A Checklist for Responding to Attorney-Issued Medical Record Subpoenas Without Violating HIPAA
-
Review the subpoena. Is your patient a party (plaintiff or defendant)?
- If no, and the patient is not a minor/incompetent, either move to quash the subpoena or request a Court order before producing the medical records.
- If no, and the patient is a minor/incompetent, then check to ensure that the party requesting the records has signed a valid HIPAA authorization. If the party has signed a valid HIPAA authorization, go to No. 2 below. If the party has not signed a valid HIPAA authorization, you will either need to obtain an authorization, produce the records to the Court under seal, or move to quash the subpoena.
- If yes, move to No. 2.
-
Was the subpoena served on the patient (is there a cover letter and/or certificate of service that indicates that the patient has been provided a copy of the subpoena)?
- If no, you will either need to obtain the patient’s authorization/consent or you need to move to quash the subpoena.
- If there is no cover letter and/or certificate of service, call the attorney who sent the subpoena and ask and then obtain the response in writing.
- If yes, move to No. 3.
-
Has 10 days elapsed since the subpoena was served on the patient?
- If no, contact the patient (or his/her attorney) and obtain in writing confirmation that the patient does not intend to file a motion to quash, OR
- Wait 10 days before producing the medical records.
- If yes, produce the records.