3.5 Release of Information: Subpoenas, Law Enforcement, and Warrants
Key Takeaways
- A subpoena signed by an attorney or court clerk is not a court order; under 45 CFR 164.512(e) protected health information may be released only with satisfactory assurance of notice to the patient or a qualified protective order.
- A search warrant is signed by a judge or magistrate and executed immediately, so the correct response is to call counsel, copy the warrant, refuse consent beyond its scope, observe and inventory what is taken, and never alter or remove records.
- Under 45 CFR 164.512(f)(2), identification and location disclosures to law enforcement are limited to an enumerated list and expressly exclude DNA, DNA analysis, dental records, and body fluid or tissue typing.
- Substance use disorder records held by a 42 CFR Part 2 program require Part 2-compliant patient consent or a Part 2 court authorizing order; a subpoena alone is never sufficient.
- Disclosures made under a subpoena, court order, or law enforcement request are accountable under 45 CFR 164.528, while disclosures made under a signed authorization or for treatment, payment, and operations are not.
The Highest-Yield Discriminator in Domain 1
Domain 1 lists 'release of information (e.g., law enforcement, subpoenas, attorneys, search warrants, etc.)' as its own sub-task, and it is one of the most reliably scorable topics on the CPHRM because the right answer turns on a single question: who signed the paper, and what does that signature actually compel? A neighboring section owns the architecture of the HIPAA Privacy and Security Rules and breach notification. This section is about the decision at the health information counter at 11 p.m. when someone with a badge or a document wants a chart.
Memorize the headline: a subpoena signed by an attorney is not a court order. In civil litigation, a subpoena duces tecum is typically issued by a party's attorney or a court clerk as a discovery device. No judge has reviewed it, no judge has weighed the patient's privacy interest, and the HIPAA Privacy Rule does not treat it as a mandate to disclose protected health information (PHI).
| Instrument | Who signs it | What it compels | What the risk manager must do |
|---|---|---|---|
| HIPAA authorization | The patient or the patient's personal representative | Permission to disclose exactly what the authorization describes | Verify the core elements — description of the information, who discloses, who receives, purpose, expiration date or event, signature and date, revocation right, no-conditioning statement, redisclosure notice — and release strictly within its terms |
| Subpoena or subpoena duces tecum | An attorney or court clerk | Appearance or production in the litigation, but not, standing alone, disclosure of PHI | Obtain satisfactory assurance under 45 CFR 164.512(e): documented reasonable efforts to notify the patient with time to object, or reasonable efforts to secure a qualified protective order; otherwise decline and route to counsel |
| Court order (including a judge-signed subpoena or a grand jury subpoena) | A judge, magistrate, or grand jury | Disclosure of exactly what the order specifies | Disclose only the PHI expressly authorized, never the rest of the chart; log the disclosure |
| Search warrant | A judge or magistrate, on probable cause | Immediate search and seizure within the warrant's stated scope | Call counsel immediately, obtain and copy the warrant and credentials, do not obstruct, do not consent beyond its scope, observe and inventory everything taken, request copies of seized originals for continuity of care |
A qualified protective order (QPO) is a court order or stipulation that (1) prohibits the parties from using or disclosing the PHI for any purpose outside the litigation and (2) requires return or destruction of the PHI when the proceeding ends. Producing under a QPO is often faster than chasing patient notice, and counsel can frequently obtain one by stipulation.
Health information management receives a subpoena duces tecum signed by the plaintiff's attorney in a personal injury suit, demanding the complete record of a patient who is not suing your organization. There is no court order, no protective order, and no patient authorization. What should the risk manager advise?
The Workflow That Produces the Right Answer
Walk every request in this order. Most distractors fail at step 1, 3, or 8.
- Verify the requester. Identity, agency, credential, and contact information. A badge in the hallway is not authority, and the presence of police in the emergency department authorizes nothing by itself.
- Date- and time-stamp everything, keep the envelope and the document, and log the request.
- Identify the instrument and read its scope — authorization, subpoena, court order, warrant, or statutory reporting mandate — including the date range, encounter, or record type it actually names.
- Check state law and the record type. HIPAA is a federal floor; a more protective state law or a special record category controls.
- Involve legal counsel and the privacy officer for anything non-routine: warrants, grand jury subpoenas, requests about employees, media inquiries, high-profile patients, and every special-category record.
- Confirm the objection window or protective order before producing under a subpoena.
- Disclose the minimum necessary for the permitted purpose. The minimum necessary standard does not apply to disclosures to the patient, disclosures made under the patient's authorization, or disclosures required by law where the law sets the scope — but it does discipline discretionary law enforcement responses.
- Record the accounting of disclosures. Under 45 CFR 164.528 a patient may request an accounting of disclosures made without authorization, generally covering the prior six years. Subpoena, court order, and law enforcement disclosures are accountable; treatment, payment, operations, and authorization-based disclosures are not.
- Keep a copy of exactly what was released and of the document that authorized it.
- Never alter, back-date, or destroy anything. A records request is often the first hint of litigation. Preserve the record, place a litigation hold, and evaluate whether the request signals a potentially compensable event requiring notice to the carrier or third-party administrator.
Law Enforcement Requests Under 45 CFR 164.512(f)
The rule contains several narrow permissions, and each boundary is testable.
- Required by law or legal process — a court order, court-ordered warrant, subpoena or summons issued by a judicial officer, a grand jury subpoena, or an administrative request that is relevant and specific, cannot reasonably be satisfied with de-identified information, and is limited in scope.
- Identifying or locating a suspect, fugitive, material witness, or missing person — limited to name and address, date and place of birth, Social Security number, ABO blood type and Rh factor, type of injury, date and time of treatment or death, and distinguishing physical characteristics. It expressly excludes DNA, DNA analysis, dental records, and body fluid or tissue typing.
- Victims of crime — with the individual's agreement, or without agreement in limited circumstances when the individual cannot agree because of incapacity and the rule's conditions are met.
- Decedents — to alert law enforcement to a death the organization suspects resulted from criminal conduct.
- Crime on the premises — PHI the organization believes constitutes evidence of criminal conduct that occurred on its property.
- Reporting a crime in an emergency — by a provider furnishing emergency care off site.
- Serious and imminent threat — 45 CFR 164.512(j) permits disclosure to prevent or lessen a serious and imminent threat to health or safety, made to someone able to prevent it.
Two practical points. Staff should not act as investigative agents. A blood draw taken for law enforcement purposes requires a warrant, valid consent, or a recognized statutory or exigent basis; an officer's request alone is not enough, and a clinically indicated draw is a different act from an evidentiary one. And mandatory state reporting is a separate track from these permissions: gunshot and stab wounds, suspected abuse of children, elders, and dependent adults, and certain communicable diseases are reported because a statute requires it, not because an officer asked.
Two detectives arrive at the nursing station looking for a man they believe committed an armed robbery and was treated for a hand laceration last night. They have no warrant, no court order, and no authorization, and they ask for a copy of his emergency department record. What may be disclosed?
Records That Need More Than HIPAA
HIPAA is the floor. Several categories require a stronger legal basis, and confusing them is a reportable privacy violation.
| Category | Extra requirement beyond HIPAA |
|---|---|
| Substance use disorder records held by a 42 CFR Part 2 program | Part 2-compliant patient consent, or a Part 2 court authorizing order entered under the regulation. A subpoena alone is never enough. The 2024 final rule aligned many Part 2 provisions with HIPAA, but Part 2 records still may not be used in a criminal investigation or prosecution of the patient without a qualifying court order. |
| Psychotherapy notes | A separate, stand-alone authorization under 45 CFR 164.508(a)(2) that may not be combined with any other authorization. The definition covers a mental health professional's notes analyzing a counseling session that are kept separate from the record; it excludes medication prescription and monitoring, session start and stop times, modalities and frequencies, test results, diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date. |
| HIV and AIDS status | Many states impose specific written-consent and redisclosure rules exceeding HIPAA. |
| Genetic information | The Genetic Information Nondiscrimination Act (GINA) plus state genetic privacy statutes. |
| Mental health and developmental disability records | State-specific consent and disclosure regimes in most states. |
| Minor-consent records | Where a state statute allowed the minor to consent, the minor generally controls the record and the parent may not be the personal representative. |
| Reproductive health information | State law varies widely and federal rulemaking in this area has been subject to litigation; verify the current rule with counsel rather than relying on memory. |
When a record set is mixed — a Part 2 program note filed inside a general hospital chart, for example — the safer practice is to segregate and withhold the protected content, disclose the remainder under the applicable authority, and state on the transmittal that material was withheld under a specific legal protection rather than silently omitting it.
Attorney Requests
- The patient's own attorney needs a valid HIPAA authorization signed by the patient or the personal representative. A letter of representation is not an authorization.
- Opposing counsel needs an authorization, a court order, or a subpoena carrying the 164.512(e) assurances. There is no professional-courtesy exception.
- Your organization's defense counsel and liability carrier ordinarily receive information for health care operations and legal defense; route it through counsel to preserve attorney-client privilege and work-product protection, and coordinate with the litigation-hold process.
- A records request from a plaintiff's firm is a claims signal. Evaluate it as a potentially compensable event (PCE), notify the carrier or third-party administrator per the policy's notice provisions, and preserve everything, including audit trails, imaging, device data, and electronic health record metadata.
A hospital-based, federally assisted opioid treatment program receives a subpoena duces tecum signed by a county prosecutor demanding a patient's counseling notes and dosing records. The patient has signed nothing. What is the correct action?
Putting It Together
Scenario. At 9 p.m. a federal agent presents a search warrant for the billing and clinical records of a physician practice owned by the health system, while at the same moment a local detective asks the emergency department charge nurse for the chart of a patient injured in a bar fight two hours earlier.
Two different answers. For the warrant: call counsel and the administrator on call immediately; ask for and photocopy the warrant and the agent's credentials; read the scope; do not obstruct execution; do not consent to a search beyond what the warrant names; assign a staff member to observe and inventory everything taken; request copies of any originals seized so patient care can continue; and instruct staff that interviews are voluntary and counsel should be present. Do not shred, move, or 'clean up' a single file. For the detective: there is no warrant, no court order, and no authorization, so the only available pathways are the narrow identification and location elements, a victim-of-crime disclosure with the patient's agreement, a crime-on-premises disclosure if the assault occurred on the property, or a mandatory state report if the injury is a reportable wound. Log whatever is disclosed in the accounting of disclosures.
Exam Traps
| Trap | The tested reality |
|---|---|
| 'A subpoena is a court order' | An attorney-issued subpoena requires patient notice or a qualified protective order before PHI moves. |
| 'A judge signed it, so send the whole chart' | A court order compels only what it expressly specifies. |
| 'Ask the agent to come back with an appointment' | A search warrant is executed now; the correct moves are counsel, copy, observe, inventory. |
| 'Police are investigating a felony, so release the record' | Law enforcement permissions are narrow and category-specific, and the identification pathway excludes DNA, dental records, and fluid typing. |
| 'It is all one chart' | Part 2 records, psychotherapy notes, and state-protected categories need more than HIPAA; segregate them and disclose that material was withheld. |
| 'Her lawyer sent a letter of representation' | A letter of representation is not an authorization. |
| 'Fix the note before it goes out' | Alteration is spoliation; preserve, place a litigation hold, and never back-date. |
| 'It was only a records request' | It is frequently the first notice of a claim — evaluate it as a potentially compensable event and notify the carrier or third-party administrator. |