Health Information Management

What are our duties when we receive a subpoena for medical records or other PHI?

HIPAA Weekly Advisor, September 11, 2003

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: What are our duties when we receive a subpoena for medical records or other PHI?

A: When a covered entity receives a subpoena for PHI, it must determine whether the subpoena resulted from a judicial or administrative order. When a court or administrative tribunal order issues the subpoena, the covered entity may disclose the requested information without authorization. Note that this rule says that a covered entity "may" disclose; it does not say "must" disclose.

Absent a subpoena issued by a court or administrative tribunal, a covered entity may respond to a subpoena from a party to the proceeding only if the covered entity has an authorization from the person whose PHI is being released, or if it obtains either of the following from the party seeking the information:

  • Satisfactory assurances that reasonable efforts have been made to give the individual whose information has been requested notice of the request
  • Satisfactory assurances that the party seeking such information has made reasonable efforts to secure a protective order that will guard the confidentiality of the information

    The regulations state that a covered entity has received these assurances if the requestor produces the following evidence:

  • that it has made a good faith effort (such as by sending a notice to the individual's last known address) to provide written notice to the individual whose information is the subject of the request
  • that the written notice included sufficient information about the proceeding to permit the individual to raise an objection
  • that the time for the individual to raise objections to the court or administrative tribunal has elapsed, and that no objections were filed, or any objections filed by the individual have been resolved.

    Note that the regulations require these assurances to be made in writing with accompanying documentation.

    A covered entity will receive satisfactory assurance if it receives from the party seeking the information a written statement and accompanying documentation that demonstrates

  • the parties to the dispute have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute
  • the party seeking the information has requested a qualified protective order from the court or administrative tribunal.

    A qualified protective order is an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that

  • prohibits the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which such information was requested
  • requires the return to the covered entity or destruction of the PHI (including all copies made) at the end of the litigation or proceeding.

    Editor's note: Brought to you by attorneys Marty Baxter and Gretchen McBeath at Bricker and Eckler, LLP and The Quality Management Consulting Group, Ltd.. E-mail: mbaxter@bricker.com or gmcbeath@bricker.com



    • Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

    • Briefings on APCs

      Worried about the complexities of the new rules under OPPS and APCs? Briefings on APCs helps you understand the new rules...

    • Medical Records Briefing

      Guiding Health Information Management professionals through the continuously changing field of medical records and toward a...

    • Briefings on Coding Compliance Strategies

      Submitting improper Medicare documentaion can lead to denial of fees, payback, fines, and increased diligence from payers...

    • Briefings on HIPAA

      How can you minimize the impact of HIPAA? Subscribe to Briefings on HIPAA, your health information management resource for...

    • APCs Weekly Monitor

      This HTML-based e-mail newsletter provides weekly tips and advice on the new ambulatory payment classifications regulations...

    Most Popular

    Related Articles