Update Notice: This blog post was reviewed for accuracy by a Healthcare Training Leader expert and was updated on May 26, 2021. This update included adding the following sections to this post, “What if the Subpoena is Inadequate” and “Identifying Request Requirements,” to ensure the information you receive is accurate, up-to-date and complete. responding to subpoena for medical records.
Protecting patient privacy when you release medical records requires careful attention to every detail — even small mistakes can have large financial and legal consequences. The process gets even more complicated when you’re responding to a subpoena for medical records.
How you handle responding to a subpoena for medical records can make the difference between a seamless transaction and a legal and financial mess. Follow the below strategies to protect your practice from costly patient information release violations. responding to subpoena for medical records.
Remember: Your duty to protect patient privacy under the Health Insurance Portability and Accountability Act (HIPAA) and the 21st Century Cures Act doesn’t pause just because the request for your patient’s records came from an attorney. responding to subpoena for medical records.
Implement a Process for Responding to a Subpoena for Medical Records
Knowing how to respond to a subpoena for medical records is not always black and white. Unfortunately, there is tons of grey, and the risk of making costly mistakes is high. You need to implement a process that outlines exactly how your practice handles responding to subpoenas for medical records. Healthcare attorney and Healthcare Training Leader expert, Lester J. Perling, JD, MHA, CHC recommends that you include the following key elements in your policy to be optimally protected:
- Train your staff. Everyone in your practice who handles the transfer of patient medical records must be properly trained in three areas:
-
- HIPAA rules
- 21st Century Cures Act rules
- Responding to subpoenas for medical records and patient information. This training should answer the following questions:
- What is the process when you receive a subpoena for patient records?
- Who in your practice is authorized to sign off on releasing records?
- What laws apply when you receive a release for patient medical records?
- What are the patient’s confidentiality rights?
- How can you identify if a subpoena is valid?
- Who should you contact to verify the validity of the request?
Note: Be sure to periodically review this training so it’s fresh in the minds of your staff. Also, keep track of each time you conduct a staff training with a log of the date, time and everyone who was in attendance.
- Use caution submitting certain protected health information (PHI). Educate yourself and your staff on what medical information should and should not be sent. You might be surprised at some forms of PHI. For example, under certain circumstances, sensitive information such as mental health or psychotherapy records should not be submitted. However, you can submit sensitive information when responding to a judge’s signed court order request or a patient’s signed release.
. - Pick a subpoena liaison, or a few. Consider limiting parties who handle subpoenas for your practice. Selecting a few employees to manage records release for subpoenas lessens the likelihood of mistakes.
. - Log the subpoena process. Keep detailed, dated records of the subpoena process. You should answer the following questions in your documentation:
- When did you receive the subpoena?
- What documents did you prepare to respond to the subpoena?
- Which members of your team managed the process and were they authorized to do so?
.
- Protect yourself – and save time – with prepared training. Consider a training session for staff members on how to compliantly release medical records. With a small investment, you can protect yourself and your practice from the most common and costly medical records release request mistakes.
Get Written Authorization When Responding to Subpoena for Medical Records
When responding to a subpoena for medical records, your safest bet is to obtain written authorization from the patient before releasing any of their PHI – EVERY SINGLE TIME. A patient may not always be willing to sign a release, but your efforts protect your practice. A patient’s signed authorization for records release keeps your practice HIPAA compliant. responding to subpoena for medical records
Note: If the patient refuses to authorize the release of their PHI when there is a subpoena involved, seek advice from an attorney knowledgeable in HIPAA law before sharing patient PHI.
Determine the Subpoena Request’s Validity
It’s sometimes difficult to decipher if a subpoena for medical records is legitimate (meaning you are required to respond), and what your response obligation is. In general, your practice must provide an individual’s healthcare records to comply with a validly issued health care subpoena, pursuant to a search warrant, grand jury subpoena or court order. responding to subpoena for medical records
When deciding how to respond to a subpoena for medical records, look at who issued the request. Use the chart below as a key to help you determine your next step after receiving a subpoena for medical records. responding to subpoena for medical records.
Resources:
- According to the Cambridge Dictionary, an Administrative Tribunal is “a legal organization that makes decisions in disagreements between two people or between a person and a government department, but which is not part of the court system.”
- The Department of Health and Human Services provides the following information about what to look for before you respond to a court order or subpoena on their website.
- This online training by, Lester J. Perling, JD, MHA, CHC, will walk you through how to better determine your obligation when responding to a subpoena for medical records.
What if the Subpoena Is Inadequate?
If the subpoena is lacking in some way, you MUST NOT release your patient’s protected PHI. Instead, inform the requestor that there’s a problem. When communicating about this request, DO NOT divulge any patient information or even acknowledge that the person is your patient. All you can talk about is the subpoena’s inadequacy. Otherwise, you would be violating HIPAA’s Privacy Rule.
If you feel that the scope of the request for medical records is unreasonable, you can try to narrow the breadth of the subpoena by filing a motion with the judge. You should only take this action if you feel the information’s release would harm your patient.
In addition to responding to an information request with a problem notification, you should also contact your patient and notify them of the subpoena. You are required to make a “reasonable effort” to inform your patient about the subpoena, and of your obligation to respond unless they formally object. Your notification efforts can include calling, emailing, texting or mailing a letter to your patient. Whichever method(s) you use, be sure to document the format and date the notification was sent. It can also be beneficial to save a copy of the notification in the patient file. Ideally, the goal is to get the patient to sign a HIPAA release of information form.
Identifying Request Requirements
Sometimes it’s difficult to tell a court-issued subpoena from an attorney-issued one – legalese all looks alike! A judge’s name and a signature will signify a court-issued document.
It can also be challenging to discern whether a subpoena is requesting medical records or is ordering you to testify in court. Become familiar with these legal terms that inform you of your obligations:
- Witness Subpoena: Requires you to testify in court
- Subpoena Duces Tecum: Requests documents or records
- Deposition Subpoena: Usually means you must attend a deposition
As mentioned above, be sure to have clear policies and procedures for your staff regarding how to respond to a medical records subpoena. This can really help you avoid costly mistakes and huge violation fines. Finally, contact an attorney if you have any questions or doubts about how to proceed.
Beware: There are other rules you must comply with when responding to requests for patient medical records beyond the ones outlined in this post. Requests for records can come from patients, custodial and noncustodial parents, schools, family members, other medical practices, attorneys, Judges, caregivers, payers, hospitals, etc. Each requesting source presents its own set of rules that you are REQUIRED to comply with.
Don’t end up with a violation! Learn how to protect your practice. Healthcare Training Leader expert, Lester J. Perling, JD, MHA, CHC, will walk you step-by-step through exactly how to respond to requests for patient medical records in his online training, Stop Costly Legal Errors When Responding to Medical Record Requests. Sign up for this online training today!
 | Subscribe to Healthcare Practice Advisor |
| Get actionable advice to help improve your practice’s reimbursement, compliance, and success in this weekly eNewsletter. | |
| |