What obligations do healthcare providers have when releasing billing information to authorized representatives?

Understanding the Problem

You want to know if a North Carolina provider can tell an authorized representative what, if anything, is still owed on a patient’s account—and what the provider must do before sharing that billing information. This comes up in personal injury matters when an attorney tries to confirm post-insurance balances. Here, the attorney provided the client’s name and date of birth to the billing office.

Apply the Law

Under North Carolina law, providers may share billing information with: (1) the patient; (2) an authorized personal representative for a living patient (such as an agent under a valid power of attorney or a court‑appointed guardian); (3) a duly appointed personal representative of a deceased patient’s estate; or (4) another requester who presents a valid, case‑appropriate court order or subpoena. Providers should verify the requester’s identity and authority, disclose only the minimum necessary information for the purpose stated, and follow special protections for mental health/substance use records. If records are produced, providers may charge statutory copy fees.

Key Requirements

• Authority or authorization: Get a signed HIPAA‑compliant authorization from the patient, or proof of legal authority (healthcare POA, guardianship, or estate letters for a decedent), or a valid court order/subpoena.
• Verification: Reasonably confirm the requester’s identity and authority; name and date of birth alone are usually not enough for a third party.
• Minimum necessary: Limit disclosures to the billing information reasonably needed for the stated purpose (for example, dates of service and balance status).
• Sensitive records: Mental health and certain substance use records have extra protections; providers may require specific authorization language or a court order.
• Fees for copies: Providers may charge reasonable, statutorily permitted fees for copying and mailing records and must follow any applicable limits.
• Litigation tools: In disputes, a properly issued subpoena or court order can compel production; privileges and notice requirements still apply.

What the Statutes Say

• North Carolina Gen. Stat. § 90-411 (Medical record copy fees) - Allows reasonable fees for copying and mailing medical records.
• North Carolina Gen. Stat. § 8-53 (Physician–patient privilege) - Sets privilege and court‑order exceptions for medical information in legal matters.
• North Carolina Gen. Stat. § 1A‑1, Rule 45 (Subpoenas) - Governs subpoenas for records, objections, and protections.
• North Carolina Gen. Stat. § 122C‑52 (Mental health records confidentiality) - Provides additional protections and exceptions for mental health information.

Analysis

Apply the Rule to the Facts: Because only the patient or a legally authorized representative may receive billing information, a provider should not rely on a caller’s knowledge of name and date of birth alone. If the attorney had a signed authorization on file (or legal authority such as a health care power of attorney or guardianship), the provider could verify that and confirm the zero balance consistent with the minimum‑necessary rule. If no authorization existed, the provider could request one before confirming balances or releasing statements.

Process & Timing

1. Who files: The patient or authorized representative. Where: The provider’s Health Information Management/Medical Records department in North Carolina. What: A signed HIPAA‑compliant authorization or proof of authority (e.g., healthcare POA, Letters of Guardianship, or Letters Testamentary/Administration for a decedent); request itemized billing statements. When: Providers typically respond within a reasonable time; federal privacy rules generally allow up to about 30 days for access requests.
2. If informal requests stall or the provider requires a legal mandate, counsel may issue a subpoena under Rule 45 through the appropriate North Carolina court; the recipient may object within the rule’s timelines (often within 10 days of service or by the compliance date).
3. For sensitive categories (mental health/substance use), obtain the enhanced authorization language or a court order. The provider then releases only the billing records necessary for the stated purpose and may assess statutory copy/mailing fees.

Exceptions & Pitfalls

• Missing authority: Without a signed authorization or legal authority (POA/guardianship/estate letters), providers should not disclose billing details.
• Sensitive records: Mental health/substance use records often require specific consent language or a court order beyond a general authorization.
• Overbreadth: Requests that are too broad may be limited; tailor to dates of service and the minimum necessary billing fields.
• Subpoena notice/privilege: For litigation, follow Rule 45 and physician‑patient privilege rules; improper service or missing notice can delay or block production.
• Fees: Budget for statutory copy/mailing fees; confirm the provider’s fee schedule before requesting voluminous statements.

Conclusion

In North Carolina, providers may share billing information only with the patient or someone who proves legal authority, and they must verify identity, limit disclosures to what’s needed, and follow special rules for sensitive records. If cooperation stalls, use a properly issued Rule 45 subpoena or seek a court order. Next step: send the provider’s Medical Records department a signed authorization (or proof of legal authority) requesting itemized billing, and track the response window.