Under HIPAA, you release records for a subpoena only when the right paperwork backs it. A court order gets exactly what it names, and no more. A subpoena with no court order first needs written proof: a good-faith attempt to tell the patient, or a qualified protective order. Police usually need a warrant, court order, or qualifying request. Always respond by the deadline.
A process server hands your front desk an envelope. Inside is a subpoena duces tecum (a subpoena that orders someone to produce documents or records) for a patient's complete chart. Practices get this wrong in two opposite directions: some mail the chart the same day, and some stick the envelope in a drawer and hope it goes away. Both are mistakes. The first can be an impermissible disclosure (a release of patient information that HIPAA does not permit). The second can carry penalties under state or federal court rules.
HIPAA's answer lives in 45 CFR 164.512(e) for lawsuits and 164.512(f) for law enforcement, and it sorts every request into a small number of buckets. Here they are, in the order your front desk will meet them.
The HIPAA Subpoena Analysis, Bucket by Bucket
Bucket 1: An Order of a Court or Administrative Tribunal
An order of a court or administrative tribunal is the strong form. HIPAA permits disclosure in response to it, with one instruction. The rule reads:
"In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order"
Read the order, produce exactly what it names, nothing more. The complete chart goes only if the order says the complete chart.
Bucket 2: A Subpoena With No Court Order
A subpoena, discovery request, or other lawful process that is not accompanied by a court order, such as one issued by an attorney in the case, is different. Under 164.512(e), that document alone is not enough. Before you can comply, you need "satisfactory assurances" (a written statement and accompanying documentation from the party seeking the records), showing one of two things:
1. The party asking made a good-faith attempt to tell the patient in writing. The patient had time to object. Either no objection was filed, or the court resolved the objections and the request is consistent with its ruling. Or:
2. The parties have agreed to, or asked the court for, a qualified protective order (a court order or stipulation that restricts the records to the litigation and requires their return or destruction at the end).
No assurances attached? You do not ignore the subpoena, and you do not comply with it yet. You respond to the party that sent it: "Under 45 CFR 164.512(e), we need satisfactory assurances before we can produce these records. Please provide them." The rule also lets you skip waiting and provide the notice or seek the protective order yourself, but for a small practice, putting the burden back on the requester is the sane default.
Bucket 3: Law Enforcement
Police and investigators run under 164.512(f), which is its own list. With a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena, disclosure is permitted, as limited by that document. An administrative request, such as an investigative demand without a court behind it, works only if it meets three tests. First, the information is relevant and material to a legitimate law enforcement inquiry, which means it actually matters to a real investigation. Second, the request is specific and limited. Third, de-identified information (data with the identifying details removed) could not reasonably be used.
For identifying or locating a suspect, fugitive, witness, or missing person, HIPAA allows only a short list of details: name and address, date and place of birth, Social Security number, ABO blood type and Rh factor, type of injury, date and time of treatment, date and time of death if applicable, and a description of distinguishing physical characteristics such as height, weight, scars, and tattoos. Not DNA or DNA analysis, dental records, or typing, samples, or analysis of body fluids or tissue. Not the rest of the chart. A badge at the front desk is a reason to get the practice manager, not a reason to open the chart. Train the desk to say one sentence: "Our privacy officer handles all record requests, let me get them."
The Buckets at a Glance
| What arrives | What HIPAA needs before you release anything | Rule |
|---|---|---|
| Order of a court or administrative tribunal | Nothing more; disclose only what the order expressly authorizes | 164.512(e)(1)(i) |
| Subpoena, discovery request, or other lawful process with no court order | Written satisfactory assurances: notice to the patient with the objection time elapsed, or a qualified protective order | 164.512(e)(1)(ii) to (v) |
| Law enforcement: court order, court-ordered warrant, subpoena or summons issued by a judicial officer, or grand jury subpoena | Comply as limited by the document's own requirements | 164.512(f)(1)(ii)(A), (B) |
| Law enforcement administrative request (administrative subpoena, investigative demand) | All three tests: relevant and material, specific and limited, de-identified information could not reasonably be used | 164.512(f)(1)(ii)(C) |
| Request to identify or locate a suspect, fugitive, material witness, or missing person | Only the short list of identifying details, never the full chart | 164.512(f)(2) |
Two Overlays That Change the Answer
First, permitted is not required. Nearly everything in 164.512 says a practice "may" disclose, not "must." HIPAA permits these disclosures; it does not require them. Whether a subpoena or a court rule compels you to produce records is a separate legal question, so put it to your attorney.
Second, state law sits on top. State privilege law, and stricter state privacy statutes, can block disclosures HIPAA would permit, particularly for mental health, HIV, and substance use records, where 42 CFR Part 2 adds a federal layer of its own. The relationship between privilege and HIPAA is covered in the doctor-patient confidentiality comparison. When the request touches any sensitive category, the analysis belongs with counsel, not the front desk.
The Office Workflow
Five steps, one page. Log the request the day it arrives, with the response deadline on a calendar. Route it to one owner, the privacy officer. Sort it into a bucket: court order, subpoena with no court order, law enforcement, or none of the above. For anything beyond a clean bucket-one order, call your attorney or malpractice carrier; ask whether yours offers risk-management help for this kind of question. And always respond by the deadline, even when the response is "we require satisfactory assurances."
Responding is not the same as disclosing, and the practices that get hurt are the ones that confused the two, in either direction.
A missing written policy is fixable fast. In one anonymized case, a Florida mental health franchise office had policies that were never written, records with holes, and training half done, with a state auditor due in days. It was audit-ready in under a week and passed its state audit.
One Guy Consulting in 37 Seconds
FAQ
Do we have to comply with every subpoena for medical records?
Not automatically. Under 45 CFR 164.512(e), a subpoena with no court order needs written satisfactory assurances before HIPAA permits disclosure. Still, respond by the deadline: ignoring a valid subpoena can carry penalties under state or federal court rules, so ask your attorney.
Can police see a patient's record if they show up with a badge?
Not on the badge alone. Apart from a few narrow cases, like reports a law requires, 164.512(f) calls for paperwork. That means a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, a grand jury subpoena, or an administrative request that meets three tests. To help identify or locate a person, you may share only a short list of details. Examples are name, address, date of birth, type of injury, and date of treatment. Never the full chart.
Does the patient have to be notified about a subpoena?
Not always. For a subpoena with no court order, you need satisfactory assurance, which means a written statement and documentation from the party asking. One kind shows they made a good-faith attempt to give the patient written notice and the time to object has passed. The other kind shows the parties agreed to a qualified protective order, or the party asking requested one from the court.
What is a qualified protective order?
An order of a court or administrative tribunal, or a stipulation by the parties, that prohibits using or disclosing the records for any purpose other than the case and requires their return or destruction, including all copies, when the case ends. Written proof that one was agreed to or requested is one of the two forms of satisfactory assurance under 164.512(e).
Should we produce the entire chart when a subpoena asks for it?
Produce what the document actually compels and no more. With a court order, disclose only what the order expressly authorizes. Outside a direct court command, think minimum necessary. That means you share only what the request actually needs.
The subpoena workflow is a one-page policy plus a phone number for counsel, and it is the difference between a calm response and a disclosure you cannot take back. One Guy Consulting's Full-Scope plan includes 4 hours a month of 1:1 implementation calls with Chuck to set up your compliance plan. For a specific subpoena, talk with your attorney. Start with a free 30-minute intro call. No obligation, no pressure.
Sources
- 45 CFR 164.512(e) and (f) (judicial, administrative, and law enforcement disclosures)
- HHS FAQ: court orders and subpoenas
Related Reading
Try three One Guy Consulting 3D staff training courses free →