How to Respond to a Subpoena: Tips for Healthcare Practices

How can healthcare professionals appropriately respond to subpoenas? We discuss the factors that you need to consider before taking action.

You’re finishing up another long day. While imagining trading your lab coat for sweatpants, it happens. Your receptionist hands you a letter with three Latin words written across the top: Subpoena duces tecum. As you read on, you see the phrase “required to disclose,” and you feel your heart starting to beat faster. The good news: you’re not being sued. The bad news: this subpoena needs to be taken seriously.    

A subpoena is a legal document requiring someone to do something. Subpoenas are often issued to healthcare providers to order them to attend a deposition or other proceeding or to produce a patient’s medical records for a court. Never ignore a subpoena. If you do, you could face heavy fines, and in rare cases, even jail.

But what about confidentiality? Doesn’t disclosing a patient’s private records expose you to liability? Indeed, you must balance your obligation to comply with a subpoena with your duty of confidentiality. Therefore, you should educate yourself on your rights and obligations related to subpoenas. 

HIPAA Considerations In Responding to Subpoenas

Healthcare professionals must comply with HIPAA’s Privacy Rule at all times. The Rule sets out national standards to protect patients’ protected health information (PHI). Courts want to keep patient information private, and providers can only release PHI when authorized to do so. The extent to which a provider must disclose PHI in response to a subpoena depends on the type of subpoena issued. 

Court-Issued Subpoenas

A court-issued subpoena has been signed by a judge. Here, providers must disclose the requested information. Importantly, though, the provider can only release the requested information—nothing more. For example, if the subpoena asks specifically about records relating to mental health, the provider is not authorized to release records relating to cardiovascular issues. Providers should carefully read subpoenas to understand their scope.   

Attorney-Issued Subpoenas

Sometimes, attorneys issue subpoenas that have not been signed by a judge. In this case, a patient’s information can only be released once the HIPAA Rule’s requirements have been met and the patient has been notified. Courts want to ensure that patients understand their information is being released and have a chance to object. You will know the notification requirement has been met when you see evidence that there were reasonable efforts to either:

• Provide satisfactory notice to the subject of the subpoena about the request, so the person has a chance to object to the disclosure; or 
• Seek a qualified protective order for the information from the court.  

Identifying If HIPAA Requirements Have Been Met for Attorney-Issued Subpoenas

Where can you find the evidence of reasonable efforts to satisfy the HIPAA Privacy Rule? Check the documentation the issuing attorney provided. The documentation should show that the attorney made a good faith effort to notify the patient of the subpoena and related legal matter. Moreover, it must show the patient had a reasonable opportunity to object to the subpoena and that they either did not object or the time to object has expired. 

Similarly, this documentation can show that reasonable efforts were made to obtain a qualified protective order. A qualified protective order prohibits the parties seeking the PHI from using it for any purpose other than the proceeding or litigation for which the information was requested. In simple terms, it guarantees the PHI will only be used as authorized. Further, these orders require the PHI to either be returned to the patient or destroyed at the end of the proceeding.

Look for documentation that 1) the parties to the dispute have agreed to a qualified protective order and have presented it to the court, or 2) the party seeking the PHI has requested a qualified protective order from the court. 

If the notification requirement is not met, a provider can still release PHI if the patient has signed a valid release form authorizing the release of records. However, this release form must be HIPAA compliant.  

How to Respond if the Subpoena Is Inadequate  

If the subpoena is deficient in some way, then the provider cannot release protected PHI. The provider is not off the hook, though. Rather, the provider should promptly communicate the problem to the issuing party. It’s crucial that the provider indicates she can only release information if there have been reasonable efforts to notify the patient. Remember, at this stage, discussing any PHI is a violation of privacy. Avoid mentioning any specific treatments, diagnosis, or personal information in your conversations. Instead, generally state that you need to make sure your patient receives notice before proceeding. 

Beyond telling the issuer about the subpoena’s inadequacy, the provider can make reasonable efforts to notify the patient. She might call the patient and explain she has received a subpoena and must respond unless the patient objects. Further, a provider can attempt to obtain a signed, HIPAA-compliant release of information form from the patient.

If the provider believes the request for medical records is unreasonable, she can try to narrow the subpoena’s scope by filing a motion with the presiding judge. However, the provider should only take this action if she feels the requested information’s release would harm the patient.   

Practical Tips for Subpoena Recipients 

Sometimes it can be hard to discern between court-issued and attorney-issued subpoenas—legal documents tend to all look alike! Look for a judge’s name and signature on the subpoena to confirm a court issued it. 

Additionally, it can be hard to tell whether a subpoena asks for medical records or tells the provider to testify in court. Become familiar with the keywords that signal your obligations: 

• A “Witness subpoena” calls for you to testify in court. 
• A “Subpoena duces tecum” is a request for documents or records. 
• A “deposition subpoena” often requires you to attend a deposition. 

Next, communicate with colleagues and staff to make sure they know what to do if they receive a subpoena. Clear policies and procedures can reduce the chance of any liability. 

Finally, contact a lawyer if needed. An experienced healthcare firm such as Jackson LLP can help you appropriately respond to any requests for information. If you’re located in one of the states where we practice, reach out to us to schedule a consultation to learn more about how we can support you in responding properly to a subpoena. 

This blog is made for educational purposes and is not intended to be specific legal advice to any particular person. It does not create an attorney-client relationship between our firm and the reader. It should not be used as a substitute for competent legal advice from a licensed attorney in your jurisdiction.