Subpoena, Broad Authorization, and Sensitive Records

No. A subpoena is not a court order, and a broad intake authorization is not a blank check. New Jersey confidentiality law and HIPAA require a valid, specific authorization that identifies the information to be released and the recipient, or a court order with appropriate protections. The authorization here-'any requesting party'-is overbroad and does not specifically authorize release of HIV status, psychiatric history, or domestic-violence information, each of which may have special protection. Even with valid authorization, Dr. Diaz should release only the minimum necessary information relevant to the workers' compensation claim, not the entire chart. The safer course is to review the subpoena, determine what is actually sought, contact the patient or counsel, redact unrelated sensitive information, and document the disclosure. If there is any doubt, Dr. Diaz should seek a protective order or legal advice rather than fax the full file. The disclosure may violate patient confidentiality and the Board's recordkeeping and ethics rules.

The current record is inadequate. A billing sheet and 'pt improved' do not document the initial examination, diagnosis, treatment plan, consent, or response to care. The Board expects records that identify the patient, date of service, presenting complaint, objective findings, assessment, treatment rendered, patient response, and any referrals or instructions. Without those elements, another provider cannot safely continue care and the Board cannot evaluate the quality of care. The destruction of records after five years is also problematic. New Jersey retention requirements generally require records to be kept for a defined period measured from the last date of service, and five years may be shorter than the Board's requirement, especially if the patient was a minor or the matter is under investigation. Dr. Diaz should not destroy records while a complaint or claim is pending. He should preserve all remaining records, reconstruct what he can from billing and scheduling data, and adopt a written retention policy.

He should not alter or destroy the existing record. He should secure the file, including the authorization, subpoena, fax cover sheet, and any response from the adjuster. He should notify his malpractice carrier and consult counsel about whether the disclosure triggers breach-notification or other legal obligations. He should contact the patient to explain what was disclosed, apologize if appropriate, and take reasonable steps to mitigate harm. He should request that the adjuster return or destroy the improperly disclosed sensitive information and confirm that in writing. He should implement a written release policy: verify the authorization or court order, limit disclosure to the minimum necessary, redact unrelated sensitive information, and log every disclosure. He should also review retention practices and stop any routine destruction. In responding to the Board, he should cooperate, provide the records, and explain corrective steps. Defensiveness or further disclosure would worsen the disciplinary exposure.