Short Answer

Under HIPAA, a patient has the right to get copies of their medical and billing records and to direct a provider to send those records to their attorney. Providers generally must respond within 30 days. For legal proceedings without a patient authorization, records may be obtained with a subpoena plus notice to the patient or a court order/qualified protective order. In North Carolina litigation, attorneys typically use a Rule 45 subpoena and, if needed, a protective order to ensure HIPAA-compliant disclosure.

Understanding the Problem

In North Carolina personal injury cases, the question is: how do you legally obtain a patient’s urgent care medical and billing records for use in the claim? Here, the health system could not locate the visit and pointed you to a separate urgent care provider. You need to confirm who actually holds the records and the proper release process so the request goes to the right custodian.

Apply the Law

HIPAA gives patients a right to access their medical and billing records and to direct a provider to send records to a third party, such as their lawyer. For litigation, HIPAA permits disclosures with the patient’s written authorization or in response to a subpoena/court order if specific privacy safeguards are met (such as prior notice to the patient or a protective order). In North Carolina, if suit is filed, nonparty providers are typically reached by subpoena under Rule 45 in Superior Court; providers must be given reasonable time to comply. HIPAA’s access rule requires providers to respond within 30 days (with one 30-day extension for good cause, in writing).

Key Requirements

• Patient direction or authorization: Submit a HIPAA-compliant request or authorization that clearly identifies the patient, provider, date range, and what you seek (medical and billing records) and, if desired, directs transmission to counsel.
• Correct custodian: Send the request to the legal entity that actually holds the records (urgent care operator vs. the larger health system).
• Timing: Providers must respond within 30 days; they may extend once by up to 30 days with a written reason and new date.
• Litigation pathway: Without an authorization, use a Rule 45 subpoena with proof of patient notice or seek a court order/qualified protective order to satisfy HIPAA.
• Fees and format: Providers may charge reasonable, cost-based copy fees; request electronic delivery if readily producible.
• Sensitive records: Some records (e.g., substance use treatment) have extra federal protections and may require specific consent or court order.

What the Statutes Say

• HIPAA Right of Access (45 C.F.R. § 164.524) - Patients can inspect/copy PHI and direct it to a third party; 30-day response timeline.
• HIPAA Judicial/Administrative Proceedings (45 C.F.R. § 164.512(e)) - Disclosures allowed with court order, subpoena plus notice, or protective order.
• N.C. R. Civ. P. 45 (Subpoenas) - Tool to obtain nonparty medical records in NC cases; allows motions to quash/modify.
• N.C. Gen. Stat. § 90-411 (Medical record copy fees) - Reasonable fees permitted for copies of medical records.

Analysis

Apply the Rule to the Facts: First, identify the correct custodian. Because the health system redirected you to a separate urgent care provider, confirm the urgent care’s legal entity and send a HIPAA-compliant authorization/request there for both clinical and billing records from the urgent care date. If the patient will not sign an authorization or the case is already in litigation, serve a Rule 45 subpoena on the urgent care’s records custodian and provide the required HIPAA notice or seek a qualified protective order to permit disclosure.

Process & Timing

1. Who files: The patient (or their attorney with a signed authorization). Where: The urgent care provider’s Health Information Management/Medical Records department in North Carolina. What: The provider’s HIPAA authorization form or your HIPAA-compliant letter requesting medical and billing records for the visit. When: Provider must respond within 30 days; they may add one 30-day written extension.
2. If records are not located or the entity is unclear, call the health system and urgent care to confirm the correct legal entity and records custodian, then reissue the request to that custodian. In pending litigation, issue a Rule 45 subpoena to the custodian with a reasonable compliance date; if needed, move for a protective order to govern use and re-disclosure.
3. Final step: Receive records (preferably electronically) and, in litigation, consider requesting a custodian certification. Maintain confidentiality consistent with any protective order or HIPAA limits.

Exceptions & Pitfalls

• Sending the request to the wrong entity. Verify the urgent care’s corporate name and records custodian before you submit.
• Incomplete authorizations. Ensure patient identity, scope (medical and billing), date range, destination, and signature are clear.
• Special confidentiality rules. Substance use treatment records (42 C.F.R. Part 2) and certain mental health notes may require specific consent or court order.
• Subpoena missteps. In litigation, comply with HIPAA by providing patient notice or obtaining a court/qualified protective order; allow reasonable time to respond and be prepared for motions to quash/modify.
• Format and fees. Request electronic delivery if possible and anticipate reasonable, cost-based copy fees.

Talk to a Personal Injury Attorney

If you're dealing with missing or delayed medical records for a North Carolina injury claim, our firm has experienced attorneys who can help you understand your options and timelines. Call us today at 919-341-7055.

Disclaimer: This article provides general information about North Carolina law based on the single question stated above. It is not legal advice for your specific situation and does not create an attorney-client relationship. Laws, procedures, and local practice can change and may vary by county. If you have a deadline, act promptly and speak with a licensed North Carolina attorney.