Responding to Subpoenas for Medical and Mental Health Records

Health care providers frequently receive subpoenas requesting patient medical records, mental health records, billing information, or testimony regarding patient care. A subpoena may arise from a malpractice case, personal injury lawsuit, employment dispute, custody proceeding, criminal matter, insurance dispute, or other litigation in which the health care provider is not even a party.

Receiving a subpoena, however, does not necessarily mean that a physician, therapist, medical practice, or health care organization may immediately release the requested records.

Medical record subpoenas can implicate HIPAA, state confidentiality and privilege laws, special protections for mental health and substance use disorder records, court rules, and patient authorization requirements. Improperly disclosing protected information may expose a provider to privacy claims, regulatory penalties, professional discipline, or other liability. Ignoring a valid subpoena can also create legal consequences.

G2Z Law Group assists physicians, behavioral health professionals, medical practices, and health care organizations with responding to subpoenas for medical records, mental health records, psychotherapy notes, and other confidential health information.

Does a Subpoena Automatically Authorize Release of Medical Records?

Not necessarily.

HIPAA permits certain disclosures of protected health information in connection with judicial and administrative proceedings, but the requirements depend upon the legal process presented to the provider.

When a covered entity receives a court order, HIPAA permits disclosure of the PHI expressly authorized by that order.

A subpoena that is not accompanied by a court or administrative order receives different treatment. Under the HIPAA Privacy Rule, a covered entity generally must receive satisfactory assurances that reasonable efforts have been made either to notify the patient and provide an opportunity to object or to obtain a qualified protective order. In some circumstances, the provider itself may take steps to provide notice or seek an appropriate protective order.

For that reason, a provider should evaluate the subpoena and supporting documentation before producing records.

What Should a Health Care Provider Do After Receiving a Subpoena?

A subpoena should first be reviewed to determine:

• who issued it;

• which court or proceeding is involved;

• whether the provider is a party or non-party;

• whose records are requested;

• what categories and dates of records are sought;

• whether a patient authorization accompanies the subpoena;

• whether a court order has been entered;

• whether HIPAA's requirements for disclosure have been satisfied;

• whether state confidentiality or privilege laws apply; and

• whether the request includes specially protected information.

Providers should also identify the response deadline promptly. If the subpoena is objectionable, overly broad, seeks privileged information, or otherwise creates legal concerns, action may be required before the production date.

Simply forwarding the subpoena to administrative staff and releasing the entire medical chart can create unnecessary risk.

Are Mental Health Records More Protected?

They can be.

Mental health information may be protected by state confidentiality and privilege statutes in addition to HIPAA.

For example, District of Columbia law provides that physicians, surgeons, and mental health professionals generally may not disclose confidential information acquired in their professional capacity in D.C. or federal courts in the District without the client's written consent, subject to statutory exceptions.

D.C.'s Mental Health Information Act provides additional protections for mental health information. It does, however, permit disclosure in certain civil or administrative proceedings when the patient or someone claiming through the patient places the patient's mental or emotional condition at issue as an element of a claim or defense.

The existence of litigation therefore does not eliminate confidentiality protections. The provider must determine which statutory exception, authorization, court order, or other legal basis permits disclosure.

What Are Psychotherapy Notes?

HIPAA gives psychotherapy notes special protection.

Psychotherapy notes are generally notes recorded by a mental health professional documenting or analyzing conversations occurring during counseling sessions when those notes are maintained separately from the remainder of the medical record.

They do not generally include ordinary treatment information such as medication prescriptions, session times, test results, diagnoses, treatment plans, symptoms, prognosis, or progress summaries.

HIPAA ordinarily requires a specific patient authorization before psychotherapy notes may be used or disclosed, subject to several narrow exceptions.

This means that a subpoena requesting "the complete medical record" should not automatically be interpreted as authorization to produce separately maintained psychotherapy notes.

What About Substance Use Disorder Records?

Records involving treatment for substance use disorders may require additional analysis under 42 C.F.R. Part 2, in addition to HIPAA and applicable state law.

Part 2 provides special confidentiality protections for certain records created by federally assisted programs providing substance use disorder diagnosis, treatment, or referral for treatment.

Providers should therefore identify whether subpoenaed records contain information subject to Part 2 before responding. A standard authorization, subpoena, or HIPAA analysis may not by itself answer whether those records can lawfully be disclosed.

Similar caution may be necessary for other specially protected information, including HIV-related information, genetic information, reproductive health information, and other categories governed by specific federal or state confidentiality requirements.

Does a Provider Have to Produce the Entire Medical Record?

Not always.

A subpoena may seek records that are broader than necessary for the litigation. Providers should evaluate the exact scope of the request and any applicable privacy, privilege, and discovery limitations.

Under HIPAA, the minimum necessary standard applies to many permitted disclosures of PHI, although its application depends upon the legal basis for the particular disclosure.

Medical records can also contain information concerning people other than the patient, unrelated episodes of treatment, privileged communications, psychotherapy notes, or specially protected information that may require additional review.

The draft materials you provided appropriately identify this as an important concern: providers should consider minimum-necessary principles and whether the requested records contain information involving third parties or specially protected categories before producing them.

Can a Provider Object to or Challenge a Subpoena?

Potentially.

A subpoena may be subject to objection, modification, a protective order, or a motion to quash when, for example, it seeks privileged information, imposes an undue burden, requests information beyond the permissible scope of discovery, or conflicts with applicable confidentiality laws.

Providers should pay particular attention to deadlines because subpoena objections may have to be asserted promptly.

Legal counsel can also communicate with the requesting attorney to narrow an overly broad request, obtain a patient authorization, secure an appropriate protective order, or resolve confidentiality concerns without unnecessary litigation.

Why Should Health Care Providers Be Careful When Responding?

The provider receiving the subpoena may be caught between two competing legal obligations.

On one side is the obligation to comply with valid legal process. On the other are obligations to protect confidential patient information under HIPAA, state privilege and confidentiality laws, mental health statutes, and other privacy requirements.

The safest response is therefore rarely to ignore the subpoena or automatically release everything requested.

Instead, providers should determine what disclosure is legally authorized, whether additional documentation is necessary, and whether any portion of the request should be withheld, limited, or challenged.

What Can G2Z Law Group Do for My Health Care Practice?

G2Z Law Group assists physicians, psychiatrists, psychologists, therapists, behavioral health professionals, medical practices, and other health care organizations with subpoenas and requests for confidential patient records.

Our attorneys can review subpoenas and court orders, evaluate HIPAA and state confidentiality requirements, determine whether patient authorization is necessary, identify privileged or specially protected records, communicate with requesting attorneys, prepare objections, and seek protective orders or other court relief when appropriate.

We also advise providers regarding mental health records, psychotherapy notes, substance use disorder records, medical-record privacy, HIPAA compliance, and proper documentation of disclosures.

Responding correctly to a subpoena can protect both the patient's confidentiality and the health care provider from unnecessary regulatory and legal exposure.