A Daughter, a Subpoena, and 5 pm
At 3:40 pm a woman calls saying she is the daughter of Mr. Chen, 82, a patient of the practice for 12 years. She says she has managed his affairs since his stroke and needs his whole file, everything, faxed to a new specialist by 5 pm today. She gives his date of birth, address, and the name of his cardiologist correctly. Mr. Chen's chart lists his son as healthcare proxy and contains a 2021 HIPAA authorization signed by Mr. Chen naming the daughter for appointment reminders and scheduling only. At 3:55 a fax arrives from a law office: a subpoena duces tecum for Mr. Chen's complete record with no patient authorization attached. The return date is three weeks away. The office manager has left for the day, the provider is with the last patient, and the fax machine sits in the front office where you are working.
1. What can you do about the daughter's request right now, and what has to happen before anything is released?
Read the worked answer
What the chart allows: the 2021 authorization covers appointment reminders and scheduling only. It is not authorization to release a medical record, and it certainly does not cover the whole file. A healthcare proxy designation is a state document that may or may not grant access to records, and it often takes effect only when the patient lacks capacity; either way, you are not the person to interpret it.
What you may do today: take a complete request in writing, confirm how to reach her, and tell her honestly that a full record release needs documentation the practice can verify and that you will not fax records at 5 pm on the strength of a scheduling authorization.
What has to happen first: a valid HIPAA authorization signed by the patient or by a verified personal representative, or a copy of a medical power of attorney or guardianship document that the practice can verify and file. Even then, release only what is requested and needed, not 'everything.'
Practical next step: offer to have the provider or office manager call her first thing the next morning, and offer to send the specialist a shorter, clearly authorized summary if the provider approves it. Do not confirm to her which family member is the proxy or discuss any family disagreement.
2. What do you do with the subpoena today?
Read the worked answer
Do not fax records. Do not ignore it. Do not shred it.
- Time-stamp and keep the fax cover sheet, the subpoena, and the envelope exactly as received.
- Write a short note of when it arrived and who found it, and deliver it to the office manager and the provider the same day, or leave it in the designated locked location with an urgent message if they have gone.
- Route it to whoever handles legal matters for the practice: the manager, a compliance officer, or the malpractice carrier. Many practices require attorney review before any response.
- Confirm receipt only. If the attorney's office calls, say the subpoena was received and forwarded, and give the name of the person who will respond. Do not confirm that Mr. Chen is a patient, do not describe the record, and do not estimate how many pages exist.
Why it is not an emergency: the return date is three weeks away, and a subpoena is not the same as a court order. Under HIPAA, disclosures in response to a subpoena generally require satisfactory assurances such as notice to the patient or a qualified protective order, and state law may add requirements. That analysis is for the practice's legal reviewer, not for the front desk at 4 pm on a Friday.
3. What do you say to the daughter and to the attorney's office, and how do you document the afternoon?
Read the worked answer
To the daughter: be warm and concrete. 'I understand this is time-sensitive. I am not able to fax records today, because the authorization we have on file covers scheduling and reminders, not the medical record. Here is what will work: a signed authorization from your father or a copy of the document that gives you authority to act for him. Bring or fax that, and our office manager will call you first thing tomorrow to get this moving.' Give a name and a time. Do not promise the 5 pm deadline, and do not blame the provider.
To the attorney's office: 'Your subpoena arrived at 3:55 pm and has been forwarded to our practice manager, who will respond in writing.' Nothing further.
Documentation for the afternoon: the time of the daughter's call, how you verified who she was, what she requested, what you disclosed (nothing), what you told her, and the name and time of anyone you escalated to. Then a separate log entry for the fax: time received, sender, what it requested, where the original is stored, and to whom it was routed. Keep both entries factual and free of commentary about the family. If the provider later decides to release anything, that authorization and the exact pages released should be documented too.