Subpoena, a Mother, a Vendor, and No Risk Analysis
A patient's attorney serves a subpoena duces tecum on a 25-employee practice for the complete record of a 34-year-old patient injured in a car accident. The subpoena is signed by the attorney, is not accompanied by a court order, and contains no assurance that the patient was notified; it demands production in 10 days. The record includes two years of psychotherapy notes from an outside therapist that the patient had scanned in, plus HIV test results. That same week, the patient's mother calls asking for 'everything, I'm his mother,' and a vendor offering free glucose meters asks for a list of the practice's diabetic patients. The practice submits claims electronically, has never performed a security risk analysis, and has no business associate agreements with its offshore transcription vendor.
1. Can the practice produce the record in 10 days? What may or must be withheld?
Read the worked answer
No - not as served. An attorney-signed subpoena without a court order is not, by itself, sufficient authority to disclose protected health information. HIPAA requires either:
- satisfactory assurance that the individual has been notified and given time to object (typically a written statement and documentation of the notice), or
- a qualified protective order.
Response: send a written reply to the attorney stating what is required, and note that the 10-day demand is not a court order and does not override the legal requirements. Confirm the notice/order before producing anything. Consider notifying the patient directly if contact information is valid - that also supports the assurance route.
What to withhold or handle separately:
- Psychotherapy notes: these require a specific, separate authorization from the patient even for many treatment disclosures, and an attorney's subpoena does not substitute. Withhold absent a patient authorization or a court order that specifically addresses them.
- HIV test results: state law frequently imposes a stricter consent standard than HIPAA; verify state requirements before release.
- Everything else: apply minimum necessary - produce the records relevant to the accident and the body systems at issue, not the entire chart by default.
- Log the disclosure in the accounting-of-disclosures record, including what was withheld and why.
2. How do you handle the mother's request and the glucose-meter vendor's request?
Read the worked answer
The mother: the patient is 34 and there is no indication of incapacity. A parent is not a personal representative of an adult competent patient without a valid personal representative designation, health care power of attorney, or guardianship documentation. Do not release the record. You may take a message, confirm the patient's preferred contact method, and invite the patient to authorize the disclosure in writing. Even a family member calling about billing is limited to information the patient has agreed may be shared.
The vendor: a list of patients with diabetes compiled for a third party's free-meter promotion is a disclosure for marketing, and marketing use or disclosure of PHI requires the patient's written authorization. A business associate agreement is not a workaround - a BA relationship covers a vendor performing a function for the practice, not a vendor using patient lists to promote its own product. Also flag:
- Minimum necessary: a diagnosis-based list is about as broad as it gets.
- If the practice receives anything of value in exchange, screen it against the civil monetary penalty/Anti-Kickback beneficiary-inducement rules before proceeding.
Answer to both: no disclosure without a signed, specific authorization; route the vendor request to compliance and counsel rather than answering it at the front desk.
3. What is the compliance exposure here, and what should be fixed first?
Read the worked answer
Exposure, in rough priority:
- Missing business associate agreements with the transcription vendor. A vendor that transcribes for the practice and touches PHI is a business associate, and offshore location does not change that. Each arrangement needs a written BAA. This is a straightforward, citable violation.
- No security risk analysis. An accurate, thorough, and enterprise-wide risk analysis is a core administrative safeguard under the Security Rule, and its absence is one of the most commonly cited findings in enforcement actions. Related gaps usually follow: no designated security officer, no documented risk management plan, no workforce training.
- The subpoena handling itself - if anyone produced records before the assurance or order, that is a potential impermissible disclosure and requires a breach risk assessment (nature and extent of PHI, recipient, whether it was actually acquired or viewed).
Fix in this order:
- Stop the bleeding: confirm no further transcription work proceeds until BAAs are executed; hold the subpoena response until the assurance or order is in hand.
- Perform the risk analysis and write a risk management plan with owners and dates - not a template downloaded and filed.
- Designate a privacy/security officer, adopt a written release-of-information policy with an escalation path for subpoenas and family requests, and retrain front-desk staff.
- Document everything, and route the whole package to counsel; state law may add requirements beyond HIPAA.