Subpoena, HIV, and Part 2 Records in Workers' Compensation
A hospital's release-of-information clerk receives a fax from an attorney representing the patient's employer in a workers' compensation dispute. It includes a subpoena duces tecum for 'all medical records, including mental health and substance use treatment,' and a signed patient authorization. The patient is a 41-year-old truck driver treated after a motor vehicle accident. The record contains HIV status, treatment at a federally assisted opioid treatment program under 42 CFR Part 2, psychiatric notes, and general orthopedic records. The authorization lists 'all records' and expiration 'upon resolution of case.' It does not specifically mention HIV, mental health, or substance use. The subpoena is signed by a court clerk but not a judge, and no court order. The clerk wants to release the entire record to avoid contempt. A state law requires patient authorization for HIV disclosure and has stricter mental health confidentiality.
1. What can be released in response to this request, and what must be withheld or require additional authorization?
Read the worked answer
Release only the minimum necessary orthopedic records relevant to the workers' compensation injury, and only if the authorization and state workers' compensation rules permit it. Do not release the entire record. HIV information requires specific authorization under state law; a general 'all records' authorization is not enough. Mental health records may require a separate specific authorization under state law, and HIPAA requires a separate authorization for psychotherapy notes if they are maintained separately. The 42 CFR Part 2 opioid treatment records require a special written consent that identifies the program, the recipient, the purpose, the specific information, the expiration, and the patient's right to revoke. A subpoena signed by a clerk is not a court order and does not satisfy Part 2. For HIPAA, a subpoena requires satisfactory assurances: notice to the patient and time to object, or a qualified protective order. None is present. The clerk should withhold HIV, Part 2, and psychiatric records, and seek legal review before releasing even the orthopedic records if the authorization is ambiguous.
2. How should the clerk handle the subpoena and the risk of contempt?
Read the worked answer
Do not ignore the subpoena, but do not comply by releasing protected records. Send a timely written response to the attorney and the court explaining that the subpoena is not accompanied by a court order or the required HIPAA assurances, that the authorization does not meet state law or 42 CFR Part 2 requirements, and that the hospital will comply with a valid order. Notify the patient and, if appropriate, the treating providers. Consult legal counsel immediately. The clerk should document the date, time, and content of the request and all responses. If a judge later issues an order, release only what the order specifically requires and use the minimum necessary. Contempt risk is managed through legal process, not by an unauthorized disclosure. For Part 2 records, a court order must include good cause and appropriate safeguards; a subpoena alone is insufficient. The hospital should also check whether workers' compensation law independently authorizes release of relevant records, but that does not override federal Part 2 or state HIV confidentiality.
3. What privacy principles apply to the authorization's scope and expiration?
Read the worked answer
Under HIPAA, a valid authorization must describe the information to be used or disclosed in specific terms, identify the recipient, state the purpose, include an expiration date or event, be signed and dated, advise the patient of the right to revoke, and warn about redisclosure. 'All records' is broad and may not satisfy the specificity required by state law or Part 2. 'Upon resolution of the case' can be an acceptable expiration event if it is clear, but the authorization should define it. The patient must receive a copy. The authorization can be revoked in writing, except to the extent the hospital has already acted. For HIV and mental health, state law may require separate, specific consent; for Part 2, a separate consent is required and must include the specific elements. If the authorization is defective, the clerk should not rely on it and should request a corrected authorization. The privacy principle is minimum necessary: even with a valid authorization, release only what is needed for the stated purpose.