Subpoena for the Complete Chart: Authorization, Privilege, and Overproduction
Dr. Alvarez, an orthopaedic surgeon, treated Mateo R. for a tibial plateau fracture after a 2023 motorcycle collision. Mateo sued the other driver. Eight months ago Mateo signed a HIPAA authorization permitting release of 'complete medical records' to his own attorney; it has no expiration date. Today Dr. Alvarez's office receives a subpoena duces tecum from defense counsel with a return date 12 days away. It demands 'any and all records, including the entire chart, billing statements, emails with plaintiff's counsel, and the internal peer-review file concerning a postoperative infection.' The chart includes a note from a substance-use treatment center and a quality-assurance review in which a colleague questioned Dr. Alvarez's fixation choice. The patient has not been notified. The office manager wants to copy everything to avoid contempt.
1. May Dr. Alvarez produce records in response to the subpoena based on the existing authorization? What steps are required before any release?
Read the worked answer
The existing authorization does not authorize this disclosure. It identifies Mateo's own attorney as the recipient and was not signed for release to defense counsel. A HIPAA authorization is purpose- and recipient-specific; it cannot be treated as a blanket waiver.
HIPAA permits disclosure in a judicial proceeding under 45 CFR 164.512(e) only with a court order, or with a subpoena plus satisfactory assurances, such as a protective order or notice to the patient so an objection can be raised. State law may impose additional requirements. Dr. Alvarez should verify the subpoena's authenticity, issuing court, patient identity, and scope; notify the patient and plaintiff's counsel; and send a written objection or request for a protective order before the return date. He should not ignore the deadline, but he also should not copy the entire chart. The office manager should be told that timely legal objection, not overproduction, is how contempt risk is managed.
2. How should the peer-review file and the substance-use note be handled?
Read the worked answer
They should be segregated and reviewed by counsel before any production.
Peer-review and quality-assurance materials are privileged in many states when created for internal review purposes. The privilege belongs to the committee or institution and may be waived by disclosure. Dr. Alvarez should assert the privilege in writing, produce a privilege log identifying the document and basis, and seek a court ruling if defense counsel disputes it.
The substance-use treatment note is likely protected by 42 CFR Part 2, which requires specific written consent or a court order meeting federal requirements; a general HIPAA authorization is not enough. It should not be released absent compliant consent or an order. Billing records are generally producible, but unrelated financial information should be redacted. Emails with plaintiff's counsel should be reviewed individually; they may contain patient communications or privileged material. The safest course is to produce only responsive, non-privileged records after legal review and to document every withholding.
3. Draft a practical response timeline and explain what to tell the office manager.
Read the worked answer
Days 0-2: do not copy or release anything; route the subpoena to counsel; confirm the return date and whether any extension is available. Days 2-5: notify the patient and plaintiff's counsel in writing; assert objections and privileges; request a protective order or written agreement limiting scope. Days 5-10: assemble only responsive records; prepare a privilege log; redact protected substance-use information; obtain a records-custodian certification. By the return date: produce non-privileged records or file the objection/protective-order motion; request an extension if the court has not ruled.
The office manager should understand that copying everything can waive privilege, violate 42 CFR Part 2, and expose the practice to sanctions. A short written office protocol should identify who receives subpoenas, who contacts counsel, and who signs certifications. All communications should be documented.