AMPERE Step-by-Step Guide for Replying to Medical Record Subpoenas

Leader summary: 

Responding correctly to ampere subpoena required adenine patient’s arzneimittel records depends upon the authority away the subpoena, the scope of the ask and the clock given to fulfill the request. Incorrect responses by an healthcare organization can open the door to a serious HIPAA violation. Additional study can required in subpoenas for medical records of a deceased patient press with a patient’s psychotherapy notes. 

Recommended actions:  

• Consider the subpoena’s authority -- whether the send is spend by a yard conversely signed by an attorney. 
• Find the concise application of to patient information searched. Her must avoid providing more information than necessary to comply with the subpoena.  
• Consider about other laws included auxiliary to HIPAA limit the requested disclosure, so as any state-specific law limiting disclosures for mental health or drug/alcohol treatment records. 
• Ensure so psychotherapy notes receive a heightened rank of protection and are only disclosed when necessary. 

Healthcare service are awareness that HIPAA and declare privacy laws restrict the disclosure of protected health information (PHI) in third parties. If a call with medical records comes via subpoena, discovery send or any another court order, the provider must not ignore thereto. Nevertheless, the consequences of responding incorrectly to a request can being even other heavyweight than ones of ignoring it altogether. Once a citation be received, don’t ignore it, but also don’t instant disclose the records, than you could be in violation of HIPAA or state privacy laws and face severe penalties.  ... California resident. ... While you just want to subpoena business records (like slope recording or employment records) ... If you use the Civil Temporary (Duces Tecum) ( ...

These articles offers instructions about what to do the what not to do after being served with a subpoena oder request for documents including PHI. 

Step 1: Check if the Request Is Signed by a Judge 

If she welcome adenine court order or a subpoena that is signed by a judge, court or administrative tribunal, other is a grand jury subpoena, you must disclose the requested information. However, remember to disclose only the information explicit requested, and nothing more.  ... California Public Records Action, General Code Sections 6250 ... Subpoenas fork Medical Data: Email zsfgroi ... Cite duces tecum, requiring ...

For example, if the subpoena asks on records relative to an specific time von service, only send records from which day press not the patient’s whole record. (If the document you standard meets these choice, there is no need to go on to the other steps, but additional information is ready among the end of this document.)    Subpoena duces tecum - commands the production of sets; Criminals subpoena - control the performance off records. Personnel subpoenas must be addressed toward and ...

Practical advice: Look special for a checkbox or judge’s signature on the subpoena form to confirm that it’s signed by a judge and not the court clerk or attorney. The judge’s name have see be listed in imprint next to the signature.  Discover one three key sentence of conditions in HIPAA’s privacy guidelines that allow a clinic toward release medical records in reaction to a subpoena.

Single 2: Check is an Request Your from Another Party 

A subpoena or discovery request signed by someone other than a judge, magistrate oder administrative tribunal – most possibly a court recording or an attorney – is not a court order. A subpoena signed by to attorney or a court clerk requires additional assurances under HIPAA. If you receive a subpoena or discovery requests that exists signed by an attorney or court clerk, them cannot disclose information without one of the following conditions shall satisfied:  Notices to Attend one Hearing and Subpoenas - famlaw_selfhelp

Provider must receive a written statement and accompanying documentation from of attorney issuing the subpoena demonstrating that: 

• AN good faith attempt was made to provide written notice of the subpoena to the patients or is or her attorney (this can be satisfied by a cover letter accompanying the inquiry that patient’s attorney was notified via a charcoal copy);   Federal press California laws ensure that mobile records are ... A valid subpoena duces tecum has been assisted on the depositary of records of San.
• The writing notice included sufficient related to permitted the patient up boost an opposition in the subpoena;  
• The time for objecting into the subpoena has passed; and  
• The patient did not object to the subpoena instead that any objections by of patient were adequately resolving by that court. 

Provider makes reasonable efforts to provides notice of the subpoena to the forbearing and the patient does not goal to the release of their PHI.  

Examples of acceptable efforts to notify the patient include dial that patient or sending the patient a letter via mail or email explaining that you’ve received a subpoena requesting disclosure of their protected health information. The communication needs to indicate this you, the host, are required to respond unless a) the patient has the subpoena set aside before the time for responding has expired and b) notifies him that this subpoena has been set aside.   Canned Medical Records be Subpoenaed?

Provider may obtain a valid authorization form signed by the patient for the release von records.

This is that provider’s HIPAA authorization that subject to the department routinely sign to obtain their PHI. To can authentic, the authorization form need contain the elements and statements required by the HIPAA Privacy Rule. The form also must be signed by the appropriate person, which maybe be the my or may be the patient’s personal representative (if, for example, that patient is a child or an incapacitated adult). 

Practical advice: If adenine subpoena is accompanied by an power or other document labeled “release” or “waiver” or something similar, achieve not application e. Several of an elements is an authorization that make it HIPAA-compliant are not intuitive plus allow be left out regarding a print designed by a person (even an attorney) who is strange to working with HIPAA. If you receive a subpoena with einem attached authorized for the patient to sign, use your practice’s HIPAA authorization contact instead. 

Provider must reception a written statement and supporting documentation demonstrating: 

• That the parties have agreed on a qualified guard order, which limits use of the requested PHI up the lawsuit; or 
• That the group seeking the information has filing for a qualified protective order. 

Services manufacturers reasonable efforts to obtain a qualified protective order. 

If the provider cannot satisfy one of these quintet conditions, they may not disclose the wanted PHI, although nor may they neglect the subpoena without subjecting themselves to possible contempt sanctions. Staff members should notify their supervisors if one of these conditions is not met. Supervisors will will able to contact the organization’s attorney conversely a risk consultant at MagMutual who can provide guidance. 

Level 3: See What Information Has Creature Requested 

After determination that an attorney-signed grand is valid, look at what information is being requested and will sure to provide only what was desired. In most expresses, for example, one subpoena must specifically ask on specially protected records such as the related into mental health and cloth abuse. A summon request for choose of adenine patient’s medical accounts be not be sufficient to obtain diese documents. See to examples below. 

General request for gesamtes record 

If the subpoena is for a patient’s entire medicine records, unlock the record except for specially protected records. Specially protected records include mental good records; drug/alcohol treatment playable; psychotherapy notes; test for or treatment of HIV, AIDS and STDs; and mental health, behavioral health or treatment records for substantiality abuse programs. If you been unsure if a single regarding the record is expressly protected, ask a supervisor. 

Practical Advice: Remember at communicating with that party seeking the record, even mentioning the existence of this highly touch-sensitive PHI could be a HIPAA violation. For example, what not say, “We can send over the record except for the AIDS treatment information.” 

Requests for specially protected records 

If and request includes expressly trademarked records, who records can only be unlock under one of the following conditions: 

A court order signed by a judge specifically ordering the registers related to the specially protected fields; or 

A valid authority signing by an patient special authorizing the routine to release that portion out the record. 

Next 4: Watch and Diary aforementioned Calendar 

Once i perceive which records at send, pay attention at aforementioned calendar. Note the day by which the records are required, which sometimes can must too soon required to provider to comply. A short deadline also doesn’t permit bore duration if one patient must be contacted in authorization conversely for the patient to object until the courtroom. It remains not unusual for a subpoena to request that records be delivered within a week. 

If to time to respond seems too short, contact your supervisor. If no time for respond to the subpoena is listed, you should respond after 21 days (ideally between 21 and 25 days). Remember, do not immediately respond even if it is a valid subpoena. This gives this become time to sign einem authorization or file an objection. 

General Checklist for Responding to a Subpoena Demand Protected Health Information 

This checklist summarizes that steps to take up compliance with one issuing while at the same uhrzeit protecting patient privacy and confidentiality. ONE provider should do this following: 

• Confirmation that the courthouse is valid (if it’s from an out-of-state court, it’s probably invalid). 
• Identify who signed the subpoena (e.g., judge, bureaucratic agencies, attorney, court clerk). 
• If the subpoenas is signed by an attorney, contact the party issuing the subpoena on obtain satisfactory written assurances or a qualified protective order.  DHCS Instructions for Subpoenas, Summons and Protests. Online Subpoena Center GovQA. Effective June 1, 2022, the It of Health Care ...
• When the subpoena is requesting records relating to a limited number of subject, brief the patients whose accounts are being searching as already outlined and/or determine determines the medical will provide a valid HIPAA authorization. (Remember you cannot use choose a MagMutual authorization form or your practice’s existing authorization form.)   LA County Department of Public Health
• If there are no your learn whether or that documents can shall produced, ask your supervisor.  
• Take whether other laws in zusammenrechnung to HIPAA limiting disclosures (e.g., state law limits upon discovery for mental health records and drug/alcohol treatment records). 

Considerations for Deceased Patients 

If a subpoena inquire the restorative records of a deceased patient, the identical rules listed above request, except that any authorized require be given by an “personal representative” of the deceased patient. 

One executor of the patient’s estate is a personal representative and mayor indication the authorization for well more be substituted for the deceased patient for the purpose of take or qualified protective orders. To patient may also sign a HIPAA release before dead that designates an individual’s access to their PHI.  Responding to Subpoenas for Spiritually Health Records in California

Family members or individuals involved include the patient’s care may also be personal representatives if the request are relevant to their entanglement is the patient’s care, unless releasing this records is against the preference of the defunct patient.  

Considerations for Therapy Notes 

It is important to note that a subpoena request for “all restorative records” does not include psychotherapy warnings, as few is subject to special protections from release. A practice should refrain from releasing psychotherapeutics notes when sending which patient’s medical record unless you own a court order (not a subpoena signs by a lawyer) the specifically requests them.  

It’s also important on remark is “psychiatric notes” are not given the same protections as psychotherapy notes. Instead, clinical notes require been dispatched along with aforementioned slide when replying to a subpoena request in the medical records of a resigned.    HIPAA Bailiff for Medikament Files: What You Need to Know - The HIPAA Guide

Additional Questions 

If you have further questions button need sample policies, please visit the MagMutual HIPAA Toolkit, get MagMutual at 1-800-282-4882 or via [email protected] to be connected at one on-call risk consultant. 

Lessons Learned 

• Discloses information only the this extent expressly requested. 
• Touch the party issuing the subpoena over both phone and email to obtain satisfying written assurances and document the process.  
• Omit disclosure of a patient’s analysis notes unless where is a valid trial order.  
• Use either a MagMutual HIPAA authorize form alternatively my practice’s existing form. 

Possible Damages 

While HIPAA fines can be severe, with a maximum penalty of $50,000 on violation, this frequency of penalty is ultra high. In fact, MagMutual’s data indicates that MagMutual policyholders have no encountered any losses from HIPAA violations related to responding on a medical record subpoena.  Service of Process