Medical record review software: how to choose and buy it
Short answer: buy medical record review software that cites a source page for every line, removes duplicate pages before it bills you, signs a BAA that names its AI subcontractors, and publishes a price you can turn into a 12-month total. Then test it on a closed file you already know, and count your own checking time as part of the price.
Limits: Vendor facts come from each vendor's own website, read on 2026-11-12; we haven't run every product, and prices, terms and security claims change, so get them in writing before you sign.
What should you look for in medical record review software?
4 things decide most purchases. First, every fact in the output links to the page it came from, so you can check it in 1 click. Second, the vendor signs a Business Associate Agreement before you upload anything, and tells you which AI model providers and hosts touch the records. Third, the price is stated per unit you can count (pages, cases or seats), with duplicate pages, minimums and rush fees spelled out. Fourth, it handles your real files: their size, their scan quality and the mix of sources they come from.
Everything else on this site expands those 4 points into questions you can send a vendor and math you can run on your own volume.
4 kinds of product sold under this name
Search for medical record review software and you get 4 different things on the same results page. They cost different amounts because they do different work, so sort them before you compare prices. We read the top 10 Google results for 5 buyer searches on 2026-11-12, and most of the products in them are built for law firms and insurers. A physician, an IME or QME clinic, or a hospital risk team has to read past that framing.
| Type | What you get | How it is usually priced | Who it fits |
|---|---|---|---|
| Self-serve AI review software | You upload the file; software builds a chronology and summary in minutes to hours; you check it | Per page, page allowance, per case or annual credits | Physicians and teams who want control and the lowest cost per file |
| AI plus human review service | You send the file; clinicians or nurses check an AI draft and return it in days | Per page or per case, often with rush fees | Buyers who don't want to touch the records at all |
| Legal case platforms with a chronology feature | Case management, document review, sometimes a medical chronology module | Per user per month, often annual | Law firms; rarely the right fit for a clinic |
| General HIPAA AI workspaces | A chat assistant covered by a BAA that can read uploaded documents | Per user per month | Short documents and drafting help; check document size limits before you load a full record set |
The rest of this guide is about the first type, with the second as the main alternative. The pricing models page shows real published prices for all 4.
Must-have features, in short
A demo always looks good, because the vendor picks the file. These are the features to check on your own file, with what to look for. The features page has the full scorecard.
| Feature | Why it matters | How to test it |
|---|---|---|
| Page citations on every line | You sign the report; you need to see the source for each fact | Click 20 random citations; each should open the right page |
| Duplicate page removal | Productions from several sources repeat the same notes; you shouldn't pay or read twice | Upload a file where you know the duplicates; compare the page count billed |
| Scans and handwriting | Older and outside records are often faxed or handwritten | Include 10 handwritten pages and check what was read |
| Large files | Your largest file sets the limit you need, not your average one | Ask the per-file page and size limit in writing |
| Missing records and gaps | What isn't in the file can matter as much as what is | Remove 1 known visit and see if the gap is flagged |
| Questions about the file | Saves rereading when a new question comes in | Ask 5 questions you already know the answers to |
| Exports you can use | The output goes into your report or the case file | Export to PDF and Word; check citations survive |
| Access controls | Staff, reviewers and outside parties need different rights | Check roles, MFA and an access log |
Security and the BAA: 6 questions that end most shortlists
If you are a covered entity, or you work for one, HIPAA requires a written contract with any vendor that stores or processes protected health information for you. The required contents are set out in 45 CFR 164.504(e). A vendor that says "BAA available" has told you very little. Ask these 6 questions in writing before any trial with real records:
- Will you sign a BAA before the first upload, and can we see it now?
- Which subcontractors touch the records, including AI model providers and hosting, and do they all sign BAAs with you?
- Do our records, or anything derived from them, ever train or tune a model? Is that promise in the contract or only in a settings page?
- Do you have a SOC 2 report, which type, for what period, and can we read it under NDA?
- How long do you keep our files after a case closes, and can we delete them ourselves?
- How fast will you tell us about a breach? HHS sets the outer limit for a business associate at 60 days from discovery; ask for a shorter contractual number.
The security and BAA page maps each required BAA clause to the regulation, lists what 16 vendors say publicly about BAAs and SOC 2, and names the red flags.
Pricing models compared
Published prices for this category come in 6 shapes. The model matters more than the headline rate, because each one punishes a different usage pattern.
| Model | Published example | Cheapest when | Costly when |
|---|---|---|---|
| Per page, prepaid | InPractice $0.15 to $0.07 a page by pack size | Volume is uneven | Duplicate pages are billed |
| Monthly page allowance plus overage | MediScan $169 for 1,200 pages, then 10 cents | You use most of the allowance every month | Some months are quiet |
| Annual credit subscription | Dodonai $300 to $1,000 a year for set credits | Volume is steady and known | You overbuy or advanced runs use extra credits |
| Per case or per summary | Legalyze $199 a case; CaseMark $25 plus $0.01 a page, capped at $100 | Files are large | Files are small and frequent |
| Per user seat | BastionGPT $20 to $75 a user a month | Many short documents | The seat can't load a full record set |
| Service per page | Medical Insightz from $0.15 a page | You want people to do the review | You still check the output yourself |
Sources and capture dates for every row are on the pricing models page.
What a year really costs: the license is the smaller part
Most comparisons stop at the price per page. For a physician, the larger cost is often your own time checking the output. A tool that is 3 cents a page cheaper but takes twice as long to verify costs more by the end of the year.
Here is a worked example on a synthetic practice (synthetic, no real patient, no real clinic): 60 files a year, 1,500 pages on average, 20% duplicate pages, a physician hour valued at $300, and checking time of 6 minutes per 100 unique pages. These inputs are assumptions for the example, not measurements.
| Option | License for the year | Your checking time | Total |
|---|---|---|---|
| 10 cents a page, duplicates not billed | $7,200 | $21,600 | $28,800 |
| 10 cents a page, every page billed | $9,000 | $21,600 | $30,600 |
| $169 a month for 1,200 pages, then 10 cents | $9,588 | $21,600 | $31,188 |
| $199 a case | $11,940 | $21,600 | $33,540 |
| Any option, if checking takes 12 minutes per 100 pages | as above | $43,200 | $50,400 or more |
2 lessons from the example. The gap between pricing models is a few thousand dollars a year. The gap between a tool you can check fast and one you can't is tens of thousands. Put your own numbers into the total cost calculator, using checking times you measured in a trial, not the vendor's speed claim.
A 6-step buying process that fits in a month
Hospitals run procurement; a solo physician runs a week of email. The steps are the same, only the paperwork changes.
- Write requirements. List your 3 most common case types, your average and largest file, and who checks the output. Mark each feature as must-have or nice-to-have.
- Screen security first. Send the 6 questions above. Drop any vendor that won't sign a BAA before upload or won't name its AI subcontractors.
- Shortlist 3. 1 per-page tool, 1 with a different pricing model, and 1 wild card. More than 3 trials and you won't finish any of them properly.
- Trial on a closed file. Use a case you already reviewed by hand, so you know the right answers. Time your own checking. Note every wrong date, missed visit and wrong citation.
- Send the RFP and negotiate. Use the RFP question list and get answers in writing: price, limits, data handling, exit terms.
- Roll out and review at 30 days. Compare billed pages, checking time and errors against the trial. Keep the option to leave: no long term until the numbers hold.
When to buy software, and when to buy a service instead
Software makes sense when a physician or a trained reviewer will read the output anyway. It turns the first pass from hours into minutes, and you keep control of the facts. A service makes sense when nobody on your side has time to check a draft, when you need a reviewer with a specific clinical specialty, or when volume is so low that learning a tool isn't worth it.
Neither option removes the physician's duty. In IME, QME, peer review and expert work, the person who signs is responsible for the opinion and for the record review behind it. No software we know of forms the opinion, and you shouldn't buy one that claims to.
3 situations where we'd tell you not to buy this kind of software at all:
- You need a scribe for patient visits. That is a different product category.
- You need to request and retrieve records from providers. Most review tools only analyze files you already have.
- Your files are under 50 pages and arrive a few times a month. A careful manual read is cheaper.
Questions buyers ask about medical record review software
What is medical record review software?
Medical record review software reads a set of medical records, usually hundreds or thousands of PDF pages, and produces a chronology, summary and answers to questions about the file, with links to the source pages. Physicians use it for IME, QME, peer review, expert and standard-of-care work; hospital teams use it for risk and claims review.
How much does medical record review software cost?
Published prices captured on 2026-11-12 run from about $0.04 to $0.15 a page for per-page tools, $99 to $665 a month for page allowance plans, and $199 to $299 a case for per-case tools. Your checking time usually costs more than the license; run your numbers in the calculator.
Do I need a BAA with a record review vendor?
If you are a HIPAA covered entity or a business associate of one, yes: the vendor stores and processes protected health information for you, and 45 CFR 164.504(e) requires a written contract with set terms. Get it signed before the first upload, and check that it covers the vendor's AI model providers.
Is SOC 2 enough to trust a vendor?
SOC 2 is a useful start, not an answer. Ask which type (Type 1 checks control design at a point in time; Type 2 tests controls over a period), which period it covers, and whether you can read the report. A SOC 2 claim doesn't tell you whether records train models or where they are stored.
Can I use ChatGPT or another general AI chat for record review?
Not with patient records on a consumer plan, which has no BAA. HIPAA-covered AI workspaces exist and sign BAAs, but check their document size limits and whether answers cite pages; many are built for short documents, not 3,000-page files.
How long should a trial take?
1 week per vendor is enough if you prepare: pick a closed file you know, list 20 facts to check, and time yourself. Trials published by vendors in our table range from 100 pages to 1,000 pages, or 7 to 15 days.
Should a hospital run a formal RFP?
If procurement requires it, yes, and the RFP question list is written to drop into one. A small practice can send the same questions by email; the point is getting the answers in writing.