A Subpoena, a Seventeen-Year-Old, and Fourteen Pages
Priya is the hygiene coordinator at a three-dentist practice and, by written delegation, handles record requests. Mia, age 17, has been a patient for three years. Her parents divorced; the custody order gives joint legal custody and mother physical custody, and both parents signed the practice's financial agreement. On Tuesday Mia's mother submits a signed request for a complete copy of the record, including a note in which Mia disclosed self-induced vomiting after meals and was referred to her pediatrician, and a note documenting a conversation about a pregnancy test. On Wednesday the practice receives a subpoena duces tecum signed by the father's attorney demanding 'any and all records' in ten days. On Thursday Mia asks Priya not to show her mother 'the referral note.' Also that week an insurer requests the last two years of radiographs and notes for a claim, and the office manager asks Priya to 'tidy up' a note that miscoded a restoration.
1. How should Priya handle the mother's request for the complete record, including the sensitive notes?
Read the worked answer
Do not release unilaterally. Priya is a delegate, not the records custodian; the treating dentist owns the release decision and should be the one to make it, with counsel if the answer is unclear.
The ordinary rule and its exception. A parent with legal custody is generally the minor's personal representative for record access. But state minor-consent law can make certain categories of care - mental health, substance use, reproductive health - accessible to the minor alone, and HIPAA defers to that state law. An eating-disorder disclosure made to a dental hygienist is probably not automatically in a protected category, but it may be, and the pregnancy-test conversation is exactly the kind of note where a provider may reasonably conclude disclosure would deter the minor from seeking care.
Practical sequence. Verify the custody order. Provide the routine clinical record promptly (radiographs, charting, treatment notes). Segregate the two sensitive entries, obtain the dentist's documented decision, and if any portion is withheld, say so in writing with the legal basis rather than silently omitting pages. Silent omission is what turns a records request into a board complaint.
2. What is the correct response to the attorney's subpoena, and how does it differ from a court order?
Read the worked answer
A subpoena signed by an attorney is not a court order. Under HIPAA, disclosure in response to a subpoena generally requires satisfactory assurances that the patient has been notified and a reasonable opportunity to object, or a qualified protective order. A judge's order or a court-ordered warrant is a different, stronger instrument.
Steps. Log receipt and the ten-day return date. Notify the patient and, for a minor, the appropriate parent or guardian unless doing so is contraindicated. Contact the requesting attorney to narrow 'any and all records' to what is actually relevant, and to obtain written satisfactory assurances or a protective order. If the demand is facially overbroad, the practice may seek guidance from the court rather than produce everything.
Do not do this: do not produce the entire chart by the deadline to avoid conflict, and do not ignore the subpoena. Both responses create independent liability. Produce only after the legal predicate is satisfied, and keep a copy of exactly what was sent.
3. What should Priya do about Mia's request and about the office manager's instruction to 'tidy up' the miscoded note?
Read the worked answer
Mia's request. Acknowledge it, do not promise to conceal anything, and do not overrule the custodian. The minor's wishes are a serious consideration under state minor-consent rules and can support partial withholding where the law protects the category; they are not a veto over a parent's access to the rest of the record. Explain to Mia, in age-appropriate terms, what will be released and what is being reviewed, and document that conversation.
The miscoded note. Correct errors only through an addendum or correction entry that preserves the original text, who changed it, when, and why. Never overwrite or backdate. Altering a record after a billing error is discovered converts a clerical mistake into a potential fraud and falsification issue - for the person who edits it as much as for the practice. Priya should decline, state the compliant alternative in writing, and keep that message.
Insurer request. Release only what the authorization covers, confirm the authorization is valid and current, and log the disclosure as HIPAA accounting-of-disclosures requires.