NC Medical Records Statute: Access, Copy Fees, and Corrections

North Carolina medical records law gives you the right to see, copy, correct, and keep private the health information your providers hold about you. The main state rules live in N.C. General Statutes 90-411, which governs copies and fees, and N.C. General Statutes 8-53, which establishes physician-patient privilege. Federal HIPAA rules sit on top of both, adding response deadlines, digital access rights, and limits on what you can be charged for electronic copies.

Your Right to Get Copies

You can request copies of your records from any provider who treated you, and the provider cannot refuse a valid request.¹ Your records include physician notes, test results, imaging reports, and treatment plans. Providers do not have to create documents that don’t already exist.

Under HIPAA, a provider generally must respond within 30 days. One 30-day extension is allowed if the provider tells you in writing why it needs more time.² Put your request in writing, keep a copy, and specify the format you want (paper, electronic file, or portal download).

What Providers Can Charge

Paper Copies

N.C. General Statutes 90-411 caps the fees a provider can charge for paper copies. Per request, the maximums are:

First 25 pages: up to $0.75 per page
Pages 26 through 100: up to $0.50 per page
Pages beyond 100: up to $0.25 per page

A provider can also charge a minimum of up to $10.00 per request, which is inclusive of copying costs. If you ask a physician to write a narrative summary rather than just copy the file, a separate professional fee is allowed.¹

Two situations sit outside these caps. Charges for records tied to workers’ compensation claims are set by the North Carolina Industrial Commission, not the per-page statute. Requests from the Department of Health and Human Services Disability Determination Services, made for someone applying for Social Security or Supplemental Security Income disability, are exempt from the fee statute entirely.³

Electronic Copies

When your records are already stored electronically and you want an electronic copy, HIPAA overrides the state per-page caps. The provider can only charge a reasonable, cost-based fee covering the labor to copy the data, any physical media you request such as a USB drive, and postage. Search time, IT overhead, and system maintenance cannot be passed on.²

As a shortcut, HHS lets providers charge a flat fee of no more than $6.50 for an electronic copy, covering all labor, supplies, and postage. Per-page fees are not considered reasonable for records maintained electronically. And if the provider makes your records available through a patient portal’s view-download-transmit function, there is no charge at all.²

Confidentiality and Who Else Can See Your Records

N.C. General Statutes 8-53 makes communications between you and your physician privileged. Medical record information is not a public record, and confidential information can only be released with your authorization or, after death, by your executor, administrator, or next of kin.⁴

Personal Representatives

Someone with legal authority to make healthcare decisions for you — typically a healthcare power of attorney holder or court-appointed guardian — is your personal representative under HIPAA, and providers must generally treat them as if they were you for record access. The scope of access matches the scope of legal authority: full guardianship means full access; a limited authority means access only to records tied to that role.⁵

Minors

Parents and legal guardians are usually a minor child’s personal representative and can see the child’s records. HIPAA defers to state law here, and North Carolina lets minors consent on their own to certain services, including some reproductive health, mental health, and substance abuse care. When a minor lawfully consents to that treatment, the provider may withhold those specific records from the parent unless the minor authorizes disclosure.⁶

Deceased Patients

After death, the executor or administrator of the estate can authorize release of records. If no estate has been opened, the next of kin can do so.⁴ The hospital administrative code takes the same approach, giving the executor — or, when there is none, the next of kin responsible for disposition of remains — access to all records of the deceased patient.⁷ Expect to provide letters testamentary, letters of administration, or a death certificate before records are released.

Psychotherapy Notes: The Main Exception to Access

HIPAA carves out one narrow category from your right of access. Psychotherapy notes are a therapist’s personal notes analyzing a counseling session, kept separate from the rest of the chart. They do not include diagnoses, treatment plans, medication records, session times, or progress notes, all of which remain accessible to you.⁸ A therapist can share these separate notes with you voluntarily but is not required to.

When a Provider Can Disclose Without Your Consent

Court Orders and Subpoenas

A judge can order a provider to disclose records if the judge finds disclosure necessary to the proper administration of justice, and trial courts have broad discretion on that question.⁴ A subpoena by itself is generally not enough under North Carolina mental health confidentiality rules; the provider needs your consent or a separate court order. Under HIPAA, a provider responding to a subpoena must confirm you were notified and given a chance to object, or that a qualified protective order was sought.⁹

Public Health Reporting

Providers must report confirmed or suspected communicable diseases to the local health department, which reports to the state Division of Public Health. Timeframes vary by disease. Some conditions linked to bioterrorism require immediate reporting, tuberculosis must be reported within 24 hours, and chlamydia within seven days.¹⁰

Mandatory Reporting of Abuse and Certain Injuries

North Carolina’s child abuse reporting law applies to any person, not just healthcare workers. Anyone who suspects a child is abused, neglected, or dependent must report to the county department of social services. Knowingly failing to report is a Class 1 misdemeanor.¹¹

Providers must also report certain injuries, including gunshot wounds, to the local police chief or county sheriff as soon as practicable under N.C. General Statutes 90-21.20.¹²

Imminent Danger

North Carolina does not impose a mandatory duty to warn, but it gives mental health professionals authority to break confidentiality when needed. Under N.C. General Statutes 122C-55(d), a provider may disclose confidential information when there is imminent danger to the patient or another person, or a likelihood that a felony or violent misdemeanor will be committed.¹³ The statute says the professional “may” disclose, leaving the judgment call to the clinician.

Fixing Errors in Your Records

If your records contain a mistake, HIPAA lets you ask any covered entity to amend the information. The provider can require the request in writing with a reason.¹⁴ The provider can deny the amendment only on specific grounds: it did not create the record and the original source is still available, the information isn’t part of the designated record set used for your care, the information falls under an access exception like psychotherapy notes, or the existing record is already accurate and complete.

If the provider denies your request, it must give you a written explanation and tell you how to file a statement of disagreement. That statement gets attached to your record going forward, so even when the original entry stays, your objection travels with it.¹⁵

How Long Records Are Kept

Licensed hospitals and healthcare institutions in North Carolina must keep adult patient records for at least 11 years after discharge. Records created when the patient was a minor must be kept until the patient’s 30th birthday. If a former minor patient is readmitted as an adult, the 11-year rule applies to the new records.¹⁶

Providers who bill Medicare face a separate federal floor: CMS requires records to be kept for at least seven years from the date of service.¹⁷ Hospitals subject to both rules follow the longer 11-year state period.

Digital Access and Information Blocking

The 21st Century Cures Act added federal protection for electronic access. Since April 2021, providers using certified electronic health record technology cannot engage in “information blocking” — practices that interfere with your access to your electronic health information. Providers generally cannot charge for electronic access through standard digital channels, and they must fulfill your request in the manner you ask unless they are technically unable to do so.¹⁸

The rules recognize limited exceptions. A provider may limit or delay digital access when it reasonably believes access would substantially risk harm to the patient or another person, when the request doesn’t meet the required preconditions or withholding is consistent with HIPAA, when releasing the information as requested would compromise system or data security, or when the request is infeasible because of technical limits or circumstances outside the provider’s control.

If a provider blocks access without a valid exception, the Office of the Inspector General can investigate and impose penalties.

What to Do If a Provider Won’t Comply

If a provider refuses to release your records or charges you improperly, you have several options. You can file a HIPAA complaint with the U.S. Department of Health and Human Services Office for Civil Rights, which can investigate covered entities and impose penalties. At the state level, the North Carolina Attorney General’s Consumer Protection Division handles complaints about provider conduct, including record access and overcharging.¹⁹ A private lawsuit is also possible, though the Attorney General cannot represent you individually.

One point that trips people up: the North Carolina Medical Board does not handle billing disputes, including complaints about record copy overcharges. The Board directs consumers with billing concerns to the Attorney General’s office.²⁰ The Board does investigate professional misconduct, including unauthorized disclosure of patient information, and disciplinary action can go up to license revocation.²¹

1
North Carolina General Assembly. North Carolina Code Chapter 90 Article 29 Section 90-411 – Record Copy Fee
2
HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
3
North Carolina General Assembly. North Carolina Code GS 90-411 – Record Copy Fee
4
North Carolina General Assembly. North Carolina Code GS 8-53 – Communications Between Health Care Provider and Patient
5
HHS.gov. Personal Representatives
6
HHS.gov. Personal Representatives and Minors
7
Cornell Law School. 10A NC Admin Code 13B .3904 – Patient Access
8
HHS.gov. HIPAA Privacy Rule and Sharing Information Related to Mental Health
9
HHS.gov. Court Orders and Subpoenas
10
NC Division of Public Health. Communicable Disease Surveillance and Reporting
11
North Carolina General Assembly. North Carolina Code GS 7B-301 – Duty to Report Abuse, Neglect, Dependency, or Death Due to Maltreatment
12
North Carolina General Assembly. North Carolina Code GS 90-21.20
13
North Carolina General Assembly. North Carolina Code Chapter 122C Article 3
14
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
15
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
16
Legal Information Institute. 10A NC Admin Code 13B .3903 – Preservation of Medical Records
17
Centers for Medicare & Medicaid Services. Medical Record Maintenance and Access Requirements
18
eCFR. 45 CFR Part 171 – Information Blocking
19
North Carolina Department of Justice. File a Complaint with the North Carolina Department of Justice
20
NC Medical Board. Consumer FAQs – Complaints
21
NC Medical Board. Medical Records – Documentation, Electronic Health Records, Access, and Retention