Release of Records When a Balance Is Owed, an Employer Requests Them, and a Subpoena Arrives

No. Under HIPAA's right of access and Indiana patient-access law, the patient is entitled to a copy of his protected health information, and the practice may not condition access on payment of an unrelated outstanding balance. The practice may charge a reasonable, cost-based fee for copying, labor, supplies, and postage, but a blanket $25 fee plus $0.75 per page may exceed what is permitted and should be recalculated under the applicable rule. If the patient requests an electronic copy and the record is maintained electronically, the practice should provide it in the requested electronic form. The contact lens prescription raises a separate duty: federal contact-lens rules require release of a valid prescription so the patient can shop elsewhere, and the practice may not require purchase from the practice as a condition of release. The practice should respond within the required time, preferably within 30 days, and document the request, the response, and any fee calculation. The unpaid bill can be pursued through ordinary collection channels, but not by denying access to the record.

The employer's request should be denied unless the patient signs a valid HIPAA authorization that identifies the employer and the information to be released. An employer does not gain access merely because it pays for insurance or because the job is safety-sensitive. If the patient authorizes release, the practice should release only the minimum necessary information, not the entire chart by default. The subpoena is not a court order and does not by itself authorize release. The practice should review the subpoena with counsel and determine whether the patient has authorized release, whether a qualified protective order is in place, or whether the issuing party has given the required notice and opportunity to object. The practice should not send records to the attorney on the same day the subpoena arrives. If the patient objects, the practice should await a court order. A subpoena for 'all records' should be narrowed to what is relevant and should not include unrelated sensitive information. Every disclosure should be logged in the accounting-of-disclosures record.

The policy should state that patients have a right to access their records and that access is not conditioned on payment. It should set a single person responsible for releases, a verification process for identity and authority, a fee schedule that follows the cost-based rule, and a deadline-tracking log. It should distinguish patient requests, third-party requests with authorization, subpoenas, and court orders, and require legal review of any compulsory process. The policy should require minimum-necessary review and documentation of every disclosure. The front-desk script should be simple: 'We will provide your records; the balance is handled separately. Please complete this request form so we can verify your identity and preferred format.' For third parties: 'We cannot release records without the patient's written authorization or a valid court order.' Staff should not improvise legal advice. The policy should be reviewed annually and should include training on HIPAA, Indiana access law, and contact-lens prescription release.