Three Record Requests for One Sixteen-Year-Old
The clinic receives three requests on the same morning for records of a 16-year-old patient: (a) a faxed subpoena duces tecum for the complete chart, signed by an attorney, with a court date in 10 days; (b) a signed authorization from the patient's non-custodial father requesting everything, including a note from a therapist; (c) a request from the patient herself asking that her visit notes not be shared with her mother, who is the policyholder and who calls weekly. The chart contains a psychotherapy note, an immunization record, and a positive STI test. State law allows minors to consent to STI testing; the parents are divorced with joint legal custody per the chart, but the mother has physical custody.
1. For each of the three requests, state whether release is permitted and what steps are required.
Read the worked answer
(a) Subpoena: a subpoena is not a court order and does not by itself authorize release. Verify it is valid for this jurisdiction and provider, log it, notify the patient or guardian and the clinic's compliance contact, and follow state law on the response window. Psychotherapy notes need a specific court order or a specific authorization.
(b) Father: joint legal custody generally gives access, but verify the custody order in the chart and check state law. Psychotherapy notes require a separate, specific authorization and cannot go out on a general one. The STI result is the harder question: if state law lets the minor consent to STI care, it may also limit a parent's access. Do not release that portion without compliance review.
(c) Patient: honor the restriction. Being the policyholder does not make the mother an authorized recipient of the record.
2. The mother calls and demands 'everything in my child's chart, I pay the premium.' How do you respond?
Read the worked answer
Explain calmly that being the policyholder is a payment relationship, not automatic access to the record, and that state minor-consent law may limit what can be shared. Offer to record a restriction request and to arrange confidential communication, such as an alternate address or phone, and ask whether the payer allows suppression of detail on the explanation of benefits.
Do not confirm or deny any specific visit or result on the call. Document the request, the time, and what you told her. If she asserts a legal right to the records, route it to the privacy officer with the custody documentation rather than deciding at the front desk. Keep the tone neutral; she may well have a legitimate parental role that the minor-consent rules partially override.
3. What documentation and deadlines must be tracked for these three requests?
Read the worked answer
Log each request separately: date received, requester and relationship, authority relied on, records requested, action taken, and date released or denied. Verify identity before anything moves, apply minimum necessary, and record any denial with its reason.
HIPAA allows 30 days with one 30-day extension and requires written notice if the extension is used; state law may be shorter, so follow the stricter limit. Track the subpoena's 10-day court date and confirm with counsel whether patient notice, a protective order, or a motion to quash is needed. Never release on a phone call, and never fax to a number that was not verified against the chart. Every entry should let a reviewer reconstruct exactly who asked, what was sent, and why.