Update Notice : This blog post was reviewed for accuracy by a Healthcare Training Leader expert and was updated on May 26, 2021. This update included adding the following sections to this post, “ What if the Subpoena is Inadequate” and “Identifying Request Requirements,” to ensure the information you receive is accurate, up-to-date and complete. r esponding to subpoena for medical records.
Protecting patient privacy when you release medical records requires careful attention to every detail — even small mistakes can have large financial and legal consequences. The process gets even more complicated when you’re responding to a subpoena for medical records.
How you handle responding to a subpoena for medical records can make the difference between a seamless transaction and a legal and financial mess. Follow the below strategies to protect your practice from costly patient information release violations. responding to subpoena for medical records.
Remember: Your duty to protect patient privacy under the Health Insurance Portability and Accountability Act (HIPAA) and the 21st Century Cures Act doesn’t pause just because the request for your patient’s records came from an attorney. responding to subpoena for medical records.
Knowing how to respond to a subpoena for medical records is not always black and white. Unfortunately, there is tons of grey, and the risk of making costly mistakes is high. You need to implement a process that outlines exactly how your practice handles responding to subpoenas for medical records. Healthcare attorney and Healthcare Training Leader expert, Lester J. Perling, JD, MHA, CHC recommends that you include the following key elements in your policy to be optimally protected:
Note: Be sure to periodically review this training so it’s fresh in the minds of your staff. Also, keep track of each time you conduct a staff training with a log of the date, time and everyone who was in attendance.
When responding to a subpoena for medical records, your safest bet is to obtain written authorization from the patient before releasing any of their PHI – EVERY SINGLE TIME. A patient may not always be willing to sign a release, but your efforts protect your practice. A patient’s signed authorization for records release keeps your practice HIPAA compliant. responding to subpoena for medical records
Note: If the patient refuses to authorize the release of their PHI when there is a subpoena involved, seek advice from an attorney knowledgeable in HIPAA law before sharing patient PHI.
It’s sometimes difficult to decipher if a subpoena for medical records is legitimate (meaning you are required to respond), and what your response obligation is. In general, your practice must provide an individual’s healthcare records to comply with a validly issued health care subpoena, pursuant to a search warrant, grand jury subpoena or court order. responding to subpoena for medical records
When deciding how to respond to a subpoena for medical records, look at who issued the request. Use the chart below as a key to help you determine your next step after receiving a subpoena for medical records. responding to subpoena for medical records.
If the subpoena is lacking in some way, you MUST NOT release your patient’s protected PHI. Instead, inform the requestor that there’s a problem. When communicating about this request, DO NOT divulge any patient information or even acknowledge that the person is your patient. All you can talk about is the subpoena’s inadequacy. Otherwise, you would be violating HIPAA’s Privacy Rule.
If you feel that the scope of the request for medical records is unreasonable, you can try to narrow the breadth of the subpoena by filing a motion with the judge. You should only take this action if you feel the information’s release would harm your patient.
In addition to responding to an information request with a problem notification, you should also contact your patient and notify them of the subpoena. You are required to make a “reasonable effort” to inform your patient about the subpoena, and of your obligation to respond unless they formally object. Your notification efforts can include calling, emailing, texting or mailing a letter to your patient. Whichever method(s) you use, be sure to document the format and date the notification was sent. It can also be beneficial to save a copy of the notification in the patient file. Ideally, the goal is to get the patient to sign a HIPAA release of information form.
Sometimes it’s difficult to tell a court-issued subpoena from an attorney-issued one – legalese all looks alike! A judge’s name and a signature will signify a court-issued document.
It can also be challenging to discern whether a subpoena is requesting medical records or is ordering you to testify in court. Become familiar with these legal terms that inform you of your obligations:
As mentioned above, be sure to have clear policies and procedures for your staff regarding how to respond to a medical records subpoena. This can really help you avoid costly mistakes and huge violation fines. Finally, contact an attorney if you have any questions or doubts about how to proceed.
Beware: There are other rules you must comply with when responding to requests for patient medical records beyond the ones outlined in this post. Requests for records can come from patients, custodial and noncustodial parents, schools, family members, other medical practices, attorneys, Judges, caregivers, payers, hospitals, etc. Each requesting source presents its own set of rules that you are REQUIRED to comply with.
Don’t end up with a violation! Learn how to protect your practice. Healthcare Training Leader expert, Lester J. Perling, JD, MHA, CHC, will walk you step-by-step through exactly how to respond to requests for patient medical records in his online training, Stop Costly Legal Errors When Responding to Medical Record Requests. Sign up for this online training today!
