Subpoenas for HIIPA Records
A recent public post by a lawyer writing for ACH Media website entitled You Must Respond Carefully When You Are Served With a Subpoena caught my attention when he made the following assertion:
A court subpoena carries more weight than one from an attorney.
This did not seem legally correct at the time. Self-initiating discovery in civil cases has been the trend in both federal and state courts starting in the mid-1980s, wherein lawyers, as officers of the court, were permitted by statute to issue subpoenas to witnesses for depositions and trials, without going to the courthouse to do so. Regardless of who or how it was issued, any objection to the subpoena would find the follow the same route through the court in the form of a motion to quash service or to modify the scope of the subpoena, or even a protective order.
After re-reading the article, I then realized that the it was written by a lawyer with an intended audience of risk managers or the people in health information management at hospitals. The tenor and topic of the article was a good, solid directive to those dealing with the release of patient’s healthcare records in response to subpoenas and search warrants under the Health Insurance Portability and Accountability Act (HIIPA).
The author provided no authority for his assertion about court issued vs. attorney issued subpoenas. He alluded to the lack of a notification requirement under HIIPA that would also require a patient’s written consent or a court order to release healthcare records.
Upon a little research, this characterization and distinction between a court and attorney issued subpoena is found in 45 CFR 164.512(e), wherein this notification is required under HIIPA.
I am assuming that is where it came from. I have not found any other authority why a court issued or attorney issued subpoena would be any more or less valid and enforceable.
Civil discovery laws are state-specific. Some states have not enacted a statutory construct for providing a patient notice when their records are being subpoenaed.
California, and I assume other states, have procedures that provide such sufficient notice. California did it almost 10 years before HIIPA became law when they enacted the consumer notice requirement for serving subpoenas that demand production of an individual’s personal records. (See CCP sec. 1985.3, et seq.) Because of this notification provision, it was already HIIPA compliant.
So, in that context, the author didn’t explain the reasoning for that statement. It was factually correct, but not completely correct. At least not in California.