The Subpoena, the Divorced Parents, and the HIV Note
Sofia, age 16, is a patient at a Portland practice. Her parents are divorced and share legal custody. Her father, who has not brought her to appointments, arrives with a subpoena from his attorney in a custody modification case. The subpoena demands "all dental records, including any notes about mental health, substance use, and HIV status." The front desk also has a voicemail from Sofia's mother asking that the records not be released to the father. Sofia's record contains a note that she disclosed vaping and marijuana use and a positive HIV test documented after a separate written consent. The practice uses an EHR vendor that stores backups in another state. The office manager wants to copy the entire chart and hand it over because "a subpoena is a court order."
1. Is the subpoena the same as a court order? What must the practice do before releasing records?
Read the worked answer
No. A subpoena is typically a discovery request issued by an attorney or clerk, not a judge's order. HIPAA permits disclosure of protected health information in judicial or administrative proceedings only when the requesting party provides satisfactory assurances-such as written notice to the patient and a qualified protective order-or when a valid court order is presented. The practice should not hand over the entire chart on the strength of the subpoena alone.
The office manager should route the subpoena to the privacy officer or legal counsel, verify its validity, confirm the custody order, and check whether Sofia's mother has any legal basis to object. Because the parents share legal custody, either parent may generally access a minor's records, but Oregon allows minors to consent to certain services, and those records may carry additional confidentiality protection. Only the minimum necessary information responsive to a valid request should be released. The HIV information requires specific authorization under Oregon's HIV confidentiality law, and any substance-use treatment records may be separately protected.
2. How should the practice handle the mother's voicemail and the sensitive HIV and substance-use information?
Read the worked answer
A voicemail objection is not by itself a court order blocking release, but it is a warning sign that the practice should pause and verify the legal situation. The privacy officer should document the call, notify counsel, and respond to the subpoena with an objection or a request for a protective order if necessary. The practice should not let the father review the chart in the reception area or release records informally.
HIV status is specially protected under Oregon law and should not be released without a valid authorization or court order that specifically addresses it. The marijuana and vaping note may be relevant to dental care, but it should still be limited to what the subpoena validly demands. If the records include information from a federally assisted substance-use treatment program, additional federal rules may apply. The safest course is to release nothing until the legal basis and the scope of the request are confirmed.
3. What issues arise from the EHR vendor storing backups in another state, and what should the practice document?
Read the worked answer
Off-site storage does not change the practice's HIPAA obligations. The practice must have a business associate agreement with the EHR vendor, ensure reasonable safeguards, and be able to produce records in response to a valid request. The location of backups may matter for breach notification and state-law requirements, but it does not broaden the permissible grounds for disclosure.
The practice should document the subpoena received, the verification steps, the mother's objection, the custody documents reviewed, the legal advice obtained, exactly what was released, and to whom. If any unauthorized disclosure occurs, the privacy officer should assess whether breach notification is required. The key judgment is that a subpoena triggers a verification and minimum-necessary analysis, not automatic production of the entire chart.