The fax arrived on a Tuesday in the second week of February. Four pages, a health plan logo, a list of 63 patient names with dates of birth, and a request for "the most recent blood pressure reading and any HbA1c results from 2025" for each one, due within five business days. The practice manager at the three-provider internal medicine office put it in the pile. By the end of the month there were five more, from four different plans, and one of them wanted remote access to the EHR instead of copies.
That is HEDIS medical record review season, and it runs from roughly February through early May every year. This year the plans are collecting data for measurement year 2025. Kaiser Permanente of Washington told its network the review runs February to the beginning of May 2026. Blue Cross NC announced its review starting in February 2026. Michigan Meridian described a hybrid season from January into April. The exact windows differ, but the shape is the same everywhere: the plan has to hand audited results to NCQA in mid June, so the chart work has to be done by May.
Most of the practices we work with treat these HEDIS medical record review requests as an interruption. We think they are worth treating as a process, partly because the volume is predictable and partly because the same charts tell you exactly which quality data your claims failed to carry. This article covers what the requests are, why you are allowed to answer them, how to run them, and how to have fewer of them next year.
Key takeaways
- HEDIS medical record review requests for measurement year 2025 arrive between February and May 2026, and plans usually ask for a response within five to ten business days.
- HIPAA permits the disclosure without patient authorization because quality assessment is a health care operation of a plan that covers the patient, but the minimum necessary standard still applies.
- Only a handful of measures still use chart review; the rest are calculated from claims, so a chart request means your claim did not carry the result.
- One coordinator, one log and a standard "minimum packet" per measure turn a month of interruptions into a few hours a week.
- CPT Category II codes on 2026 claims are the cheapest way to shrink next year's request list.
What a HEDIS medical record review request is
HEDIS stands for Healthcare Effectiveness Data and Information Set. It is the set of performance measures NCQA maintains and that nearly every commercial, Medicare Advantage and Medicaid managed care plan reports every year. The results feed NCQA health plan ratings, Medicare Advantage Star Ratings and state Medicaid contracts, so plans care about them a great deal, and the money attached to a Star rating is why the requests are persistent.
Most measures are now calculated from administrative data: claims, encounters, pharmacy fills, lab feeds and immunization registries. A few measures still use what NCQA calls the hybrid method. The plan draws a random sample of eligible members, typically 411 per measure, and for anyone in the sample whose claims do not already show the result, a reviewer looks in the chart. Blood pressure control and glycemic status for patients with diabetes are the classic examples, because the number the measure needs (a reading under 140/90, an A1c under 8) lives in the visit note and the lab result, not on the CPT line.
So the request you receive is not random. It is a list of the plan's members in the sample for whom your claims did not answer the question. Every name on that list is a visit where the work was done and the claim did not say so. NCQA has published a proposed timeline for retiring hybrid measures in favor of electronic clinical data reporting over the next several years, which is one more reason the data should be leaving your EHR in structured form rather than by fax.
The HIPAA question everyone asks
We are asked every February whether it is legal to send a patient's blood pressure to an insurance company without asking the patient. It is. The HIPAA Privacy Rule permits a covered entity to disclose protected health information to another covered entity for the recipient's health care operations when both parties have or had a relationship with the individual and the disclosure relates to that relationship, and quality assessment and improvement activities are on the list of health care operations. Your participation agreement almost certainly also obliges you to supply records for the plan's quality programs, usually at no charge. Kaiser Permanente of Washington's provider FAQ says it plainly: a signed consent from the member is not required.
Two limits still apply. The first is the minimum necessary standard. The plan asked for the 2025 blood pressure readings; it did not ask for the psychotherapy notes, the full medication list or the visit from 2019. Send the pages that answer the question. The second is verification. A fax with a logo is not proof. Call the plan's provider services line, or use the contact on your contract, and confirm that the request and the vendor named on it are genuine before you send anything or grant remote EHR access. Retrieval vendors are common and legitimate, but you confirm them through the plan, not through the phone number on the fax.
Two more things trip people up. Requests often include members who have left the plan or who have died, and the plan is still entitled to the record for the year they were covered. And requests can reach back several years for measures with long lookback periods, such as colorectal screening, so archived records from a retired physician are still in scope. The one exception: if a listed patient was never yours, tell the reviewer immediately rather than searching for a chart that does not exist.
A workflow that takes hours instead of weeks
The office that lost a records clerk for March did so because every request was handled as a one-off. The version that works looks like this.
First, one owner. Name a HEDIS coordinator for February through May, usually the practice manager or the most senior medical records person, and route every request to them regardless of which fax line it hit. Second, one log. A spreadsheet with the plan, the vendor, the date received, the due date, the number of patients, the measures requested, the delivery method, the date sent and the confirmation. If a plan later claims you never responded, the log and the fax confirmation are your evidence. Third, a standard packet per measure so nobody decides fresh each time which pages to send.
| Measure the plan names | What the reviewer is actually looking for | Minimum packet to send | CPT Category II code that would have closed it on the claim |
|---|---|---|---|
| Controlling High Blood Pressure (CBP) | The most recent BP in 2025, with the date, under 140/90 | Vitals page from the last 2025 visit; the note if BP was retaken | 3074F or 3075F (systolic under 130, or 130 to 139) plus 3078F or 3079F (diastolic under 80, or 80 to 89) |
| Glycemic Status Assessment for Patients With Diabetes (GSD) | The most recent A1c in 2025, with the date and value | Lab result page or flowsheet showing the value and date | 3044F (under 7.0), 3051F (7.0 to 7.9), 3052F (8.0 to 9.0), 3046F (over 9.0) |
| Prenatal and Postpartum Care (PPC) | A prenatal visit in the first trimester or within 42 days of enrollment; a postpartum visit 7 to 84 days after delivery | Dated prenatal and postpartum visit notes | 0500F, 0501F or 0502F for prenatal; 0503F for postpartum |
| Weight Assessment and Counseling (WCC) | BMI percentile plus documented nutrition and activity counseling in a child 3 to 17 | Growth chart or vitals with percentile; the counseling line from the note | Z68.51 to Z68.54 for percentile; Z71.3 nutrition; Z71.82 exercise counseling |
| Childhood and adolescent immunizations (CIS, IMA) | Vaccine names and administration dates | Immunization record printout, or confirm the state registry entry | The CPT vaccine codes themselves, plus registry submission |
Delivery method matters too. If a plan offers portal upload, use it; it gives you a timestamped receipt. If they ask for remote EHR access, most EHRs let you create a time-limited, read-only, audit-logged account restricted to the listed patients. We prefer that over fax for anything above twenty charts, but confirm the reviewer's identity first and set the account to expire on the due date. Fax is fine for small lists; keep the confirmation sheet.
Turning the request list into next year's fix
Here is the part most practices skip. Before you file the log in May, sort it by measure. If 140 of your 220 requested charts were for blood pressure, you know that in 2025 your claims did not carry blood pressure results, and in 2026 they still are not. The fix is not more staff in February. It is adding the CPT Category II code at the visit.
Category II codes are supplemental tracking codes that end in F. They carry no payment; most payers allow them at a zero charge and a few ask for a one-cent line. When the medical assistant records a blood pressure of 128/78 and the visit is billed with 3074F and 3078F, the plan's administrative data now shows a controlled reading and that patient drops out of the chart sample. Most EHRs can map a vitals value or a lab result to the Category II code automatically. Turn that on, then check a week of claims to confirm the codes are reaching the clearinghouse and not being stripped by a scrubber rule.
The same logic applies to the care gap lists plans send throughout the year, which we covered in an earlier article on closing gaps in care. Chart requests in spring and gap lists in summer are two views of the same problem, and structured data on the claim answers both.
Questions we hear
Can we charge the plan for copying records?
Read your participation agreement first. Most contracts require records for quality and utilization review at no charge, and plans will point to that clause. Where the contract is silent, some practices bill a per-page fee under state law, but in our experience it costs more goodwill than it earns. We would rather spend the effort on reducing the requests.
What if we miss the deadline?
There is no penalty to the practice in the way a payer denial is a penalty. What happens is that the measure counts the patient as non-compliant, the plan's rate drops, and the plan's quality team remembers which practices did not respond when it sets incentive payments and network tiers. Plans will usually accept records a few days late if you tell them in advance. Silence is what hurts you.
Our EHR vendor offers to send data to plans directly. Should we?
Probably yes, if the plan accepts it. Several plans now take continuity of care documents or structured extracts in place of chart pulls, and NCQA is steering measurement toward electronic clinical data. Ask the plan's quality contact what electronic options they accept before the next season, and ask your vendor what it costs. It is one of the few technology purchases that removes work rather than adding it.
What to do this week
- Name the HEDIS coordinator for February through May and route every quality record request to that person.
- Start the request log today with anything already received: plan, vendor, due date, patient count, measures, delivery method.
- Verify each requesting vendor through the plan's provider services line before sending records or granting EHR access.
- Build the minimum packet for the two or three measures that appear most on your lists, so staff pull the same pages every time.
- Ask your EHR vendor to turn on automatic CPT Category II coding for blood pressure and A1c, then audit one week of claims to confirm the codes are transmitting.
- In May, sort the log by measure and give the top measure to the clinical lead as a documentation and coding project for the rest of 2026.
