Job Description

The Medical Records & Compliance Specialist owns the intake, classification, and end-to-end processing of patient and continuation-of-care medical records requests — serving as the dedicated point of accountability for this request stream as Ally Medical continues to add sites and grow request volume. The role verifies patient identity and authorization, processes releases in accordance with HIPAA and practice policy, and tracks every request through to completion in the HIPAA tracking system. Positioned within the Compliance department, the role also carries compliance administration support.

Requirements

Duties/Responsibilities:

Medical Records Processing

• Monitor the dedicated medical records fax, phone line, and email inbox.
• Own the intake and classification of all requests across every channel, determining the appropriate workflow for each.
• Identify and forward requests that fall outside the continuation-of-care scope to the RCM team’s billing/payer workflow.
• Track every request through to completion, ensuring releases are processed within established turnaround-time standards and nothing goes unresolved or falls through the cracks.
• Serve as the dedicated owner of all patient and continuation-of-care medical records requests, plus requests from state boards or county agencies, from intake through release.
• Follow up directly with patients, facilities, or requestors to obtain any missing information needed to complete a request.
• Flag requests approaching or past the turnaround-time threshold.

Compliance Responsibilities

• Support HIPAA compliance monitoring, including periodic audits of the medical records request log for completeness, authorization documentation, and turnaround-time adherence.
• Assist in maintaining and updating medical-records-related policies and procedures to reflect current practice and regulatory requirements.
• Support staff training on HIPAA authorization requirements and proper records-request handling across intake channels.
• Participate in compliance reporting and assist with responses to compliance inquiries or audits involving medical records.
• Take on additional compliance department projects and responsibilities as assigned.

Required Skills/Abilities:

• Working knowledge of HIPAA privacy and release-of-information requirements.
• Strong attention to detail and ability to manage a high volume of requests accurately.
• Clear written and verbal communication skills for working with patients, facilities, and internal teams.
• Familiarity with release-of-information (ROI) platforms and ticketing/workflow systems (preferred).

Education and Experience:

• High school diploma or equivalent; Associate’s or Bachelor’s degree preferred.
• 1–2+ years of experience processing medical records requests, HIPAA release-of-information work, or healthcare administrative/compliance experience.
• Prior experience in a healthcare compliance function (preferred).
• Experience with multi-site medical practices or healthcare organizations undergoing growth (preferred).

Physical Requirements:

• Prolonged periods of sitting at a desk and working on a computer.
• All employees of Ally are responsible for complying with all privacy and security laws and internal policies and procedures. You will play an active role in protecting the company's sensitive data and ensuring that our patient's information is treated with the utmost care and confidence. You are responsible for reporting any concerns or infractions that you become aware of so that the company may appropriately address them.
• You are responsible for protecting the credentials provided to you to access Company (and customer, where applicable) networks, systems, and data.
• You are responsible for maintaining the confidentiality of all Ally and customer data to which you are granted access. Any suspected compromises of Ally proprietary data or customer data must be reported to Management immediately.
• You will adhere to the Company’s Information Security Policy and Procedures and support standard operating procedures to protect Company systems and data.
• You will alert management immediately with any expected system or data compromises and/or system failure impacting the security, confidentiality, availability, and integrity of Ally Medical and customer data.
• You will be required to attend an annual Information Security Awareness Training.