Protecting patient privacy when you release medical records requires careful attention to every detail — even small mistakes can have large financial and legal consequences. The process gets even more complicated when you’re responding to a subpoena for medical records.
How you handle responding to a subpoena for medical records can make the difference between a seamless transaction or a legal financial mess. Follow the below strategies to protect your practice from costly patient information release violations.
Remember: Your duty to protect patient privacy under the Health Insurance Portability and Accountability Act (HIPAA) doesn’t pause just because an attorney requests patient records.
Implement a Process for Responding to Subpoena for Medical Records
Subpoenas aren’t always cut and dry. When releasing records, the risk of making costly mistakes is high.
Therefore, you should implement a process that outlines how your practice handles responding to subpoenas for medical records. As part of this process policy, include training and monitoring on several key elements recommended by healthcare attorney John C. Ivins, Jr., Esq, JD in his online training session.
Train Your Staff on HIPAA and Medical Records Requests
Everyone in your practice who handles transferring patient medical records must be properly trained on HIPAA rules and on your practice’s policy on responding to subpoenas for medical records and patient information. The medical records training should include:
- a thorough overview of the laws that apply to releasing patient medical records
- a solid review on patient confidentiality
- what to do when you receive a subpoena for patient records
- how to identify if a subpoena is valid — and who to contact to verify validity when the staff is unsure
- what medical information should and should not be submitted. For example, sensitive information such as mental health or psychotherapy records under certain circumstances should not be submitted. You can submit sensitive information when responding to a judge’s signed court order request or a patient’s signed release.
Periodically review this training on a routine basis so it’s fresh in everyone’s minds.
Decrease Risk for Incorrectly Responding to a Subpoena
Here are some ways Ivins suggests you can protect your practice from making a mistake when responding to a subpoena for medical records.
- Pick a subpoena liaison, or a few. Consider limiting parties who handle subpoenas for your practice. Selecting a few employees to manage releasing records for subpoenas lessens the likelihood of mistakes.
- Log the subpoena process. Keep detailed, dated records of the subpoena process. Record information such as:
- when you receive the subpoena
- documents prepared for the subpoena
- who is handling the process
- Protect yourself – and save time – with prepared training. Consider a training session for staff members on how to handle releasing medical records. With a small investment you can protect yourself and your practice from the most common and costly medical records release request mistakes.
Get Written Authorization When Responding to a Subpoena for Medical Records
If you receive a subpoena for patient records, your safest bet is to obtain a written authorization from the patient before releasing any of their protected health information (PHI).
A patient may not always be willing to sign a release. However, your efforts protect your practice. A patient’s signed authorization for records release keeps your practice HIPAA compliant.
When in doubt: Seek advice from an attorney (who is knowledgeable in HIPAA law!) before sharing patient PHI.
Uncertain on Subpeona Request’s Validity? Seek Legal Counsel
It’s sometimes difficult to decipher if a subpoena for medical records is legitimate and how you should respond.
In general, your practice must provide an individual’s health care records to comply with a validly issued health care subpoena, pursuant to a search warrant or a grand jury subpoena, or pursuant to a court order.
When deciding how to respond to a subpoena for medical records, look at who issued the request.
Beware: There are other rules for other requesting sources
You may have questions on how to respond to a request for medical records from patients, custodial and noncustodial parents, schools, family members, other medical practices, caregivers, payers, and even hospitals, etc. Each source presents with its own set of rules that you must follow.
To get answers to these questions and more, Training Leader is hosting a webinar to dive into the legal and financial aspects of releasing patient records.