Three Release-of-Information Requests in One Morning
At 9:00 a.m. the release-of-information desk receives three requests. (1) A plaintiff attorney serves a subpoena duces tecum for the complete record of a patient treated after a motor vehicle crash; the record includes behavioral health progress notes and psychotherapy notes. No patient authorization is attached, and no notice to the patient or protective order is documented. (2) A police officer presents a written request on department letterhead for that same patient's blood alcohol result from the night of the crash; there is no warrant, court order, or grand jury subpoena. (3) A woman identifying herself as the patient's adult daughter asks for the discharge summary and asks that the request be kept from her father. A technician hired three weeks ago asks whether she can process all three to avoid complaints.
1. Analyze each of the three requests and state what may be released today.
Read the worked answer
Request 1 - attorney subpoena: hold, do not release.
A subpoena is not by itself a permitted disclosure. The disclosure rules require satisfactory assurance, meaning either (a) documented notice to the patient with enough time to object, or (b) a qualified protective order. Neither is documented. Return a written deficiency letter and log it.
Even with satisfactory assurance, the scope is limited:
- Minimum necessary applies to the disclosure; release only records relevant to the crash and treatment at issue, not the entire chart by reflex.
- Psychotherapy notes carry a separate, higher authorization requirement and are generally not reachable through a routine subpoena response. Segregate them and route to counsel.
- Behavioral health and substance use disorder records may be protected more strictly by state law and by federal confidentiality rules for SUD treatment records. Verify before producing anything.
Request 2 - police letterhead: hold, escalate.
A written request on letterhead is not legal process. Law enforcement access generally requires a court order, warrant, grand jury subpoena, or an administrative request supported by legal process, with additional limits on identifying and locating individuals. Check whether state law independently mandates reporting of blood alcohol results in a DUI investigation - if so, that is a separate legally required disclosure with its own documentation, and legal should confirm it in writing.
Request 3 - adult daughter: do not release.
The patient has capacity and has not authorized disclosure. Do not confirm or deny that he is a patient. Explain the process, offer an authorization form for the patient to sign, and, if he consents, note whether he wants the daughter excluded.
2. What verification, documentation, and escalation steps should the technician complete for each request?
Read the worked answer
Verification
- Confirm the identity and authority of each requester: attorney identity and bar standing, subpoena validity and issuing jurisdiction, officer identity and badge, and daughter's identity plus any health care proxy or guardianship claim.
- Check the master patient index for the correct patient, including whether a confidentiality flag or sensitive-record flag exists.
Documentation
- Log all three requests in the disclosure log with date/time received, requester, scope, and disposition.
- For request 1, issue a written deficiency letter and retain the return receipt.
- For request 2, document the escalation in writing.
- For request 3, do not enter the request as a disclosure; note the inquiry only.
- Ensure the accounting-of-disclosures log is updated for any disclosure ultimately made outside treatment, payment, and operations.
Escalation and authority
- The technician should not decide any of these. Route all three to the privacy officer the same day; request 1 goes to counsel, request 2 to counsel plus compliance, request 3 stays with HIM.
- Release only on a signed release-of-information authorization approved by the privacy officer.
Coaching point: the technician's instinct to be helpful is the risk. Build a decision tree at the desk - authorization, legal process type, required assurances, sensitive categories, escalation - so the default is hold rather than release.
3. Leadership asks whether refusals will generate complaints and legal exposure. Frame the risk comparison.
Read the worked answer
Risks of releasing improperly
- A wrongful disclosure to an attorney without valid legal process is a reportable privacy breach, triggers notification and documentation obligations, and creates a private action and state AG exposure.
- Producing psychotherapy notes or SUD records without the correct authorization is a distinct, more serious violation.
- Telling an unauthorized family member about a patient's admission is a common, entirely preventable complaint with the same resolution cost as a clinical error.
Risks of refusing properly
- A complaint to the provider or a motion to compel. Both are manageable when the file contains a deficiency letter, a documented verification attempt, and a dated escalation.
- Delay cost in litigation, which is a legal problem with a legal remedy, not a reason to skip the assurance requirement.
The asymmetry is clear: a documented, prompt refusal is defensible; a well-intentioned release is not. Respond to complaints by explaining the regulatory requirement in writing and offering to expedite once the requester cures the deficiency. Escalate any request that appears to be a repeated pattern from one attorney or officer to compliance for tracking.