Handling a subpoena for medical records creates the potential for either a HIPAA violation or a contempt of court citation. How a healthcare organization responds to a subpoena for medical records should be managed carefully to avoid these pitfalls.
Subpoenas are used by attorneys to gain access to documents or to compel an individual to testify. A subpoena for medical records might be for use in a personal injury claim, a medical malpractice claim, or less frequently for other types of civil lawsuits, including billing disputes with providers.
A valid subpoena for medical records received by a HIPAA-covered entity cannot be ignored and a response within the time limit applicable under the particular circumstances is necessary to avoid a contempt citation or other legal sanctions. But responding to the subpoena by turning over records can potentially create considerable risk of a HIPAA violation. Even in response to a subpoena, providing a patient’s medical records could constitute an unauthorized disclosure of protected health information (PHI) and result in a penalty for the covered entity for noncompliance.
The HIPAA Privacy Rule generally requires written consent from a patient before medical records are disclosed for reasons other than treatment, payment, or healthcare operations, but HIPAA does not require authorizations for disclosures required by law. Best practices would dictate that, even if the entity believes it is required to make the disclosure, it is advisable to inform the patient promptly about the subpoena and the deadline for response. This would allow the patient to take action opposing the disclosure if they so choose.
A covered entity that receives a subpoena for medical records should first ascertain the validity of the subpoena. If the subpoena is not valid, a response is not required. However, competent legal advice should be obtained as to whether the subpoena is valid and what action the organization should take. Simply ignoring the subpoena will probably result in further legal entanglement, and an attorney can advise as to an appropriate response notifying the party issuing the subpoena that medical records will not be provided.
There are different types of subpoena, depending on how the subpoena is issued. Subpoenas generally fall into two main categories:
1. Court orders and court-issued subpoenas
If the subpoena is signed by a judge or magistrate, and has been issued as part of an administrative or court proceeding or is a grand jury subpoena, the request must be responded to promptly, and unless otherwise advised by legal counsel must be honored and the requested information, documents or records must be provided. While it is possible to raise objections by writing to the court specifying the grounds for objection, this should generally be undertaken only with the advice or assistance of legal counsel.
In the absence of an objection and resulting protective order, a covered entity is only permitted to disclose the information specifically identified in the court order or subpoena and no more. Providing any additional information would almost certainly constitute an impermissible disclosure of PHI. For example, if a request is for medical records for a specific date, only records of that date should be provided. Additionally, personal information such as social security number, address, or telephone number should be redacted if not required to comply with the subpoena.
2. Subpoenas issued by attorneys and discovery requests
If a valid subpoena is issued by an attorney, as opposed to actually being issued by a judge or magistrate as part of legal proceedings, or if the records are sought by service of a discovery request, HIPAA regulations permit disclosure of medical records if any one of the following conditions is met:
- A written statement and accompanying documentation are received from the person issuing the subpoena demonstrating a good faith attempt was made to provide written notice of the subpoena to the patient or his or her legal representative; the notice included sufficient information to inform the patient that they have the right to object to the subpoena; the time for objecting to the subpoena has passed and the patient did not object to the subpoena or an objection was resolved by the court in such a way as to require or authorize the disclosure.
- A written statement and accompanying documentation are received from the person issuing the subpoena demonstrating that all parties to the lawsuit have agreed to a qualified protective order to maintain the confidentiality of the supplied information or that such an order has been requested. A qualified protective order limits the use of the information solely to the lawsuit and requires all information to be destroyed or returned when the lawsuit ends.
- The covered entity makes reasonable efforts to notify the patient, advising the patient that a response is required by law and informing the patient of his or her right to object to the disclosure of their PHI, and the patient fails to notify the covered entity, before the deadline for responding, that the subpoena has been quashed or there is some other legal reason justifying non-disclosure. The covered entity can also object to the subpoena and, if informed by the patient that they need not respond, should verify the applicable facts and consult counsel.
- A valid HIPAA authorization is obtained from the patient authorizing the covered entity to release his or her medical records and comply with the subpoena. In such cases, the information disclosed must still be limited to the information specifically requested in the subpoena.
For a more detailed treatment of these requirements, see Title 45 of the Code of Federal Regulations, sections 164.512(c)(1)(ii); (e)(1)(iii)-(vi).
It is important to note that if none of the three conditions described above is satisfied, PHI cannot be provided and a court order is required, but the subpoena cannot simply be ignored. An objection should be made to the party issuing the subpoena on the grounds of HIPAA regulations. Again, legal advice should normally be sought in order to raise an objection or otherwise state the reason for non-disclosure of the requested records.
In responding, do not do so before the date and time specified on the subpoena, to allow the patient time to take action to quash the subpoena or seek a protective order. In dealing with a subpoena, a covered entity should be sure to document any requests, all actions taken in response to the subpoena, and details of any information provided.