How do I follow up on a delayed medical records request for use in litigation?

Short Answer

In North Carolina, a HIPAA-covered provider generally must act on a proper patient right-of-access request within 30 days, with one written extension of up to 30 additional days. That deadline does not automatically apply to every attorney request made only under a HIPAA authorization. If the hospital has not confirmed receipt or produced records, send a written follow-up to Health Information Management and the privacy officer, confirm the request details, and set a clear deadline. If a lawsuit is filed, you can obtain a subpoena issued under North Carolina Rule 45 to compel production.

Understanding the Problem

You need medical records from a North Carolina hospital for a personal injury case, but the hospital has not confirmed your request or produced the records within its usual processing time. The question is: how do you, as the patient or the patient’s attorney, follow up so the records are released for litigation?

Apply the Law

North Carolina law and HIPAA work together here. HIPAA-covered providers generally must act on a patient's request for access to copies of records within a set timeframe, and they may charge only certain fees. When a civil case is filed in a North Carolina court, you may also seek records from the records custodian using a subpoena. Under North Carolina Rule 45, the clerk of court or a judge issues the subpoena; an attorney may prepare the official AOC subpoena form and arrange for proper service. For a HIPAA right-of-access request, the key timing trigger is the date the provider received a valid request. HIPAA sets a general 30-day response window, with one written extension of up to 30 additional days if the provider gives the reason for the delay and a new completion date.

Key Requirements

Valid request/authorization: Ensure the request clearly identifies the patient, dates of service, provider, and scope of records. If relying on HIPAA’s 30-day access deadline, use a patient right-of-access request under 45 C.F.R. § 164.524, which may direct the records to the patient's attorney. A request made only under a HIPAA authorization is not automatically governed by that access deadline.
Timely response: Providers generally must act on a valid HIPAA right-of-access request within 30 days or give a written reason and a new completion date for one extension of up to 30 additional days.
Reasonable fees only: Copying charges must comply with North Carolina’s fee statute and, when the request is made under HIPAA’s right of access, HIPAA’s cost-based limits.
Litigation tool if needed: After a case is filed, obtain a subpoena issued by the clerk of court or a judge under North Carolina Rule 45 and serve it on the custodian of records. HIPAA and any special confidentiality requirements must still be satisfied.
Format and scope: Ask for electronic copies when available and limit the request to what the claim requires (to reduce delays and costs).

What the Statutes Say

N.C. Gen. Stat. § 90-411 (Copying fees for patient records) - Sets allowable charges for copies of patient medical records, subject to applicable federal limits.
N.C. R. Civ. P. 45 (Subpoenas) - Authorizes subpoenas, including subpoenas for records from a custodian, and provides for issuance by the clerk or a judge.
N.C. Gen. Stat. § 8-44.1 (Hospital medical records) - Addresses authentication of hospital records tendered under Rule 45(c) or authenticated through the custodian’s testimony, if the records are otherwise admissible.
45 C.F.R. § 164.524 (HIPAA right of access) - Sets the general 30-day response deadline with one written extension of up to 30 additional days.

Analysis

Apply the Rule to the Facts: Your firm submitted a request with the patient’s identifying information, but the hospital has not confirmed receipt or produced records. First, determine whether the submission was a patient right-of-access request under 45 C.F.R. § 164.524 or only an authorization for disclosure, and confirm that it was delivered to Health Information Management. If about 30 days have passed since receipt of a valid right-of-access request, send a written follow-up demanding that the provider act on the request or provide the required written extension notice and completion date. Offer to pay allowable fees. If a lawsuit is already filed, consider obtaining a Rule 45 subpoena issued by the clerk or a judge and serving it on the custodian of records.

Process & Timing

Who files: The patient or the patient’s attorney. Where: Hospital Health Information Management and the hospital’s privacy officer in North Carolina. What: A written follow-up attaching the original patient right-of-access request or authorization, proof of delivery, and a request for electronic copies. When: Follow up promptly; if no response by about 30 days after receipt of a valid right-of-access request, demand compliance or the required written extension notice and completion date.
If still delayed: Send a final notice giving a short, reasonable deadline and ask for a fee estimate consistent with N.C. Gen. Stat. § 90-411 and any applicable HIPAA fee limits. Note that specialized records, including certain behavioral health or substance use disorder records, may be subject to additional confidentiality requirements.
If litigation is filed: Ask the Clerk of Superior Court or a judge to issue a subpoena to the custodian of records under Rule 45 using the official AOC subpoena form available on nccourts.gov. Arrange for proper service, allow reasonable time for compliance, and follow the Rule 45(c) procedure if the hospital records will be tendered for use in court under § 8-44.1.

Exceptions & Pitfalls

An incomplete or expired authorization can stall a disclosure request. Ensure the form clearly lists the provider, date range, permitted recipient, purpose when required, and expiration date or event, and is signed and dated.
A HIPAA authorization is not necessarily the same as a patient right-of-access request. If relying on the 30-day deadline in 45 C.F.R. § 164.524, clearly submit the request under the patient's right of access.
Requests sent to the wrong facility or fax number get lost. Verify the correct Health Information Management contact and delivery method.
Some records, such as psychotherapy notes or certain substance use disorder records, have additional consent requirements or disclosure limits. Plan for added review.
Fees above North Carolina’s limits or unclear invoices can delay release. Ask for a fee estimate that complies with § 90-411 and, for a HIPAA access request, HIPAA’s cost-based rules.
Subpoenas that are not properly issued or served, fail to allow reasonable time for compliance, or do not satisfy applicable privacy requirements risk objections. Follow Rule 45 and any applicable HIPAA or special confidentiality procedures.

Conclusion

To follow up on a delayed medical records request in North Carolina, determine whether the request invokes the patient's HIPAA right of access, verify delivery to Health Information Management, and demand a response within the applicable deadline. If 30 days have passed after receipt of a valid right-of-access request without records, a denial, or a proper written extension notice, send a firm written follow-up and be ready to pay allowable fees. If a lawsuit is filed, obtain a Rule 45 subpoena issued by the clerk of court or a judge and arrange for proper service on the custodian of records.