Written and maintained by CASRAI Editorial Board
Last updated
A subpoena arriving in a health information management or privacy office is not an instruction to send
records. Under the HIPAA Privacy Rule it is one of three quite different legal instruments, and only one of
them lets you release protected health information on its face. Getting the classification right in the
first five minutes determines everything that follows.
This guide sets out the federal decision tree only. State law and state court rules add
requirements on top of it, and 45 CFR
160.203(b) expressly preserves any state privacy provision that is more stringent than the
Privacy Rule. Nothing below tells you what your state requires.
The three instruments, and why they are not interchangeable
1. An order of a court or administrative tribunal
Under 45 CFR 164.512(e)(1)(i), a
covered entity may disclose protected health information in a judicial or administrative proceeding “in
response to an order of a court or administrative tribunal, provided that the covered entity discloses only
the protected health information expressly authorized by such order.”
Two things follow. A court order is sufficient on its own – no further assurances are needed. And it is
also a ceiling: the words “expressly authorized” mean you produce what the order names and nothing else. An
order for records of a single admission does not authorise the full chart.
2. A subpoena, discovery request or other lawful process with no court order
This is the case that generates almost all of the difficulty, and it is governed by 164.512(e)(1)(ii). A
covered entity may disclose only if it receives satisfactory assurances from the
requesting party by one of two routes, set out below. A subpoena signed by an attorney rather than a judge –
which is what most civil litigation subpoenas are – carries no independent HIPAA authority at all.
3. A patient authorization
A HIPAA-compliant authorization under 45 CFR 164.508 from the individual (or their personal
representative) is an independent basis for release and is the cleanest route where the requesting party can
obtain one. Requesters who send an authorization alongside a subpoena are usually doing so because it is
faster than the assurances process, not because the subpoena needed help. Validate the authorization against
164.508’s core elements as you would any other; a defective authorization does not become valid because a
subpoena arrived with it.
What “satisfactory assurances” actually require
There are exactly two qualifying routes, and both require a written statement and accompanying
documentation from the party seeking the information. An assurance offered over the telephone, or a
cover letter asserting that notice “has been given” without documentation, does not meet the standard.
Route A: notice to the individual – 164.512(e)(1)(iii)
The written statement and documentation must demonstrate that:
- the requesting party “has made a good faith attempt to provide written notice to the individual (or, if
the individual’s location is unknown, to mail a notice to the individual’s last known address)”; - the notice “included sufficient information about the litigation or proceeding in which the protected
health information is requested to permit the individual to raise an objection to the court or
administrative tribunal”; and - the time for the individual to raise objections has elapsed, and either no objections were filed, or all
objections filed have been resolved by the tribunal and “the disclosures being sought are consistent with
such resolution.”
Note the third element carefully. It is not enough that notice went out. The objection window must have
closed, and if the patient did object, you need to know how the court resolved it and confirm the
request matches that resolution.
Route B: a qualified protective order – 164.512(e)(1)(iv)
Alternatively, the written statement and documentation must demonstrate that either the parties “have
agreed to a qualified protective order and have presented it to the court or administrative tribunal with
jurisdiction over the dispute”, or that the requesting party “has requested a qualified protective order
from such court or administrative tribunal.”
A request that is merely pending is sufficient under the rule’s text. What is not sufficient is a generic
protective order that does not meet the definition below.
What makes a protective order “qualified” – 164.512(e)(1)(v)
A qualified protective order is an order of a court or tribunal, or a stipulation by the parties, that
does both of the following:
- “Prohibits the parties from using or disclosing the protected health information for any purpose other
than the litigation or proceeding for which such information was requested”; and - “Requires the return to the covered entity or destruction of the protected health information (including
all copies made) at the end of the litigation or proceeding.”
Both elements are mandatory. A confidentiality order that restricts use but says nothing about return or
destruction is not a qualified protective order for HIPAA purposes, however robust it looks.
The route the requester cannot block: 164.512(e)(1)(vi)
The rule contains a provision that is frequently overlooked and is often the fastest way out of a stalled
exchange. Notwithstanding the assurances requirement, a covered entity may disclose in response to lawful
process without receiving assurances from anyone “if the covered entity makes reasonable efforts to provide
notice to the individual sufficient to meet the requirements of paragraph (e)(1)(iii) of this section or to
seek a qualified protective order sufficient to meet the requirements of paragraph (e)(1)(v)”.
In other words, if the requesting attorney will not produce assurances, the covered entity may do the
work itself – notify the patient to the (e)(1)(iii) standard, or seek the qualified protective order – and
then disclose. Whether it should is a resourcing and risk decision, but the option exists.
Law enforcement is a different section entirely
Do not run a law enforcement request through the 164.512(e) analysis. Disclosures for law enforcement
purposes sit at 164.512(f), which permits disclosure in compliance with and as limited by:
- “A court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer”;
- “A grand jury subpoena”; or
- “An administrative request for which response is required by law, including an administrative subpoena
or summons, a civil or an authorized investigative demand, or similar process authorized under law” –
subject to three conditions that must all be met: the information sought is “relevant and material to a
legitimate law enforcement inquiry”; the request is “specific and limited in scope to the extent reasonably
practicable in light of the purpose for which the information is sought”; and “de-identified information
could not reasonably be used.”
A grand jury subpoena therefore stands on its own under (f), where a civil litigation subpoena does not
stand on its own under (e). The distinction turns on the issuing authority, not on the word “subpoena”.
Minimum necessary: when it applies and when it does not
Under 45 CFR 164.502(b), a covered entity “must make reasonable efforts to limit protected health
information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.”
The rule then lists the situations where minimum necessary does not apply. Two matter here:
- disclosures “made pursuant to an authorization under 164.508” – so a patient-authorized release is
bounded by the authorization, not by your judgement of necessity; and - “uses or disclosures that are required by law, as described by 164.512(a)”.
A permissive disclosure under 164.512(e) is not a required-by-law disclosure. Minimum necessary applies
to it. This is the analytical basis for producing the records the subpoena identifies rather than the entire
chart, and for pushing back on a request drafted as “any and all records”.
Required by law – 164.512(a) – does not shortcut the analysis
164.512(a) permits use or disclosure “to the extent that such use or disclosure is required by law and the
use or disclosure complies with and is limited to the relevant requirements of such law”, but it then adds
that “a covered entity must meet the requirements described in paragraph (c), (e), or (f) of this section for
uses or disclosures required by law.” A statute that compels production therefore routes you back into the
judicial-proceedings or law-enforcement analysis rather than around it.
Substance use disorder records: a subpoena is never enough
Records subject to 42 CFR part 2 – the
confidentiality rules for substance use disorder patient records – follow a stricter regime that is easy to
miss because the request looks identical. Part 2 requires a court order entered under subpart E, and
42 CFR 2.61(a) is explicit about how the two instruments interact:
“An order of a court of competent jurisdiction entered under this subpart is a unique kind of
court order. Its only purpose is to authorize a use or disclosure of patient information which would
otherwise be prohibited… Such an order does not compel use or disclosure. A subpoena or a similar legal
mandate must be issued to compel use or disclosure.”
The regulation gives the worked example directly: “A person holding records subject to the regulations in
this part receives a subpoena for those records. The person may not use or disclose the records in response
to the subpoena unless a court of competent jurisdiction enters an authorizing order under the regulations
in this part.” For non-criminal proceedings, 42 CFR 2.64 sets the procedure – application using a fictitious
patient name, notice to both the patient and the record holder, an opportunity to respond, an in-chambers or
otherwise protected hearing, and a good cause finding that other ways of obtaining the information are
unavailable or ineffective and that the public interest outweighs the injury to the patient and the
treatment relationship.
So a Part 2 disclosure needs both: an authorizing court order under Part 2, and compulsory
process. Neither alone will do.
Psychotherapy notes
Psychotherapy notes are excluded from the individual’s own right of access under 164.524(a)(1)(i) and are
treated separately throughout the Privacy Rule, including under the authorization requirements at 164.508.
Treat any subpoena that would reach them as a distinct analysis rather than as part of the main record
production, and take legal advice before releasing them.
A practical intake checklist
- Classify the instrument. Judge-signed order? Attorney-issued subpoena? Grand jury
subpoena? Administrative subpoena? Patient authorization? The classification drives the section. - Identify the proceeding type. Civil or administrative proceeding routes to 164.512(e);
law enforcement routes to 164.512(f). - Check the record category. Any part 2 substance use disorder records? Psychotherapy
notes? These leave the main path. - If 164.512(e) with no court order: demand the assurances in writing. Ask specifically
for the written statement and accompanying documentation, and say which of the two routes you will accept
evidence for. - Test a proffered protective order against both prongs of 164.512(e)(1)(v) – use
restriction and return or destruction. - Scope the production to the minimum necessary for a permissive disclosure, and to the
express terms where there is a court order. - Decide whether to self-serve under (e)(1)(vi) if the requester will not cooperate.
- Log the disclosure. Disclosures under 164.512 are generally accountable disclosures –
see accounting of disclosures – so the
production must be recorded, not just performed. - Check state law before releasing. See the scope note below.
What this guide deliberately does not cover
State-by-state requirements. Many states impose notice periods, patient consent requirements, special
protections for HIV status, genetic information, mental health and reproductive health records, and specific
subpoena forms or certifications that go beyond the federal floor. Because 45 CFR 160.203(b) does not preempt
a state privacy provision that is “more stringent than a standard, requirement, or implementation
specification adopted under subpart E of part 164”, those requirements sit on top of everything above rather
than instead of it. Workers’ compensation proceedings in particular are governed largely by state schemes
with their own disclosure rules. Read the federal analysis here, then read your state’s.
Which records are even in scope
A production request is bounded not only by the legal instrument but by what your institution treats as
the record. That is a policy question with two overlapping answers – the statutory designated record set and
the institutional legal health record – and they are not the same thing. See
designated record set vs legal health
record.
Sources
All regulatory text above was taken from the current Code of Federal Regulations via the eCFR versioner
API: 45 CFR 164.512(a), (e) and (f); 45 CFR 164.502(b); 45 CFR 164.524(a)(1); 45 CFR 160.203; and 42 CFR
2.61 and 2.64 (as revised at 89 FR 12629, 16 February 2024). hhs.gov returned an access block and no HHS
guidance document was used; every proposition here is traceable to regulatory text you can read yourself.
