Records Request and Subpoena for a Patient With Dementia
A woman presents with a signed release requesting copies of her 78-year-old father's progress notes from the past year. The father has a diagnosis of moderate Alzheimer disease; the chart contains no guardianship order or health care power of attorney. The daughter states she pays his bills and 'handles everything.' The father is a current patient and has not been declared incapacitated. The same afternoon, the clinic receives a subpoena duces tecum for the father's records in a civil lawsuit. The subpoena is signed by an attorney but is not accompanied by a court order or patient authorization. The clinic uses an electronic health record and has a 30-day response policy for record requests. The release form the daughter presents is signed by her, not by the father.
1. Can the MA release the father's records to the daughter? What must be verified?
Read the worked answer
Not on the basis of the daughter's statement alone. The father has not been declared incapacitated, and the chart contains no guardianship order or health care power of attorney. Under HIPAA, a personal representative can access records, but the clinic must verify that the daughter has legal authority. Paying bills does not create that authority.
The MA should check the chart for a signed authorization from the father, a durable power of attorney for health care, or a court-appointed guardianship. If the father has capacity, he can sign an authorization naming the daughter. If the daughter claims authority, ask for documentation and route it to the privacy officer. Do not release records while verification is pending. The release form signed by the daughter is not sufficient by itself.
2. How should the subpoena be handled?
Read the worked answer
A subpoena duces tecum is not automatically a valid authorization to release the full record. Route it to the privacy officer or legal counsel, verify the court, case number, and response date, and check whether the patient has been notified or a court order accompanies it. Many jurisdictions require a qualified protective order or patient authorization before records are released.
The MA should not release records or confirm their contents to the requesting attorney. Log the receipt, respond within the legal deadline, and release only the specific records ordered. If the subpoena is valid, the minimum necessary standard still applies. Do not ignore the subpoena, and do not treat it as equivalent to the daughter's request.
3. What should the MA document about both requests, and what communication is appropriate with the father?
Read the worked answer
Document the date and time of the daughter's request, the records requested, the verification attempted, and the reason for holding the release. For the subpoena, document the receipt date, sender, deadline, and referral to the privacy officer. Keep the two requests separate in the record.
Communicate with the father in a way he can understand: 'Your daughter asked for your records. We need your written permission or proof that she can act for you. You can sign this form if you want us to share them.' If he lacks capacity, follow the provider's and privacy officer's direction. Do not discuss the subpoena with the daughter unless she is authorized, and do not imply that the clinic has already released anything.