Connecticut Supreme Court Case Creates Another Reason To Be Cautious About Medical Records Subpoenas

Every time a subpoena for medical records arrives, it creates angst. The medical records custodian experiences pressure to release records from the moment he/she receives a call from the requesting attorney's office, often arguing about whether the subpoena provides enough authority to release the records.

A Connecticut Supreme Court case1 is getting a lot of attention for allowing state negligence claims based on noncompliance with HIPAA standards. For health information management professionals, the case underscores the need to resist releasing clinical information merely on the basis of a subpoena or at the insistence of an attorney. The court ruled that state court pretrial practices must be HIPAA compliant and that HIPAA requirements extend to responses to subpoenas.2 The court cited HIPAA regulations, 45 C.F.R. § 164.512(e)(1)(ii), to reaffirm that a healthcare provider cannot transfer protected health information (PHI) to an outside entity without receiving satisfactory assurances that the person whose medical records are the subject of the subpoena has been given notice of the request. [45 C.F.R. §165.512(e)(1)(ii)(A)] Usually the subpoena includes some notice language. However, satisfactory assurances requires all of the following:

Written notice to the affected individual; Sufficient information for the individual to raise an objection; and Time for the individual to raise an objection or confirm that there are no objections or that all objections have been resolved. Thus, before the requested medical record can be released, the provider needs to make sure there are no objections from the affected individual.

Alternatively, a provider may release PHI if it receives satisfactory assurances from the party seeking the information that it has made reasonable efforts to secure a qualified protective order. [45 C.F.R. §165.512(e)(1)(ii)(B)] Satisfactory assurances requires:

The parties have agreed to a qualified protective order; or The party seeking the PHI has requested a qualified protective order. [45 C.F.R. § 164.512(e)(1)(vi)] Thus, it is not enough for the subpoena to include a statement that a protective order will be filed or to include...