Three Requests in One Afternoon: Subpoena, Divorced Parents, and an Instagram Photo
You are the hygienist and interim compliance lead at a two-dentist practice. Three requests land the same afternoon. First, a subpoena duces tecum from a plaintiff's attorney demands the complete chart of a patient suing over a root canal performed by the other dentist; it is signed by a deputy clerk and no patient authorization is attached. Second, the mother of a 16-year-old patient asks for copies of the chart; the parents are divorced, the father has joint legal custody, and he previously sent the office a written note saying nothing may be released to the mother. Third, the office manager wants to post a full-face before-and-after photo of a patient's smile on the practice Instagram account; the patient said 'sure, that's fine' over the phone. The dentist tells you, 'Just handle it.'
1. The subpoena. What may you release, and what has to happen first?
Read the worked answer
A subpoena is a demand from a court or an attorney - it is not patient authorization. Under HIPAA, disclosure in response to a subpoena is permitted only if one of these is true:
- the patient has signed a valid authorization; or
- the requesting party provides satisfactory assurances that a qualified protective order exists, or that reasonable efforts were made to notify the patient and give time to object; or
- a court order accompanies it.
So the chart does not go out this afternoon. Concretely:
- Verify the subpoena is valid and properly served, and calendar the response deadline - ignoring it has legal consequences.
- Notify the patient (or the patient's counsel) and allow the objection period unless a protective order is in place; document the notification.
- Release only what is requested - this patient's record, the relevant date range - not siblings, not the spouse, not unrelated charts stapled to the file.
- Keep a disclosure log and an exact copy of what was sent.
- Route it through the practice's attorney if there is any ambiguity.
Premature disclosure is a privacy violation and can support board discipline even when the underlying lawsuit is not the practice's fight. Altering anything in the chart before production is far worse.
2. The divorced parents with joint legal custody and a written objection from the father. What do you do?
Read the worked answer
Joint legal custody generally makes both parents personal representatives with a right of access to the minor's dental record, and a note from one parent does not unilaterally strip the other of that right. But you now have a written objection in the file, so you cannot simply hand over copies and hope.
The disciplined sequence:
- Ask for the custody order. Request the decree or any order addressing medical/dental records and decision-making. If it limits the mother's access, follow it and keep a copy in the chart.
- If the order is silent or ambiguous, do not let the front desk improvise and do not choose a side. Escalate to the dentist and to counsel for a decision on release versus a written explanation of what is needed.
- Communicate with both parents in writing, describe exactly what is required, and document the request, the objection, and the decision with dates.
- Apply minimum necessary: copies of the dental record - treatment notes, radiographs, treatment plans - not internal commentary or billing speculation.
A 16-year-old's record is still the parent's to request in ordinary dental care; this is not one of the sensitive-service situations where a minor consents alone. The risk here is procedural, not substantive: releasing over a documented objection without checking the order, or refusing a parent with equal legal authority, both create complaints.
3. The Instagram before-and-after photo. Is a verbal 'sure, that's fine' enough, and what should the practice do?
Read the worked answer
No. Verbal permission is not sufficient. A full-face before-and-after photo is individually identifiable - the patient's face and dentition are the identifying feature, and there is no realistic de-identification of a full-face image.
What is required:
- A written authorization that describes the information to be used, who may disclose it and to whom, the purpose, an expiration date, and the patient's right to revoke, signed and dated. A general consent-to-treatment form is not a marketing authorization.
- A process for honoring revocation later - if the patient withdraws permission, the post comes down.
- Compliance with the board's advertising rules: nothing false, misleading, or suggestive of guaranteed outcomes, and no patient testimonial used without proper consent.
What the practice should do right now: do not post. Prepare a specific photo-release authorization, explain to the patient what will be posted and where, get it signed, and only then publish. Adopt a written social media policy so the decision does not fall to whoever runs the account - and so staff know that clinical photos taken on personal phones are a records and confidentiality problem of their own. "Just handle it" is not an instruction that insulates anyone if the patient later objects.