Glossary for buying medical record review software
Plain definitions of the terms in vendor proposals, contracts and security questionnaires for record review software. Legal terms are summarized for buyers; have counsel read the contract you sign.
Limits: Vendor facts come from each vendor's own website, read on 2026-11-12; we haven't run every product, and prices, terms and security claims change, so get them in writing before you sign.
Contract and compliance terms
- BAA (Business Associate Agreement)
- The contract HIPAA requires between a covered entity and a vendor that handles protected health information for it. 45 CFR 164.504(e) lists what it must contain. See the security and BAA page.
- Business associate
- A person or company that creates, receives, stores or transmits protected health information on behalf of a covered entity. A record review vendor working for a practice or hospital is usually one.
- Subcontractor
- A company the business associate uses that also touches the records, such as a cloud host or an AI model provider. It must agree to the same restrictions as the business associate.
- PHI (protected health information)
- Health information that identifies a person and is held or sent by a covered entity or business associate. A medical record file is PHI.
- Breach notification
- The duty to report a breach of unsecured PHI. HHS says a business associate must tell the covered entity without unreasonable delay and no later than 60 days from discovery. Contracts often set a shorter deadline.
- SOC 2
- An attestation report by an outside auditor on a service company's controls, using AICPA criteria for security, availability, processing integrity, confidentiality and privacy. Type 1 covers control design on a date; Type 2 tests controls over a period.
- Data residency
- Where records are stored and processed, by country or region. Ask about hosting, backups and AI model providers separately; they can differ.
- Audit log
- A record of who opened, changed, exported or deleted what, and when. Useful for your own HIPAA duties and for showing what was reviewed.
- SSO (single sign-on)
- Logging in through your organization's identity provider instead of a separate password. Matters most to hospitals; often priced as an add-on.
- Auto-renewal
- A contract clause that renews the term unless you cancel by a notice date. Check the notice period before signing an annual plan.
Pricing terms
- Total cost of ownership
- Everything a tool costs over a period: license, fees, and the staff and physician time it takes to use and check. The calculator counts all 3 for 12 months.
- Overage
- The per-page or per-unit price charged above a plan's included amount, such as pages above a monthly allowance.
- RFP (request for proposal)
- A written set of questions sent to vendors so their answers can be compared. A practice can send 1 email; a hospital uses a formal template. See the RFP question list.
Record and output terms
- Deduplication
- Finding pages that repeat in a file, usually because the same records came from several sources, and grouping them so they are read and billed once.
- Page citation
- A link from a line of output to the page of the record it came from. The single feature that makes AI output checkable.
- Chronology
- A date-ordered list of medical events from the record: visits, tests, procedures, medications, with provider and source page for each.
- OCR (optical character recognition)
- Turning a scanned or photographed page into text. Quality on faxes and handwriting varies a lot between tools.
- Bates number
- A unique number stamped on each page of a legal production so pages can be cited exactly.
- Hallucination
- An AI output stating something that isn't in the source, such as a visit that never happened or a wrong date.
- Omission
- Something in the record that the output leaves out. Harder to catch than a hallucination, because nothing on the page looks wrong.