A Parent Demands a Minor's Records, Then a Subpoena Arrives
The office receives a phone call from the mother of a 16-year-old patient. The daughter was seen nine days ago, and the encounter included a pregnancy test and treatment for a sexually transmitted infection. The mother says she pays the bill, that she is 'entitled to see everything,' and demands that the entire record be faxed to her that day. No signed authorization is on file. In this state, minors may consent to their own diagnosis and treatment of sexually transmitted infections, and records of that care may be kept confidential from parents. The practice manager is at lunch, and the front desk has already pulled the chart. Twenty minutes later a fax arrives: a subpoena duces tecum from an attorney representing the parents in an unrelated custody matter, requesting 'all records' for the same patient.
1. What do you say to the mother on the phone, and what do you do with the pulled chart?
Read the worked answer
Verify identity, then decline to act. Confirm who is calling and the patient's name and date of birth, but do not confirm what the visit was for, what tests were done, or even that the visit occurred - confirming the fact of an encounter is itself a disclosure. A safe script: 'I'm not able to release records or discuss the visit over the phone. I'll take your request in writing and have our privacy officer respond.'
Take the request in writing - fax, mail, or portal message - and log the date, time, caller, and exactly what was requested.
Do not fax anything, and return the chart to a secure location. The decision is not an MA decision, and it is not a coin flip: HIPAA generally treats a parent as a minor's personal representative, but that status does not extend to care the minor lawfully consented to herself. Because state law governs here and the exception applies, this needs the privacy officer or practice manager plus, ideally, a call to counsel before anything is released. The mother's financial argument does not create a right of access.
Tell no one else in the waiting room or on staff the substance of the call.
2. How do you handle the subpoena? Is an attorney's subpoena sufficient authority to release the records?
Read the worked answer
No - not by itself, in most circumstances. A subpoena duces tecum signed by an attorney is a litigation request, not a court order. Releasing protected health information in response requires one of: a valid patient authorization, a court order, or a subpoena accompanied by satisfactory assurance that the patient has been notified and given an opportunity to object (a qualified protective order). The exact requirements are state-specific, which is why the practice needs a documented procedure and legal review rather than an improvisation at the front desk.
Practical steps: do not alter, amend, or destroy anything; note the date and time of receipt and preserve the fax; route it immediately to the practice manager and physician; contact the practice's attorney before the response deadline. Calendar the deadline so it cannot lapse by inattention.
Note the conflict of interest: the parents are adverse to the daughter in a custody dispute. The 16-year-old lawfully consented to this care, and her interests are not represented by the parents' attorney. Counsel will need to consider notifying the patient - or her own representative - and seeking guidance from the court. That judgment is far above an MA's authority, and the correct professional action is to escalate promptly and document that you did.
3. What documentation should be created for both requests, and what are the practical privacy pitfalls to avoid while this is pending?
Read the worked answer
Create a disclosure/request log entry for each contact: date and time received, method (phone, fax), the identity of the requester and how identity was verified, precisely what was requested, what was released (nothing, in both cases) and by whom the decision was made, and each internal referral with a time. For the subpoena, log that it was received and forwarded to counsel and record the response deadline.
Pitfalls:
- Returning a call and leaving a voicemail that references the visit or the tests.
- Discussing the request in a hallway, at the front desk within earshot, or on a staff group chat.
- Faxing to a number supplied only verbally, or to a number not verified against the record - fax misdirection is a classic breach.
- Confirming to the attorney's office over the phone anything about the patient or the chart.
- Altering the record in any way to 'protect' the patient. Never amend; add an addendum only if a factual correction is needed, and say why.
If the staff later discovers that anything was released in error, report it up the chain immediately - the practice's breach-notification clock may start on discovery, not on the mistake.