A process server hands your front desk an envelope. Inside is a subpoena for a patient's complete chart. Practices get this wrong in two opposite directions: some mail the chart the same day, and some stick the envelope in a drawer and hope it goes away. Both are mistakes. The first can be an impermissible disclosure. The second can be contempt of court.
HIPAA's answer lives in 45 CFR 164.512(e) for lawsuits and 164.512(f) for law enforcement, and it sorts every request into a small number of buckets. Here they are, in the order your front desk will meet them.
The HIPAA Subpoena Analysis, Bucket by Bucket
Bucket 1: An Order Signed by a Judge
A court order, or a subpoena signed by a judge or magistrate, is the strong form. HIPAA permits disclosure in response to it, with one instruction: disclose "only the protected health information expressly authorized by such order." Read the order, produce exactly what it names, nothing more. The complete chart goes only if the order says the complete chart.
Bucket 2: An Attorney Subpoena, Not Signed by a Judge
Most subpoenas in civil cases are issued by attorneys, not judges. Under 164.512(e), that document alone is not enough. Before you can comply, you need "satisfactory assurances," in writing, from the party seeking the records, showing one of two things:
1. The patient was notified of the request, had time to object, and either did not object or lost the objection. Or:
2. The parties have agreed to, or asked the court for, a qualified protective order: an order restricting the records to the litigation and requiring their return or destruction at the end.
No assurances attached? You do not ignore the subpoena, and you do not comply with it yet. You respond to the issuing attorney: "HIPAA requires satisfactory assurances under 45 CFR 164.512(e) before we can produce records. Please provide them." Litigation attorneys handle this letter routinely. The rule also lets you skip waiting and provide the notice or seek the protective order yourself, but for a small practice, putting the burden back on the requester is the sane default.
Bucket 3: Law Enforcement
Police and investigators run under 164.512(f), which is its own list. With a court order, warrant, or a subpoena issued by a judicial officer or grand jury, disclosure is permitted. An administrative request, such as an investigative demand without a court behind it, works only if it certifies that the information is relevant and material, the request is specific and limited, and de-identified information would not suffice.
For identifying or locating a suspect, fugitive, witness, or missing person, HIPAA permits only a short list of identifiers: name, address, date of birth, and similar demographic facts. Not diagnosis. Not treatment details. A badge at the front desk is a reason to get the practice manager, not a reason to open the chart. Train the desk to say one sentence: "Our privacy officer handles all record requests, let me get them."
Two Overlays That Change the Answer
First, permitted is not required. Nearly everything in 164.512 says a practice "may" disclose, not "must." Absent a judge's order compelling you, you retain discretion, and exercising it conservatively is rarely the wrong call.
Second, state law sits on top. State privilege law, and stricter state privacy statutes, can block disclosures HIPAA would permit, particularly for mental health, HIV, and substance use records, where 42 CFR Part 2 adds a federal layer of its own. The relationship between privilege and HIPAA is covered in the doctor-patient confidentiality comparison. When the request touches any sensitive category, the analysis belongs with counsel, not the front desk.
The Office Workflow
Five steps, one page. Log the request the day it arrives, with the response deadline on a calendar. Route it to one owner, the privacy officer. Sort it into a bucket: judge-signed, attorney subpoena, law enforcement, or none of the above. For anything beyond a clean bucket-one order, call your attorney or malpractice carrier; many carriers run a risk-management line for exactly this question. And always respond by the deadline, even when the response is "we require satisfactory assurances." Responding is not the same as disclosing, and the practices that get hurt are the ones that confused the two, in either direction.
---
FAQ
Do we have to comply with every subpoena for medical records?
No. A subpoena signed only by an attorney requires written satisfactory assurances under 45 CFR 164.512(e) before HIPAA permits disclosure. But you must always respond by the deadline; ignoring a subpoena risks contempt.
Can police see a patient's record if they show up with a badge?
Not on the badge alone. Law enforcement disclosures under 164.512(f) require a court order, warrant, judicial subpoena, or a qualifying administrative request. For locating a person, only limited identifiers may be shared, never diagnosis or treatment details.
Does the patient have to be notified about a subpoena?
For attorney subpoenas, the satisfactory-assurance route most commonly used requires proof the patient was notified and given time to object, or a qualified protective order in its place.
What is a qualified protective order?
A court order or stipulation that prohibits use of the records outside the litigation and requires their return or destruction when the case ends. It is one of the two forms of satisfactory assurance under 164.512(e).
Should we produce the entire chart when a subpoena asks for it?
Produce what the document actually compels and no more. With a court order, disclose only what the order expressly authorizes. Minimum necessary thinking applies to everything outside a direct court command.
Conclusion
The subpoena workflow is a one-page policy plus a phone number for counsel, and it is the difference between a calm response and a disclosure you cannot take back. One Guy Consulting's Full-Scope plan includes the policy and the consulting hours to walk through real requests as they arrive. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.512(e) and (f) (judicial, administrative, and law enforcement disclosures)
- HHS FAQ: court orders and subpoenas
Related Reading