The Mother, the Subpoena, and the Story Post
A 34-year-old patient fills buprenorphine/naloxone every 28 days at a Nevada pharmacy and has told staff more than once that no one is to be told about her treatment. On Tuesday, three things happen within an hour. Her mother calls and says, "I'm her emergency contact and I pay her rent - is she still on that drug? I need to know if she's using again." Then a process server delivers a subpoena duces tecum from an attorney in a car-accident lawsuit demanding "all prescription records" for the patient; there is no patient authorization and no court order. Finally, a technician shows a coworker a photo on her phone of the patient's prescription label - the technician posted it that morning to a private social media story captioned "the things I see at work," and the coworker is now telling the pharmacist.
1. What should the pharmacist do with the subpoena?
Read the worked answer
A subpoena is a request, not an authorization, and it is not self-executing. HIPAA permits disclosure in response to a subpoena only when the requesting party provides satisfactory assurances that the patient has been notified and given a chance to object, or that a qualified protective order is in place (45 CFR 164.512(e)). Nothing in this delivery shows that. The pharmacist should not hand over records or read them to the caller; the process server gets nothing at the counter. Route the subpoena to the pharmacy's legal counsel or privacy officer the same day, note the date, time, and who served it, and preserve the document. Counsel will typically contact the attorney, request the required assurances, or seek guidance on state law, which may impose its own notice requirements. In many cases the patient herself is the best source of authorization and she can be asked to sign a HIPAA-compliant authorization if she wants the records released. Buprenorphine records are especially sensitive - they can carry substance use disorder implications - so err toward narrow disclosure limited to what is actually demanded.
2. The technician's social media post: what is this, and what must the pharmacy do?
Read the worked answer
It is a reportable breach of unsecured protected health information. The label almost certainly showed the patient's name, drug, directions, and possibly the prescriber - enough to identify her and reveal that she is being treated with a medication for opioid use disorder. Posting it is an unauthorized disclosure even if the "story" was shared with a small audience and expired, because there is no permitted purpose. Steps: have the technician delete the post immediately and preserve evidence (screenshots, timestamps) before deletion; determine who viewed it; investigate scope; conduct the four-factor breach risk assessment; notify the patient in writing within 60 days describing what happened and what is being done; document everything. Because this affects one individual, it is logged and reported to HHS OCR on the annual log rather than the 500-plus immediate report, but an internal report to the privacy officer is immediate. Also review Nevada breach-notification obligations and state board reporting, and impose consistent discipline and retraining. The coworker who saw the post needs a clear instruction not to further distribute it.