What information or authorization does a clinic or records vendor usually require to release therapy records to a law firm?
What information or authorization does a clinic or records vendor usually require to release therapy records to a law firm? - North Carolina
Short Answer
In North Carolina, a clinic or its records vendor will usually require a signed, written patient authorization (often a HIPAA-compliant release) that clearly identifies who may receive the records, what records are requested, and the purpose of the disclosure. Many vendors also require a specific request submitted through their portal, identity/relationship verification for the requesting law firm, and payment or agreement to pay allowable copying/processing fees. If the records involve mental health or substance-use treatment information, clinics often require a more specific authorization and may apply stricter confidentiality rules.
Understanding the Problem
If you are a North Carolina personal injury law firm trying to obtain a client’s physical therapy treatment records (not just bills), can the clinic or its third-party vendor require a specific written authorization and a particular submission method before releasing those records, especially where the clinic says requests must go through the clinic website and the vendor?
Apply the Law
Under North Carolina law, medical information in treatment records is generally confidential and is typically released to a third party (including a law firm) only with the patient’s authorization, unless a court (or another authorized tribunal) compels disclosure. North Carolina also has separate confidentiality rules for certain mental health records, and those rules commonly require written consent that meets core federal HIPAA authorization elements. In practice, many clinics outsource record production to a vendor, and the vendor will still require the same legal permission (a proper authorization) plus whatever administrative steps the clinic has adopted for processing requests.
Key Requirements
Signed written authorization from the patient: Usually a HIPAA-style authorization signed and dated by the patient (or a legally authorized person) allowing the clinic/vendor to release records to the law firm.
Clear description of what to release: The request should specify the provider/clinic, date range, and the types of records (for example, “physical therapy evaluation, daily treatment notes, progress notes, discharge summary, and any imaging/referrals in the chart”).
Clear identification of who may receive the records: The authorization typically must name the law firm (and sometimes a specific attorney) and provide a delivery method (secure email, portal, mail).
Purpose and expiration: Many authorizations must state the purpose (often “legal claim”) and an expiration date or event (for example, “one year from signature” or “conclusion of the claim”).
Extra steps for certain therapy/behavioral health information: If the records include mental health treatment information (or other specially protected categories), the clinic may require more specific language and may limit what is released without a compliant authorization.
Vendor process and verification: A third-party vendor commonly requires the request be submitted through a portal, includes a copy of the signed authorization, and may require confirmation of the requester’s identity and contact information.
Fees and format choices: The clinic/vendor may require payment or an agreement to pay allowable copying/processing fees and may offer options for electronic vs. paper production.
Apply the Rule to the Facts: Here, the law office received billing but not the treatment records, and the clinic says a third-party vendor handles records and requires a third-party request through the clinic website. That usually signals the vendor will not release treatment notes until it receives (1) a properly completed, signed authorization that clearly covers “treatment records,” not just “billing,” and (2) the request submitted in the vendor’s required format (often a portal upload) with the law firm’s contact and delivery details. If any portion of the file is treated as specially confidential (for example, certain mental health information), the vendor may also be checking whether the authorization language is specific enough before releasing it.
Process & Timing
Who files: Typically the patient’s law firm (as the patient’s authorized representative) or the patient directly. Where: Usually through the clinic’s designated records portal (or the vendor’s portal) for North Carolina providers. What: A signed HIPAA-style authorization plus the vendor’s request cover sheet/online form and any required identity/contact verification. When: As soon as possible after representation begins; if there is litigation, do not wait until discovery deadlines are close.
Vendor review and processing: The vendor commonly reviews the authorization for completeness (correct patient identifiers, signature/date, recipient, scope, date range, purpose, and expiration) and may send a deficiency notice if anything is missing or ambiguous (for example, requesting “bills” but not “records,” or leaving the recipient blank). Processing times vary by provider and vendor.
If voluntary production stalls: If a lawsuit is filed, records are often obtained through formal discovery tools such as a subpoena to the custodian of records (with required notice and compliance steps). The provider may then produce records in response to the subpoena process rather than an informal request.
Exceptions & Pitfalls
Authorization that is too narrow: A common reason bills arrive but treatment notes do not is that the authorization or request only asks for “billing” or “itemized statements,” not “treatment records/clinical notes.”
Mismatched names or identifiers: Vendors frequently reject requests where the patient name, date of birth, or dates of service do not match the clinic’s chart exactly (including prior names or minor typos).
Missing required authorization fields: Leaving out the recipient, purpose, expiration, signature date, or delivery instructions can trigger a hold.
Special confidentiality categories: If the file includes mental health information covered by North Carolina confidentiality rules, the vendor may require a more specific written consent and may limit what it releases without it.
Assuming the vendor can “talk substance” without permission: Even when a provider will discuss scheduling or billing, it may refuse to discuss clinical content or release notes without a compliant authorization.
Waiting too long to use formal process: If informal requests are not working and litigation is active, delaying subpoenas can create avoidable deadline pressure.
Conclusion
In North Carolina, a clinic or its records vendor will usually release therapy treatment records to a law firm only after receiving a signed written patient authorization that clearly identifies the recipient, the records requested (not just bills), and the purpose and expiration of the release. Vendors also commonly require the request be submitted through their portal and may require verification and payment arrangements. If a case is in litigation, the next step is often to serve a custodian-of-records subpoena early enough to meet discovery deadlines.
Talk to a Personal Injury Attorney
If you’re dealing with delayed therapy records that a clinic has outsourced to a third-party vendor, our firm has experienced attorneys who can help you line up the right authorizations, follow the correct request process, and choose the right formal tools if records still do not arrive on time. Call (919) 341-7055 to discuss your options and timelines.
Disclaimer: This article provides general information about North Carolina law based on the single question stated above. It is not legal advice for your specific situation and does not create an attorney-client relationship. Laws, procedures, and local practice can change and may vary by county. If you have a deadline, act promptly and speak with a licensed North Carolina attorney.
