Must we honor an attorney’s request for our employee’s personnel records?

Q. We recently received a letter from an attorney representing one of our employees. It requested “all personnel files and records, including all medical ­rec­ords” that we have on this employee. The letter contained an “authorization” that the employee had signed, but which did not specifically name our company. Do we have to provide this information? What if we don’t? And is there any risk to the company if we do provide it?