Outpatient therapy clinics frequently receive requests for medical records, including those without patient authorization. In the first two articles of this four-part series of the BCMS Blog, we explored requests from attorneys and those supported by “satisfactory assurances” under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.
In this third installment, we focus on a key distinction that every healthcare provider, clinic owner, or compliance officer must understand: whether a subpoena is court-ordered or issued solely by an attorney. Accurately identifying the type of subpoena is essential to ensuring HIPAA compliance, protecting patient privacy, and minimizing legal risk.
The easiest way to determine the origin of a subpoena is by examining its source, signature, and overall appearance. A court-ordered subpoena will typically bear the official seal of the court, include a case or docket number, and be signed by a judge, court clerk, or other authorized judicial officer. It often contains clear language such as “By order of the [Court Name],” leaving no doubt about its judicial authority.
In contrast, an attorney-issued subpoena does not require a judge’s signature or a court seal unless the court has specifically mandated it. These subpoenas are commonly issued during the discovery phase of litigation and may be signed by the requesting attorney or a notary public. While they may reference a case, they do not necessarily indicate direct court approval or involvement.
Other clues can help confirm the type of subpoena. Court-ordered documents frequently display official court identification, such as “Superior Court of [County/State]” or “United States District Court,” along with a docket number tied to an active proceeding. Attorney-issued subpoenas may mention a case but lack these formal markers.
The language used in the subpoena also provides essential insight. Court-ordered subpoenas often employ authoritative phrasing such as “The court hereby commands you” or “Pursuant to court order.” Attorney-issued subpoenas, on the other hand, may state something like “Issued by [Attorney Name] on behalf of [Party]” or lack any direct reference to a court directive.
If any aspect of the subpoena raises questions, providers should take proactive steps to verify its legitimacy. Contacting the court clerk using the provided case number is a reliable way to confirm authenticity. Reaching out to the issuing attorney for clarification or additional documentation, such as a filed motion or order, is also appropriate. In complex cases, consulting legal counsel can help ensure the subpoena complies with HIPAA Privacy Rule (§ 164.512) and any applicable state regulations, which may impose stricter requirements.
Under HIPAA, Health and Human Services states that protected health information may be disclosed in response to both types of subpoenas. However, attorney-issued subpoenas generally require additional safeguards, such as patient notification or a qualified protective order limiting the use and disclosure of the information. The covered entity, i.e., the custodian of records, should pursue satisfactory assurances from the requester to ensure that the required safeguards are in place prior to releasing records.
By carefully reviewing the subpoena’s source, signature, and language, and, when necessary, verifying it, providers can respond confidently while upholding their obligations to protect patient privacy.
BCMS Compliance Program: Your Partner in Compliance
At BCMS, we empower outpatient therapy practices with our robust Compliance Program, which features tailored policies and procedures aligned with HIPAA Privacy laws and other federal regulations. Let us assist you with the complexities of record release requests and other HIPAA issues to ensure your practice remains compliant and secure. Contact us today to discover how we can assist you in your compliance journey.
About BCMS
BCMS is a trusted leader in healthcare compliance, delivering enrollment, credentialing, audit, and appeals services, as well as other regulatory solutions, for outpatient therapy providers. BCMS specializes in empowering healthcare providers through our comprehensive Compliance Program, which includes tailored policies and procedures and integrates Federal guidance with robust annual training. Stay informed with our latest insights at bcmscomp.com/blog.
Disclaimer: This blog is for informational purposes only and does not constitute legal advice. Consult an attorney for legal matters or a compliance professional for specific guidance.