Our previous article discussed the administrative challenges associated with retrieving medical records held by non-parties in litigation, as well as the efficiencies that might be gained by outsourcing this task to a third-party vendor.
In practice, the task of collecting during pretrial discovery a comprehensive set of medical records is not necessarily straightforward. Relevant records are often held by multiple entities located in various jurisdictions, protected by the federal Health Insurance Portability and Accountability Act and additional privacy laws that vary from state to state. Making a lawful request for records upon each provider, monitoring response deadlines and following up on each request, and assembling the requested records into work product that is useful for the litigation can be difficult.
Lawyers may delegate records requests to third-party vendors, but must supervise, ensure competence, and preserve independent judgment.
It’s not surprising that litigators would consider outsourcing this work to third-party vendors in an appropriate case. But is that ethical? Can litigators outsource records requests to vendors in a manner that is consistent with their professional obligations to their clients? The answer, according to a State Bar of Georgia ethics opinion released earlier this month, is yes.
Three Keys: Supervision, Competence, Independent Judgment
In State Bar of Georgia Formal Advisory Opinion No. 24-1 (Sept. 5, 2025), Georgia lawyers were advised that hiring a third-party vendor to obtain medical records is, from an ethical standpoint, the same as delegating any other type of legal work to a non-lawyer assistant. “Assistants,” the opinion advises, can be “any person or entity that assists the lawyer in representing a client in a matter, whether by employment, contract, or other relationship with the lawyer or firm.”
According to the advisory opinion:
Lawyers are authorized to use and rely on nonlawyer assistants to assist in the representation of clients. Under appropriate circumstances, that could include the use of a third-party vendor to request the production of medical records, bills, and other documents from nonparties and to follow up on and effectuate such requests to nonparties on the lawyer’s behalf.
The use of non-lawyers for delivering legal services is addressed by Rule 5.3 of the Georgia Rules of Professional Conduct. Rule 5.3 provides that a lawyer “shall make reasonable efforts” to ensure that the non-lawyer’s conduct is compatible with the professional obligations of the lawyer. Rule 5.3 obliges the lawyer to supervise the work delegated to a non-lawyer and “communicate directions appropriate under the circumstances to give reasonable assurance that the non-lawyer’s conduct is compatible with the professional obligations of the lawyer.”
Importantly, the Georgia ethics guidance identified three leading considerations for making an ethical delegation of records retrieval work to non-lawyer vendors:
- The lawyer’s responsibility to oversee the non-lawyer assistant. When outsourcing records retrieval work, lawyers must ensure that they retain the right and ability to appropriately supervise the third-party vendor’s work. Lawyers should not make arrangements with vendors in which they are not permitted or able to appropriately direct the actions of the third-party vendor in carrying out the work of serving, following up on, or effectuating a request for production of documents or things.
- The lawyer’s responsibility to provide competent representation. Lawyers are ultimately responsible for ensuring that records requests are carried out competently in a manner that protects client confidentiality and is consistent with applicable laws (e.g., health privacy laws in the case of medical records).
- The lawyer’s responsibility to exercise independent professional judgement. In some cases, the client will suggest that the lawyer hire a particular vendor to handle records requests. If the lawyer believes the client’s suggested arrangement will likely interfere with the lawyer’s independent professional judgment, then an acceptable alternative arrangement should be reached with the client or the lawyer should withdraw from the representation.
The clear takeaway is that outsourcing records retrieval work to a third-party vendor is ethical, provided that the lawyer remains sufficiently involved and empowered to ensure that the work will be competently performed. When delegating the records acquisition process to an outside vendor with expertise in records acquisition and document management, litigators should insist that the vendor demonstrate the ability to deliver records that are:
- complete, accurate, and properly authenticated,
- retrieved within required deadlines,
- transmitted and stored under robust data security measures, and
- easy to access by law firm personnel via a unified online portal.
Importantly, long-established vendors in the records retrieval space will most likely have the largest database of records sources to draw on, as well as a demonstrated track record of on-time delivery of requested records. By insisting on these qualities in a vendor, law firms will have the best chance of efficiently, and ethically, managing the records retrieval process.
