HIPAA Privacy Rule May Allow Stopgap to Subpoenas That “Order” Personal Health Information
Handling PHI requests from third parties is commonplace. However, it can be a bit intimidating to get a subpoena seeking PHI — not least given the subtle threat in the word itself. The circumstance discussed in this post is as follows: a covered entity that is not a party to the litigation in question receives what is called a subpoena duces tecum from one of the litigating parties seeking PHI. “Duces tecum” means that the subpoenaing party is looking not just for sworn testimony but also for records. Frequently, however, the subpoenaing party doesn’t actually want the sworn testimony — just the records. As a result of civil procedure rules, this sort of subpoena can’t directly ask for just the records.
Instead, the subpoena duces tecum needs to ask the recipient to show up to give sworn testimony and bring along requested documents. It will then say that if the recipient delivers the requested records, then sworn testimony won’t be necessary. But many people aren’t familiar with this song-and-dance and therefore believe that they’ll need to show up to court to testify — something many (understandably) consider to be an unpleasant prospect.
Often, attached to the subpoena is a document that may appear to be a court order. It will be on court letterhead and include language that the covered entity is “ordered to” provide testimony and provide records. As a result, covered entities may believe (or be pushed by the lawyer who served the subpoena to believe) that releasing the requested PHI is permitted under HIPAA pursuant to 45 C.F.R. 164.512(e)(1)(i). That Section permits disclosure of PHI by a covered entity — without the written authorization of the subject of the PHI and without providing that individual the opportunity to agree or object — so long as the disclosure is only the PHI expressly authorized for release by the order.
Don’t be fooled. It is critical that the covered entity review the signature line of the “order” attached to the subpoena. As discussed, the U.S. Department of Health & Human Services has made clear that a subpoena by someone other than a judge, such as a court clerk, is not an “order” as that term is used in Section 164.512(e)(1)(i). If the clerk (or in Delaware and Pennsylvania one may see the title “prothonotary”) signed the “order” attached to the subpoena, then the covered entity cannot rely on Section 164.512(e)(1)(i) to release the PHI.
Instead, before releasing the requested PHI, the covered entity will need to get “satisfactory assurances” pursuant to Section 164.512(e)(ii), which include a written statement with attached proofs evidencing reasonable efforts to either provide the subject of the subpoena with notice of the PHI request or secure a qualified protective order. Additional details and requirements are found at Sections 164.512(e)(iii)-(v). Note, too, that the covered entity may of its own accord make reasonable efforts to provide notice to the individual or to seek a qualified protective order instead of obtaining satisfactory assurances of the same from the subpoenaing party, but covered entities may prefer to keep that onus on the subpoenaing party.
