team — include no Business Associate Agreement. Entering protected health information into them is a reportable HIPAA violation regardless of how careful the user is, and disabling model training does not create a BAA. Enterprise BAA paths exist at both OpenAI and Anthropic, but they run through sales-assisted contracts, organizational eligibility review and admin-level enablement, which is not a process a twelve-person firm or a two-nurse UM team can run.

There is a second failure that shows up later, in a vendor security review. A reviewer asks where the records were processed and for how long they were retained. “A major cloud provider” is not an answer that survives that meeting. Neither is a privacy-page assurance about training, because a preference stated on a webpage is not a contract term.

And there is a third, quieter one. A general assistant reading a 4,000-page production will chunk it, summarize each chunk and stitch the result. That works until the question spans chunks — which is precisely what onset conflicts, treatment gaps and pre-existing conditions are.

Commercial cloud standard consumer plans

✕No BAA on the plans people actually use

✕“A major cloud provider” is the answer to where was PHI processed

✕Training posture stated on a webpage, not in a contract

✕Production chunked, summarized and stitched

chunk 1 · chunk 2 · chunk 3 — answers cannot cross the seams

AWS GovCloud (US) FedRAMP High boundary

✓Signed BAA on every HIPAA-compliant plan, accepted at signup

✓US-only processing inside a named authorization boundary

✓Never used for model training or product development

✓Never touches the commercial internet · full audit logging available

one production, one context — page 200 and page 3,400 in the same pass

Both postures can be HIPAA compliant. They are not equivalent risk postures — which is the distinction a vendor security review is actually testing.

The short version. Consumer AI fails medical record review on three counts: no BAA on the plans people actually use, no defensible answer about where PHI was processed, and no ability to hold a whole production in one context. Hathr.AI answers all three the same way for a two-person firm as for a national practice.

The engineering underneath

Whole productions, retrieved and cited — not chunked and stitched

Three capabilities do the work: a context window that holds the whole production, retrieval over your own records so every claim resolves back to a page, and tool use that lets the model run the mechanical steps of review — date sorting, cross-document reconciliation, criteria matching — instead of approximating them in prose.

Pages held in a single workflow

Typical competing tool ~1,000 pages

Hathr.AI 100,000 pages

Roughly 100× the ~1,000-page ceiling typical of competing tools. Drawn to scale — the grey bar is the full width of what most pipelines can hold at once.

01 · Ingest The production, whole Mixed file types, scans, faxes. OCR includes handwriting recognition.

02 · Index Page-level provenance Every passage keeps the produced page number it came from.

03 · Retrieve RAG over your own records The question pulls the relevant pages from across the whole file, not from a single chunk.

04 · Tool use Run the mechanical steps Date sequencing, cross-document reconciliation, gap detection, criteria matching — executed, not narrated.

05 · Cite Output you can defend Every row carries the produced page it came from. Illegible sources are flagged, not filled in.

The same pipeline runs inside the GovCloud boundary end to end. No stage of it reaches the commercial internet.

97% measured accuracy in production, across live records-review work at more than 100,000 records per month

And the other 3%

The remaining 3% is not wrong answers. Those are the cases where Hathr stopped and asked for more information before completing the task rather than filling the gap itself. On a record production, a tool that asks is safer than one that guesses.

What review teams use Hathr.AI for

1. Building a cited chronology from a full production

Upload the production whole. Hathr returns a dated index of every treatment event with a page citation on each row, so any entry can be traced back to a specific produced page. Entries drawn from illegible or handwritten sources are flagged rather than silently filled in — the distinction that keeps a chronology usable under cross-examination.

The field schema we recommend, including the four columns most templates omit, is published in full and free to copy: the medical chronology template. The buyer's guide to the category sits at AI medical chronology software.

What a row carries

→Date of service, normalized and sorted

→Provider and facility as written in the record

→The event, in the record's own language

→Produced page citation

⚑Source-legibility flag where the underlying page is handwritten or degraded

2. Reading handwriting, faxes and image-only scans

Record productions are scans of faxes of photocopies. Intake forms are handwritten, nursing flow sheets are handwritten, and margin notes on printed orders are handwritten — which matters because onset dates and presenting complaints disproportionately live in exactly that material. Hathr's OCR includes handwriting recognition and reads pages that text-only pipelines skip entirely.

Quick answer. Hathr.AI's OCR reads scanned and handwritten pages, not just clean digital text. Ask any vendor to run your worst production rather than their sample file — the difference between pipelines shows up on image-only and handwritten pages, nowhere else.

Text-only pipeline

handwritten region — skipped

Onset date absent from output

Hathr OCR + handwriting

“pt reports onset 2 wks prior — lifting at work” ⚑ handwritten source · verify

Onset conflict surfaced, cited to p. 44

Schematic of the same page through two pipelines. Onset dates and presenting complaints are exactly the material that lives in handwriting.

3. Interrogating the record after the chronology exists

The chronology is rarely the end of the work. Every mention of the left shoulder. All providers who documented a prior injury. Where does the record contradict the deposition? Hathr answers those against the firm's own files, with citations, as many times as needed — which is where most of the recovered time actually is, and the job most chronology-only products do not do.

This is also where the pricing shape matters. Under per-page review, every follow-up question is a new request and a new invoice. Under a flat seat, it is a query.

4. Physician, IME and QME review support

Independent and qualified medical examiners and physician reviewers work from the same productions with a different output: an opinion, not an index. Hathr assembles the underlying material — treatment sequence, conflicting documentation, gaps, what each provider actually wrote versus what the summary says they wrote — and the reviewer forms the opinion.

Hathr surfaces what the record says. A human decides what it means. Nothing on this page substitutes for a clinician's judgment, a treating provider's records, or an expert's opinion.

5. Payer utilization and medical necessity review

UM teams compare a chart against published criteria at volume. Hathr reads the chart and surfaces what the record documents against each criterion, with citations, so the nurse or medical director is reviewing evidence rather than hunting for it. The determination stays with the reviewer — this is documentation support, not an automated denial engine, and it should never be built as one.

6. Billing-record reconciliation

EOBs and itemized statements arrive interleaved with clinical notes, and the billing record frequently dates an encounter the clinical record does not. Reconciling the two is tedious, mechanical and load-bearing for damages. It is also exactly the kind of cross-document work that breaks when a tool can only hold a thousand pages at a time.

7. Workers’ compensation and disability claims

A comp file is rarely one production. It is an initial injury report, years of conservative treatment, an IME, a functional capacity evaluation, a return-to-work note that contradicts the next visit, and a carrier file that arrives in a different order than the provider file. The questions are about causation, apportionment between the industrial injury and prior conditions, and whether the documented restrictions match the documented work.

Hathr holds the whole file at once, so those comparisons happen across the record rather than inside one chunk of it. Adjusters, comp defense teams and QMEs use the same workflow from different sides.

8. Life care planning

A life care plan is built from what the record actually documents: the diagnoses, the surgeries performed and recommended, the assistive equipment prescribed, the medication list, the therapy frequency, and every physician recommendation for future care. Missing one recommended procedure changes the plan’s total.

Certified life care planners and legal nurse consultants use Hathr to pull every future-care recommendation out of the production with a page citation attached, then work from that list rather than from a highlighted PDF. DME and HME suppliers reading the same records for documentation support use it the same way.

9. Everyday summarization, abstraction and QA

Chart abstraction for quality measures, discharge summary review, documentation QA before an audit, and plain “read this and tell me what's in it” work across mixed file types. Same boundary, same BAA, same citations.

How Hathr.AI works

Three steps, and the first one is deliberately small.

Sign up and the BAA is in place
A signed Business Associate Agreement is included on every HIPAA-compliant plan and accepted electronically at signup. There is no sales call, no eligibility review and no seat minimum, which means you can evaluate the product on real records instead of on a sanitized sample. That is the only evaluation that tells you anything.
Upload a production whole, not in pieces
Record sets of up to 100,000 pages are held in a single workflow — roughly 100× the ~1,000-page ceiling typical of competing tools — so questions that span page 200 and page 3,400 stay answerable in one pass.
Ask for the output you actually need
A chronology with citations. A summary. An abstraction against a criteria set. Then keep asking questions against the same file.

A ten-minute first test that tells you something true: take one closed matter you already know well, upload it whole, ask for a dated chronology with page citations, then ask three questions you already know the answers to. Compare. Then run the same test on your worst production — the faxed, handwritten, sideways one. That file decides whether a tool is useful in your practice.

If retrieval is your bottleneck rather than review, that is a different purchase, and what to ask a records retrieval vendor covers it.

AI medical record review vs. per-page review services vs. litigation platforms

Teams shopping for an AI medical record review company, a medical record review service or medical record review software are usually comparing four different things. Categories rather than vendor names, because capabilities change monthly and a table that is wrong is worse than no table. Verify every cell with the vendor in writing before you sign.

Medical record review options compared on nine criteria
Criterion	Consumer AI ChatGPT / Claude standard plans	Outsourced review service	Litigation platform with a review module	Hathr.AI
Signed BAA	No on the plans most people use; enterprise paths require sales contracts	Usually, as a service contract	Varies — ask	Yes, on every HIPAA-compliant plan, accepted electronically at signup
Where PHI is processed	Commercial cloud	Varies, sometimes offshore — ask specifically	Commercial cloud	AWS GovCloud, FedRAMP High boundary, US-only
Used for model training	Check the contract, not the FAQ	N/A — human reviewers instead	Check the contract	Never, for training or product development
Measured accuracy	Not published	Varies by reviewer	Not published	97% in production, across 100,000+ records a month
Handwriting and image-only scans	Poor to none	Strong — humans read handwriting	Varies	OCR includes handwriting recognition
Volume held at once	Chunked	Unlimited, priced per page	Chunked	Up to 100,000 pages in one workflow
Follow-up questions	Yes, but not on PHI	No — new request, new invoice	Limited	Unlimited, with citations
Case-management integration	None	Deliverable arrives as a document	Strongest — the reason to buy one	Export only
Pricing shape	Per seat	Per page	Per seat, often with a platform minimum	Flat per user per month — no per-page fee, no seat minimum (see pricing)

Read that honestly. If your bottleneck is that the chronology needs to live inside your matter file next to your exhibits and your damages model, a litigation platform fits better and we would rather you bought one. If your productions are mostly handwritten and small, a human reviewer may still beat any pipeline. Hathr is the right answer when the volume is high, the questions keep coming, and the records cannot legally go into a commercial tool.

What this costs against what it replaces

Nobody in this category publishes a price list, so the honest thing to give you is the model rather than a number.

Three units of pricing collide in this workflow. Retrieval is priced per request or per custodian, plus statutory provider copy fees — it scales with how many places the patient was treated. Outsourced review is priced per page — it scales with the size of the production, and it re-prices every time you go back with a new question. A per-seat tool is flat — it scales with neither.

Run your own arithmetic with four numbers you already have:

Productions per month, and their median page count.
Your current per-page review rate, if you outsource.
Loaded hourly cost of whoever does it in-house, and hours per production.
Follow-up questions per matter — the number people always underestimate.

That fourth number is where the model actually turns. A production reviewed once, by a service, for a chronology, is a single invoice and often a reasonable one. The same production asked forty follow-up questions across eighteen months — every mention of the prior injury, every provider who documented causation, every place the record contradicts the deposition — is forty more requests from a service, and forty queries under a flat seat.

So the crossover is not really about page volume. It is about question volume, and it arrives earlier than most teams expect. At a flat per-user monthly rate with no per-page fee, a 12,000-page production costs the same to interrogate as a 600-page one, and the fortieth question costs the same as the first.

Cost of one production as the questions keep coming

Schematic, not a quote. The shape is what matters: one line steps up with every request, the other does not.

Model it with your numbers

Question-volume cost model

Productions per month8Median pages per production4200Follow-up questions per matter14

Per-page review rate ($)Seats you needSeat rate (pricing)

Assumption: share of the production re-read per follow-up15%

Monthly, at 33,600 pages

Other AI Per-page review costs$88,536$28,560 first pass + $59,976 in re-priced follow-ups

Hathr.AI's unlimited use/flat rate pricing $1413 seats · unlimited questions, file uploads/downloads, and exports

Cost of one more question, per page: $536
Hathr.AI cost of one more question: $0
Hathr.AI is the best choice at the: right away

Your numbers, your assumptions — nothing here is a quote. The re-read share is the one figure we cannot know for you; set it to what your vendor actually charges to revisit a production.

Caveat one

A flat tool does not remove the human hours — it moves them. The reviewer still verifies the flagged entries and the professional still decides what the record means. What disappears is transcription, not judgment, and a business case built on eliminating the reviewer will not survive contact with the work.

Caveat two

And if your volume is genuinely low — a handful of small, mostly-handwritten productions a year — a human reviewer may still be both cheaper and better. We would rather say that here than have you find it out in month three.

Security and compliance built for vendor review

This section exists to be forwarded to whoever runs your security review.

Environment

Hathr.AI runs Anthropic's Claude models inside AWS GovCloud (US), under a FedRAMP High authorization boundary — the class of infrastructure used for sensitive federal workloads, and a stricter hosting standard than the commercial cloud regions behind most HIPAA-compliant AI. Both can be HIPAA compliant. They are not equivalent risk postures.

Contract

A signed BAA is included on every HIPAA-compliant plan, accepted electronically at signup, with the customer as Covered Entity and Hathr, LLC as Business Associate. The agreement covers the HIPAA Privacy and Security Standards and the HITECH Act, commits to breach notification within 20 business days of discovery, and to return or destruction of PHI within 30 business days of termination. The same obligations flow down to any subcontractor.

Data handling

Customer data is never used for model training or product development, and never touches the commercial internet. Full audit logging of prompts and outputs is available.

Regulatory coverage

HIPAA compliant, plus FedRAMP High infrastructure to handle records from CMS that include Medicare and Medicaid related information.
Use NIST 800-53, NIST 800-171, 42 CFR Part 2 and 38 CFR backed tools that are required for healthcare and specifically, behavioral health and veterans' records inside your environment.

On law firms and business associate status

A firm providing legal services to a covered entity is generally a business associate and needs a BAA in place. A plaintiff's firm holding records obtained under a patient authorization or a qualified protective order under 45 CFR § 164.512(e) generally is not, and its obligations run through that order, state privacy law, and professional-responsibility rules instead. The label changes; the sensitivity of the file does not. We think the right default is to treat every production as though a BAA were required and buy accordingly — it costs nothing when it is not required, and it is the only version of the decision that does not depend on a posture analysis being right. This is a description of how the frameworks fit together, not legal advice; confirm your posture with privacy counsel.

The independent criteria we recommend using on any vendor in this category — including us — are published at best HIPAA-compliant AI tools.

Adjacent workflow

Coding, billing and revenue integrity

Coders and billers read the same chart a reviewer does, and they read it under the same HIPAA rules.

Certified coders, billing managers and revenue-integrity analysts use Hathr the way a reviewer does — to read the documentation and cite it. Pull the diagnoses a chart actually supports before an HCC or risk-adjustment submission. Read a denial letter against the note that triggered it. Check an itemized statement against the clinical record line by line. Assemble the documentation behind a high-risk claim before a coding audit, or answer a payer request without re-reading the chart from the top.

Hathr does not autocode and does not submit claims. It reads the record and shows you where the support is, with the page attached; the credentialed coder assigns the code. That distinction matters for audit defensibility, and any vendor blurring it is worth a second look.

A dedicated page for this workflow is in progress. In the meantime: AI-driven medical coding software and medical billing errors and AI automation.

HCC and risk-adjustment abstractionEvery condition the chart documents, with the page that documents it, before submission.
Denials and appealsRead the denial against the documentation and assemble the appeal from what the record says.
Coding audit preparationPull the supporting documentation for a sample of high-risk claims in one pass.
Billing reconciliation and duplicate detectionEOBs and itemized statements read against the clinical record they are supposed to match.

Who it's for

Personal-injury and medical-malpractice paralegals and case managersworking productions of 3,000–15,000 pages against a demand-letter deadline.
Litigation-support and medical-record-review companiesdoing that work at volume for multiple firms, where per-page economics decide the margin.
Independent and qualified medical examiners and physician reviewerswho need the underlying material assembled before an opinion is written.
Insurance-defense teams and claims professionalsreading the same records from the other side.
Payer utilization management and appeals teamscomparing charts against published criteria.
Provider-side HIM, QA and compliance analystsdoing chart abstraction, documentation review and audit preparation.
Legal nurse consultants and certified life care plannerspulling every future-care recommendation out of a production with a citation attached.
Workers’ compensation adjusters, claims professionals and QMEsworking causation and apportionment across years of an industrial-injury file.
Medical coders, billers and revenue-integrity analystsreading documentation for HCC abstraction, denials, appeals and coding audits.
DME and HME providersassembling the documentation behind a medical-necessity determination.
Behavioral health and developmental-disability providerswhose records fall under 42 CFR Part 2 as well as HIPAA.
Mass-tort and class-action teamscomparing treatment patterns across claimants rather than within one.

Learn more: the medical record review library

AI medical chronology software: a compliance-first buyer's guideThe four jobs inside the category, the evaluation table, and the three questions to put to any vendor in writing.
Medical chronology templateThe twelve-field schema, a worked excerpt showing an onset conflict and a 22-day treatment gap, and the four columns most templates omit. Free to copy.
Medical records retrieval for lawyersWhat retrieval does and does not include, the four questions to ask a retrieval vendor, and what to do the day the production lands.
Best HIPAA-compliant AI toolsThe seven criteria that actually determine compliance, applied across the market.
Is Claude HIPAA compliant?Which Anthropic surfaces carry a BAA and which are explicitly excluded.
Documentation review and chart review in healthcare AIHow AI-assisted chart review fits alongside the clinical reviewer, and where the judgment stays.
Utilization review accelerationReading a chart against published criteria at volume, with citations, without automating the determination.
How Hathr handles your data Read how it works, private HIPAA-compliant AI, and our privacy commitments.

Frequently asked questions

Answered in full on the page, in the phrasing buyers actually use.

My firm needs HIPAA-compliant AI software for handling medical records. What solutions are available?

The market splits into four categories: consumer AI with an enterprise BAA path, outsourced human review services, litigation platforms with a review module, and compliant AI assistants. Hathr.AI is the fourth — it includes a signed BAA on every HIPAA-compliant plan accepted electronically at signup, processes records inside AWS GovCloud under a FedRAMP High authorization boundary, and never uses customer data for model training. The comparison table above sets the four categories against nine criteria.

What is the best AI tool for reviewing medical records?

It depends on which of the four jobs you are buying. For retrieval, use a retrieval vendor. For a chronology that lives inside your matter file, a litigation platform fits best. For reading a full production, producing cited output and then answering unlimited follow-up questions against it — on records that cannot legally go into a commercial tool — Hathr.AI is built for exactly that, at 97% measured production accuracy.

Are there HIPAA-compliant medical record summarization tools?

Yes. The test is not the model but the contract and the environment: does the vendor sign a BAA, what surfaces does it cover, where is PHI processed, and is your data excluded from model training in writing. Hathr.AI summarizes records inside AWS GovCloud at FedRAMP High, with a signed BAA on every HIPAA-compliant plan and no training on customer data.

Which AI platforms meet HIPAA standards for patient data security?

A platform meets HIPAA standards when a signed BAA covers every surface that touches PHI, the environment provides appropriate administrative, physical and technical safeguards, and your data is contractually excluded from training and human review. SOC 2 supports the case but does not establish compliance on its own. Hathr.AI maps to HIPAA and HITECH plus FedRAMP High, NIST 800-53, NIST 800-171, 42 CFR Part 2 and 38 CFR.

I need legal AI with a business associate agreement for HIPAA compliance. What platforms offer this?

Most legal-AI tools are built for documents generally and do not sign BAAs, because their core market is not PHI. Hathr.AI does — a signed BAA on every HIPAA-compliant plan, accepted electronically at signup, with no seat minimum, which is what makes it usable by a two-person firm rather than only by a national one.

How accurate is AI medical record review?

Hathr.AI's record-review output is measured at 97% accuracy in production, across live records-review work running at more than 100,000 records per month. The remaining 3% is not wrong answers — those are the cases where Hathr stopped and asked for more information before completing the task rather than filling the gap itself. On a record production, a tool that asks is safer than one that guesses.

Can AI replace a paralegal or a physician reviewer?

No, and any tool implying otherwise is selling past the workflow. AI drafts the cited output; a reviewer verifies the flagged entries and a professional decides what the record means. What changes is where the hours go — away from transcription, toward verification and analysis.

Can Hathr.AI be used for medical coding and billing review?

Yes. Coders, billers and revenue-integrity analysts use it to read documentation and cite it — HCC and risk-adjustment abstraction, denial letters read against the note that triggered them, itemized statements reconciled against the clinical record, and documentation pulled for a coding audit. Hathr does not autocode and does not submit claims; it shows where the support is in the record, with the page attached, and the credentialed coder assigns the code.

Does this work for QME, IME and workers’ compensation record review?

Yes, and it is one of the heavier use cases. Qualified and independent medical examiners, comp adjusters and defense teams work from files that span years and arrive in several productions at once. Because the whole file is held in a single workflow, causation and apportionment questions are answered across the record rather than inside one chunk of it, with citations back to the page.

How many pages can Hathr.AI read at once?

Up to 100,000 pages in a single workflow — roughly 100 boxes of paper. The production goes in whole rather than split into chunks, which is what makes cross-record comparisons reliable: a contradiction between a page-40 intake form and a page-9,000 deposition exhibit is only findable if both are in view at the same time.

Do you charge per page for medical record review?

No. Hathr.AI is a flat per-user monthly subscription with no per-page fee and no seat minimum, so a 12,000-page production costs the same to read as a 600-page one and the fortieth follow-up question costs the same as the first. Per-page review services re-price every time you go back with a new question; see pricing and model both shapes against your real monthly volume.

How much does HIPAA-compliant medical record review software cost?

Most tools in this category price per page or per matter, so cost scales with production size and re-prices every time you go back with a new question. Hathr.AI is a flat per-user monthly subscription with no per-page fee and no seat minimum — see pricing for current rates. Model both shapes against your real monthly volume before signing either.

Put it on a real production

Take one closed matter you already know the answer to. Upload it whole. Ask for a cited chronology, then ask the three questions you could already answer yourself. The BAA is in place from signup, so you can do this on real records rather than on a sample.

Start a free 7-day trial→See pricing Talk to our team

Accuracy measured in Hathr.AI production environments during live records-review work at a volume exceeding 100,000 records per month. Informational, not legal advice.