Law Firm's Right To Subpoena Medical Records Examined

In the United States, subpoenas are written orders from the court or an attorney that require a person to do something, with criminal penalties such as fines or jail time for failure to comply. Subpoenas are used by attorneys to gain access to information critical to a legal case or to compel an individual to testify. While subpoenas are different from court orders, they are often mistaken for the latter due to their formal appearance. A subpoena for medical records, known as a Subpoena Duces Tecum, is a formal way for a party in a lawsuit to request records. While a court order requires a judge's signature, an attorney subpoena does not.

In the context of medical records, subpoenas are used to obtain a patient's records that could serve as crucial evidence in various legal cases, including personal injury, medical malpractice, insurance fraud, workers' compensation, and criminal cases. When a healthcare provider receives a subpoena for medical records, they must navigate the complex interplay between state and federal laws, including the Health Insurance Portability and Accountability Act (HIPAA) and state privacy laws, to ensure patient privacy and confidentiality.

Subpoena vs court order

A subpoena is a type of court order that requires a person to appear and testify at a particular time and place. It is issued in the context of a court case and can be issued by a party to the case without a judge's prior approval. A subpoena can also require the person to bring specific records or documents, known as a subpoena duces tecum (SDT). This is a formal way for a party to a lawsuit to request records. An SDT is not a court order, and an attorney can issue it without going to court. However, it should not be ignored, as non-compliance may result in contempt of court.

HIPAA-covered entities, such as physicians and practices, must comply with the Privacy Rule when responding to subpoenas for medical records. They must safeguard protected health information (PHI) and analyse whether the subpoena meets Privacy Rule protections. If it does not, HIPAA prohibits disclosure. Before disclosing information in response to an SDT, the issuing party must provide evidence of reasonable efforts to notify the patient and give them a chance to object.

Court orders, unlike subpoenas, must be approved by a judge. The process to obtain a court order varies by jurisdiction, and a lawyer's input is often needed. A HIPAA-covered entity may disclose information in response to a court order, but only the information specifically described in the order. Psychotherapy notes are subject to special protections and generally should not be released without a court order.

In some states, such as Arizona, HIPAA permits disclosure only when a protective order accompanies a subpoena. In contrast, Utah allows disclosure with "satisfactory assurances" that reasonable efforts have been made to notify the patient. When a subpoena requests records for a limited number of patients, the patients whose records are sought should be notified, and their authorisation may be required. If the patient is deceased, a "personal representative" must provide authorisation.

HIPAA compliance

A subpoena for medical records is called a Subpoena Duces Tecum (SDT). It is a formal way for a plaintiff, defendant, or other party in a lawsuit to request records. An SDT is not a court order, and a HIPAA-covered provider or plan may disclose information to a party issuing an SDT only if the notification requirements of the Privacy Rule are met.

HIPAA permits physicians, practices, and other covered entities to disclose patients' medical records in response to a court order without requiring authorization from the patient or patient's personal representative. However, subpoenas for medical records are not court orders, and HIPAA prohibits disclosure if the subpoena does not meet Privacy Rule protections.

To avoid a HIPAA violation, a written policy with a standard procedure for analyzing subpoenas and determining whether the Privacy Rule allows disclosure is necessary. Before responding to a subpoena, the provider or plan should receive evidence that there were reasonable efforts to notify the person who is the subject of the information about the request, so they have a chance to object to the disclosure. Alternatively, the provider or plan can seek a qualified protective order for the information from the court. A qualified protective order prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or administrative proceeding for which the subpoena was issued.

Additionally, it is important to note that a subpoena request for "all medical records" does not include psychotherapy notes, as they are subject to special protections from release. Psychiatric notes must be sent along with the records when responding to a subpoena request for the medical records of a patient.

State-specific laws

While the Health Insurance Portability and Accountability Act (HIPAA) protects patient health information against unlawful disclosure, it is important to note that state-specific laws and rules governing subpoenas may vary depending on the type of information requested and the court that issued the subpoena. Here are some examples of state-specific laws and their implications:

State Laws on Mental Health Records

State laws may limit disclosures for mental health records, drug and alcohol treatment records, and psychotherapy notes. For instance, in some states, psychotherapy notes are given heightened protection and are only disclosed when necessary, while psychiatric notes must be released with the patient's medical records when subpoenaed.

State Court vs. Federal Court

The rules governing subpoenas can differ depending on whether the subpoena was issued in a state or federal court. For example, most states mandate a minimum number of days to comply with a subpoena, such as 20 days after it was served, and prohibit producing records earlier than the due date stated. These provisions allow patients time to challenge or limit the subpoena if they object to the disclosure of their medical records.

State-Specific Subpoena Requirements

Some states have unique requirements for subpoenas. For instance, in certain states, if a subpoena has been signed by a clerk or attorney, the patient must be given the opportunity to object to their information being disclosed in court.

It is crucial for healthcare providers to be aware of both HIPAA regulations and any applicable state-specific laws when responding to subpoenas for medical records. Consulting with legal professionals or referring to state-specific guidelines can help ensure compliance and protect patient confidentiality.

Patient notification

HIPAA-covered entities, including physicians, practices, and healthcare providers, are required to comply with the Privacy Rule when responding to subpoenas for medical records. This rule mandates the protection of patient information and sets out specific guidelines for disclosure. Before disclosing any information, providers must ensure that the patient has been notified about the request and has the opportunity to object to the disclosure. This notification process is a fundamental step in upholding patient privacy rights and ensuring they have a say in how their personal information is shared.

The specific requirements for patient notification may vary depending on the state and local laws. For example, in Utah, HIPAA permits disclosure when there are "satisfactory assurances" that reasonable efforts have been made to notify the patient. On the other hand, Arizona law is more restrictive, requiring a protective order from the court in addition to the subpoena. In this case, the attorney must provide written documentation showing their attempts to notify the patient. These variations in state laws highlight the importance of understanding the specific regulations in each jurisdiction.

To comply with HIPAA and avoid potential violations, healthcare providers should follow a careful process when responding to subpoenas. This includes analyzing the subpoena, determining the scope of the request, and considering any additional laws or restrictions, such as state-specific limits on disclosures for mental health or drug and alcohol treatment records. By following these steps, providers can ensure they are upholding their legal and ethical obligations to protect patient privacy while also responding to the subpoena appropriately.

Criminal penalties

While subpoenas are a formal way for a law firm to request medical records, they are not court orders. A subpoena issued by someone other than a judge, such as a court clerk or an attorney, is different from a court order. A HIPAA-covered provider or plan may disclose information to a party issuing a subpoena only if the notification requirements of the Privacy Rule are met.

Before responding to the subpoena, the provider or plan should receive evidence that there were reasonable efforts to notify the person who is the subject of the information about the request, so the person has a chance to object to the disclosure, or seek a qualified protective order for the information from the court.

In the United States, the Health Insurance Portability and Accountability Act (HIPAA) protects patient health information against unlawful disclosure. Disclosure of medical information in violation of the law(s) can subject healthcare providers to penalties and civil damages (e.g., compensatory damages, punitive damages, and attorneys' fees) for breach of confidentiality.

HIPAA fines can be severe, with a maximum penalty of $50,000 per violation, but the frequency of penalty is extremely low. In fact, MagMutual’s data indicates that MagMutual policyholders have not encountered any losses from HIPAA violations related to responding to a medical record subpoena.

While there are no explicit mentions of criminal penalties, there are several mentions of civil penalties, including fines, compensatory damages, and attorneys' fees.

Frequently asked questions