Short Answer

In North Carolina, a law office can usually request a client’s medical records directly if the client signs a proper written authorization (often a HIPAA-compliant release). Without the patient’s authorization, most providers should not release treatment records because North Carolina protects confidential patient-provider communications. If a provider uses a third-party records vendor, the law office typically still can request the records, but it must follow that provider’s required process and submit the signed authorization through the vendor’s portal.

Understanding the Problem

If your North Carolina personal injury lawyer asked a clinic for physical therapy treatment records (not just bills) and the clinic says “the vendor handles records,” the practical question is: can the law office obtain those records directly with your permission, or must you (the patient) make the request yourself?

Apply the Law

North Carolina generally treats medical information from a patient’s care as confidential. As a result, a health care provider typically releases treatment records only when the patient authorizes it (or when a court or other authorized tribunal compels disclosure). In personal injury matters, the most common path is a written authorization signed by the patient that allows the provider (or its records vendor) to release the specified records to the law office.

Two important North Carolina concepts often drive what happens in real life: (1) the state’s physician-patient confidentiality rule, which limits disclosure without patient authorization, and (2) the fact that some settings (like workers’ compensation) have separate rules that can allow certain parties to obtain “relevant medical information” with fewer authorization steps.

Key Requirements

• Valid patient authorization: For most personal injury record requests, the provider will expect a signed written authorization from the patient that clearly permits release of the requested records to the law office.
• Correct scope of records: The request should identify the provider, date ranges, and the types of documents sought (for example, physical therapy evaluations, daily notes, progress notes, discharge summaries), not just billing.
• Proper recipient and delivery method: Many providers require requests to go through a designated medical records department or a third-party vendor portal; sending it elsewhere can delay or stall the request.
• Identity/authority verification: The provider (or vendor) may require proof the requester is the patient’s attorney (for example, letter of representation) and may require specific forms or IDs.
• Fees and format choices: Providers and vendors often charge copying/processing fees and may require prepayment or agreement to pay before releasing records.
• Alternative legal tools if needed: If voluntary production fails, a subpoena process may be available in litigation, but it must follow court rules and still respects confidentiality requirements.

What the Statutes Say

• N.C. Gen. Stat. § 8-53 (Confidential communications between health care provider and patient) - Medical information obtained in treatment is generally disclosed only with the patient’s authorization or by court/authorized order.
• N.C. Gen. Stat. § 97-25.6 (Reasonable access to medical information in workers’ compensation) - In workers’ compensation claims, certain parties can access “relevant medical information” under specific procedures, which differ from typical personal injury requests.
• N.C. Gen. Stat. § 8-44.1 (Hospital medical records) - Addresses how hospital records may be produced and used in court proceedings, including production through subpoena procedures.

Analysis

Apply the Rule to the Facts: Here, the law office already obtained the bills but not the treatment records. That often happens when a provider treats billing as easier to release, but treats clinical notes as confidential and routed through a records department or vendor that requires a specific authorization and submission method. If the client has signed a proper authorization, the law office generally can request the records directly, but it may need to submit the request through the clinic’s third-party vendor portal exactly as instructed.

Process & Timing

1. Who files: The law office (as the patient’s authorized representative) or the patient. Where: The clinic’s designated records channel in North Carolina, often a third-party vendor portal listed on the clinic’s website. What: The vendor’s request form plus a signed medical authorization (often HIPAA-compliant) and any required identification/representation documents. When: As soon as possible after treatment begins or ends; if a lawsuit is pending, do it early enough to avoid discovery and mediation deadlines.
2. Follow-up and curing defects: If the vendor flags the request as incomplete (wrong date range, missing signature, missing required fields, wrong provider location), correct and resubmit promptly. Many delays come from small technical issues rather than a refusal to produce.
3. If voluntary production fails: If a lawsuit is filed and informal requests do not work, the next step is often a subpoena for records through the court’s subpoena process, with proper notice and compliance steps. The provider or vendor then produces records to the requesting party or the court-designated recipient, depending on the subpoena.

Exceptions & Pitfalls

• Workers’ compensation is different: If the matter is a workers’ compensation claim, North Carolina has specific rules about access to “relevant medical information,” notice requirements, and permitted communications that do not always require the same authorization process used in personal injury cases.
• Bills are not the same as treatment records: A billing ledger may not include the clinical notes needed to prove injury, causation, and impairment. Make sure the request clearly asks for the clinical chart, not just “billing.”
• Vendor portals can be mandatory: Even with a signed authorization, a clinic may legitimately require the request to go through its vendor. Repeated phone follow-ups to the clinic may not help if the clinic cannot access the vendor’s queue.
• Overbroad authorizations can backfire: Some providers reject authorizations that are unclear, expired, missing required language, or request more than necessary. Narrow, clear date ranges and provider names often move faster.
• Subpoenas still require compliance steps: A subpoena is not a shortcut if the case is not in litigation yet, and it must be properly issued and served. Improper subpoenas can be objected to or ignored.

Conclusion

In North Carolina, a law office can usually request a client’s medical treatment records directly if the client signs a proper written authorization; otherwise, providers generally should not release confidential treatment information. When a clinic uses a third-party vendor, the law office typically must submit the signed authorization through the vendor’s required process. The most important next step is to submit (or resubmit) the request through the clinic’s designated vendor portal with a complete, correctly scoped authorization as soon as possible.

Talk to a Personal Injury Attorney

If you’re dealing with delays getting medical treatment records for an injury claim, our firm has experienced attorneys who can help you understand the authorization requirements, the provider/vendor process, and the timelines that matter to your case. Reach out today at (919) 341-7055.

Disclaimer: This article provides general information about North Carolina law based on the single question stated above. It is not legal advice for your specific situation and does not create an attorney-client relationship. Laws, procedures, and local practice can change and may vary by county. If you have a deadline, act promptly and speak with a licensed North Carolina attorney.