Medical records subpoena: what your practice should do
A subpoena for a patient's records has arrived. What HIPAA allows, what a court order changes, the written assurances to ask for, and the records that need more than HIPAA.
On this page
At a glance
An ordinary civil subpoena without a disclosure order does not by itself let a HIPAA covered practice hand over a patient's records. It needs the patient's valid authorization, or written assurance from the requesting party that the patient was given notice and the time to object has passed or objections were resolved, or that a qualified protective order was sought — or the practice's own reasonable efforts to do either (45 CFR 164.512(e)). An order of a court or tribunal permits only what it expressly authorizes. Law-enforcement process, such as a grand jury subpoena, follows its own route (164.512(f)).
| Court or tribunal order | Share only what the order expressly authorizes (164.512(e)(1)(i)) |
|---|---|
| Subpoena without a court order | Patient's authorization, or satisfactory assurance of notice or of a qualified protective order (164.512(e)(1)(ii)–(vi)) |
| Grand jury, warrant, administrative subpoena | The law-enforcement route, with its own conditions (164.512(f)(1)(ii)) |
| Stricter rules | Psychotherapy notes, 42 CFR Part 2 records, state law |
| Record it | Generally account for disclosures under 164.512(e) or (f); disclosures under a valid authorization are excluded (164.528) |
What to do, in order
- Do not hand over records on the spot. Note the date it arrived, keep a copy, and tell your Privacy Official.
- Work out what it is: an order of a court or administrative tribunal, a subpoena or discovery request from an attorney or court clerk, or a law-enforcement request such as a grand jury subpoena or an administrative subpoena.
- A court or tribunal order: share only what the order expressly authorizes.
- A subpoena without a court order: release records only with the patient's valid authorization, or after written satisfactory assurance from the requesting party — that the patient was given notice and the time to object passed, or that a qualified protective order was agreed or requested — or after your own reasonable efforts to give that notice or seek that order.
- Before releasing anything, check for psychotherapy notes, 42 CFR Part 2 records and stricter state law — and the subpoena's deadline. Bring in your attorney: the subpoena itself needs a response even when the answer is not records.
- Send only what is requested and covered, and keep a copy of what you sent.
- Record the disclosure in your accounting of disclosures (not needed when it was made under the patient's authorization), and keep the subpoena, the assurances or order, and what was sent.
A subpoena is a legal demand, and it has a deadline — but for a HIPAA covered practice it is not, by itself, permission to release a patient’s records. HIPAA decides whether you may disclose; your attorney decides how to answer the subpoena, which can mean an objection or a request for assurances rather than records.
Court order or subpoena — why the difference matters
An order of a court or administrative tribunal lets you disclose the protected health information the order expressly authorizes, and nothing more (164.512(e)(1)(i)). A subpoena, discovery request or other lawful process without such an order — typically issued by an attorney or a court clerk — is different: HIPAA lets you respond only in the ways below (164.512(e)(1)(ii)–(vi)).
The written assurances for a subpoena without a court order
You may disclose if the party asking gives you satisfactory assurance, which means a written statement and documentation showing one of these:
- Notice to the patient (164.512(e)(1)(iii)): they made a good-faith attempt to provide written notice to the patient — or, if the patient’s location is unknown, to mail notice to their last known address; the notice told the patient enough about the case to object; and the time to object has passed with no objection filed, or the court has resolved the objections and the request fits that ruling.
- A qualified protective order (164.512(e)(1)(iv)–(v)): the parties agreed to one and presented it to the court, or the requesting party asked the court for one. A qualified protective order limits use of the information to that case and requires it to be returned or destroyed, copies included, when the case ends.
Without those assurances, you may still disclose if you make reasonable efforts to give the patient that notice or to seek a qualified protective order (164.512(e)(1)(vi)). Or the patient can sign a valid authorization. See authorizations.
Police, grand juries and government agencies
A grand jury subpoena, a court-ordered warrant, a subpoena or summons issued by a judicial officer, and an administrative subpoena or demand that the law requires you to answer fall under the law-enforcement route, each with its own conditions (164.512(f)(1)(ii)). An administrative request, for example, must be relevant and material to a legitimate inquiry, specific and limited in scope, and one where de-identified information could not reasonably be used. See does HIPAA apply to police?.
Records that need more than HIPAA
- Psychotherapy notes usually need the patient’s separate authorization; a subpoena alone is not one of the exceptions in 164.508(a)(2). See psychotherapy notes.
- Substance use disorder records under 42 CFR Part 2 need a Part 2 consent or a court order meeting Part 2’s own requirements; a subpoena alone does not authorize disclosure (42 CFR Part 2, subpart E).
- State law can protect mental health, HIV, genetic, minors’ or other records more strictly, and can set its own procedure for records subpoenas and custodian affidavits.
What to record
A disclosure under 164.512(e) or (f) is one the patient can ask about: record it in your accounting of disclosures (164.528) — not needed when it was made under the patient’s authorization. Keep the record, but honor any temporary suspension of the patient’s accounting that a law-enforcement official or health oversight agency asks for under 164.528(a)(2). Keep the subpoena, the assurances or the order, and a copy of what you sent. Only send what the request covers and the route allows.
This page explains HIPAA’s rules; it is not legal advice. A subpoena has legal consequences and deadlines — involve your attorney.
Relevant requirements
- HIPAA authorization →§ 164.508
- Psychotherapy notes →§ 164.501
- Minimum necessary →§ 164.502(b)
- PHI and ePHI →§ 160.103
- HIPAA documentation retention →§ 164.316(b)(2)
Frequently asked questions
Do we have to give records to a lawyer who sends a subpoena?
Not on the subpoena alone. Without a court or tribunal order, HIPAA lets you disclose only with the patient's authorization or after the written assurances 164.512(e) describes, or your own reasonable efforts to give the patient notice or seek a qualified protective order. Your attorney decides how to answer the subpoena itself.
Is a subpoena signed by a judge different?
Not necessarily. Check what the document actually does. An order expressly authorizing disclosure follows 164.512(e)(1)(i). For a law-enforcement purpose, disclosure to a law-enforcement official may instead follow 164.512(f)(1)(ii), with its own rules for judicial process and grand jury subpoenas. Do not classify the document by its signature alone.
Do we tell the patient?
The assurances route depends on the patient having been given notice and a chance to object, or on a qualified protective order. A disclosure under 164.512(e) or (f) also goes in your accounting of disclosures, which the patient can ask to see — unless a law-enforcement official or oversight agency has temporarily suspended that part of the accounting (164.528(a)(2)).
What about psychotherapy notes and substance use records?
Psychotherapy notes usually need the patient's separate authorization; a subpoena alone is not one of the exceptions. Records protected by 42 CFR Part 2 need a Part 2 consent or a court order under Part 2's own rules. Talk to an attorney before releasing either.