Subpoena for Medical Records: What Your Front Desk Does First

A courier drops an envelope at the front desk, or a fax lands with SUBPOENA DUCES TECUM across the top, demanding a patient's records by a production date already printed on the page. The person who receives it wants to help, so the instinct is to pull the chart and send it. Under HIPAA, that instinct is where the risk starts.

The Privacy Rule splits these demands at 45 CFR 164.512(e). A judge's or tribunal's order lets you release what it expressly names. A subpoena signed by an attorney or a court clerk, with no order behind it, needs written proof first that the patient had notice and a chance to object, or that a qualified protective order is in place. As HHS puts it, a subpoena issued by someone other than a judge "is different from a court order."

Routine patient requests, the 30-day access clock and fees are covered in the records-release workflow for routine requests, which hands subpoenas to a named privacy contact. This post is that contact's playbook. It is general information, not legal advice, and state rules differ, so have counsel confirm your procedure before you adopt it.

What should the front desk do when a subpoena arrives?

Receive it, date-stamp it, and hand it to your privacy official the same day. The front desk does not pull the chart, answer the attorney's questions, or confirm that the person named is a patient. Its job is a clean intake: the document, when it arrived, how it came, and the production date.

Every covered entity must designate a privacy official under 45 CFR 164.530(a)(1)(i), so the routing target already exists. Name a backup in writing, so a subpoena never waits a week in a shared inbox.

Capture these fields at intake:

• The sender, with a callback number, and the case name, court and case number
• The patient named, and the date range and record types requested
• The production date, sometimes called the return date
• Who signed it: a judge, a tribunal, a clerk or an attorney
• What came with it: a patient authorization, a notice letter, a protective order, or nothing

The deadline is not the patient-access clock. The 30-day rule in 45 CFR 164.524 governs a patient asking for their own records. A subpoena carries its own date, set by the court's rules, and it can be shorter, so log it the day the envelope opens.

Phone calls need a script too. A paralegal may call to "just confirm" that someone is your patient. Saying yes tells a stranger that the person received care from you, which is health information. The answer every time: the privacy official will respond in writing.

The front desk owns intake and routing. Everything after the signature check belongs to the privacy official.

One exception changes the track. If your practice is a party to the lawsuit, HHS treats using records for that litigation as part of the practice's health care operations. That goes to whoever is defending the practice, not through this process.

Court order or subpoena: who signed it decides what you may release

Look at the signature line first. An order signed by a judge or an administrative tribunal lets you release only what it expressly names. A subpoena or discovery request signed by an attorney or clerk, with no order attached, needs written satisfactory assurance before anything leaves. A patient-signed authorization follows separate rules.

The court order path is 45 CFR 164.512(e)(1)(i). HHS's FAQ repeats the limit: disclosures "must be limited to the protected health information expressly authorized by the order." If an order names lab results from 2024, the 2023 visit notes stay in the chart.

The subpoena path is 164.512(e)(1)(ii). It covers a subpoena, a discovery request or "other lawful process" not accompanied by an order of a court or administrative tribunal. A court caption and a clerk's stamp do not turn a subpoena into an order.

A third route often arrives stapled to the subpoena: a HIPAA authorization signed by the patient. When it is valid, the release happens under 45 CFR 164.508, stays within what the patient authorized, and drops out of the accounting log.

What satisfactory assurance has to show

Satisfactory assurance is a written statement plus documentation from the requester, in 1 of 2 forms. Either the patient got written notice detailed enough to object and the objection window closed with nothing unresolved, or the parties agreed to or requested a qualified protective order. Find one of them before anything leaves.

The notice route has 3 elements under 164.512(e)(1)(iii), and the requester must document each:

1. A good faith attempt to give the patient written notice, or, if the patient cannot be located, to mail it to the last known address.
2. The notice described the case well enough for the patient to object to the court.
3. The time to object has passed, and no objection was filed, or every objection was resolved and the request matches the resolution.

HHS has answered the two questions that come up most. Notice to the patient's lawyer counts as notice to the patient. And the subpoena alone is enough when it shows the elements on its face: the patient is a party, notice went to the patient or their attorney, and the objection period ran out with nothing pending.

The protective order route is simpler. The requester shows the parties agreed to a qualified protective order and presented it to the court, or asked the court for one. The order must bar use of the records outside that case and require their return or destruction, copies included, when it ends. Under 164.512(e)(1)(vi), your practice may also make the notice effort or seek the order itself.

HHS has shown what the fix looks like. In one OCR case example, a public hospital released a patient's records under a subpoena with no court order and no assurance. OCR required a revised procedure: a subpoena missing the Privacy Rule's requirements gets no records, the hospital explains those requirements to the requester, and staff are trained on it.

Your hold letter can be short: "We received your subpoena for the records of [patient] on [date]. Under 45 CFR 164.512(e), we need written documentation that the patient received notice and the objection period has passed, or a qualified protective order. We will respond once we receive either."

Minimum necessary applies to a subpoena too

A subpoena is not permission to send the whole chart. HHS says a practice must make reasonable efforts to limit a subpoena release to the minimum necessary to respond. A court order is narrower: release only what it expressly authorizes. An "any and all records" demand needs a scope review.

HHS's FAQ on subpoenas cites 45 CFR 164.502(b) and 164.514(d), and two parts of 164.514(d) do most of the work.

The first is the entire-record rule at 164.514(d)(5): a covered entity "may not use, disclose or request an entire medical record, except when the entire medical record is specifically justified" as the amount reasonably needed. A subpoena for all records raises that question, and somebody has to decide it in writing.

The second is the short list of requesters whose request you may treat as the minimum necessary, at 164.514(d)(3)(iii): public officials who say so, another covered entity, your own workforce or business associate professionals, and certain researchers. A private attorney is not on it. So the practice reviews scope itself, request by request, against written criteria.

Take a lawsuit over a 2025 car accident. The subpoena asks for every record of a patient seen since 2016, and the notice paperwork is complete. The review compares the request with the chart: the date range, the record types, whether billing ledgers were asked for, and whether anything belongs to someone else, such as a family member's details. The privacy official decides what goes and records why. Narrowing a demand for the full chart is for the requester or the court, not a clerk on a deadline.

Minimum necessary does not apply to a release under the patient's own authorization, where the authorization's terms govern, or to a disclosure required by law under 164.512(a), per 164.502(b)(2).

Records a subpoena alone does not unlock

Some records need more than satisfactory assurance. Psychotherapy notes need the patient's authorization. Substance use disorder records from a Part 2 program need patient consent or a specific court order. State law can add conditions on top of HIPAA. The 2024 reproductive health attestation was vacated in June 2025.

Psychotherapy notes have their own rule at 45 CFR 164.508(a)(2): any use or disclosure needs the patient's authorization, apart from a short list of exceptions that leaves out 164.512(e). The definition in 164.501 is narrow: a mental health professional's notes on a counseling session, kept separate from the rest of the record. Medication records, session times, test results and summaries of diagnosis and progress are not psychotherapy notes. An order that names the notes goes straight to the privacy official.

Part 2 records are stricter again. 42 CFR 2.61 gives the example: a holder that receives a subpoena "may not use or disclose the records in response to the subpoena unless a court of competent jurisdiction enters an authorizing order." That order authorizes the release but does not compel it, so the requester needs both the order and a subpoena. Under 2.64, which covers civil, administrative and legislative cases, the patient and the holder must get notice, the court must find good cause, and the order must limit the release to the parts of the record essential to its purpose.

The February 2024 Part 2 final rule, at 89 FR 12472 with a compliance date of February 16, 2026, widened this. The bar now covers administrative and legislative proceedings as well as civil and criminal ones, and it reaches testimony about a record. Consent for use in a proceeding cannot be combined with consent for anything else, under 2.31(d). And under 2.12(d)(1), the bar on using a record in proceedings against the patient follows the record to whoever receives it.

The general chart follows the subpoena rule. Psychotherapy notes, Part 2 records and some state laws ask for more.

Reproductive health records went through a rule and its reversal. The April 2024 reproductive health care privacy rule, at 89 FR 32976, added an attestation requirement at 164.509 for requests that touch reproductive health care, including in judicial proceedings. On June 18, 2025, the Northern District of Texas in Purl v. HHS vacated the rule's changes to Parts 160 and 164, except most of its privacy notice changes. An amended judgment followed on July 3, 2025, and an appeal by would-be intervenors was dismissed on September 10, 2025.

State law is the last layer. HIPAA keeps a state privacy law that is more stringent, under 45 CFR 160.203(b). New York is a clear example: under CPLR 3122(a), a medical provider served with a subpoena for a patient's records, other than a trial subpoena issued by a court, "need not respond or object" if it comes without the patient's written authorization.

Log every subpoena release for the accounting of disclosures

A release under a subpoena or court order belongs in your accounting of disclosures. Patients can ask for 6 years of disclosures under 45 CFR 164.528, and you have 60 days to answer. Releases under the patient's own authorization are exempt, so every log entry should record the legal basis.

The exemptions in 164.528(a)(1) cover treatment, payment and operations, disclosures to the patient, authorizations and a few others, but not judicial proceedings. HHS's FAQ on litigation confirms that when the practice is not a party, releases under a court order or a subpoena must be accounted for.

Each entry needs 4 fields under 164.528(b)(2):

• The date of the release
• The recipient's name, and address if known
• A brief description of what was released
• A brief statement of the purpose, or a copy of the written request

Every figure comes from the regulation text. The log fields are what a patient sees if they ask.

The 60-day clock allows one extension of up to 30 days if you send the patient a written reason and a new date before the first deadline. The first accounting in any 12-month period is free. Keep the log, the accountings you send, and the titles of the people who handle these requests for 6 years under 164.530(j)(2).

Hold letters are not disclosures, but file them in the same place. If a patient asks a year later why a law firm had their records, the answer should take minutes to find, the same standard set out in the audit trail an AI agent should leave.

Who signs off, and where automation stops

The privacy official signs off on every release, because each is a judgment call: is it an order, does the assurance hold, what scope fits, are special records involved. Software can handle intake, deadlines and the log. It must never judge sufficiency, choose records, send them, or confirm who is a patient.

A small practice can run this with 3 roles. The front desk receives, stamps and routes. The privacy official decides and signs the approval, including the scope. Records staff compile exactly that scope, and a second person checks the packet against the approval before it leaves.

Automation fits the mechanical edges. An AI receptionist can route a law office's call to the privacy official's line, taking the firm, the case and a callback number without confirming anything about a patient. An intake tool can flag faxes marked subpoena, calendar the production date, and open a draft log entry. That is the split described in what an AI receptionist does and where it hands off: routing goes to software, judgment goes to a person. Any vendor whose system stores the subpoena packet holds patient information and needs a signed BAA first.

Field note

Before the next subpoena arrives

• A named privacy official and a backup receive every subpoena and court order the day it arrives.
• Callers asking about a patient hear one answer: the privacy official responds in writing.
• A hold letter naming the missing assurance is drafted and ready to send.
• Every release is logged with its date, recipient, description and legal basis.

Put the subpoena procedure in writing before you need it

Write the procedure as 4 questions in order: does it ask for special records, is it signed by a judge or tribunal, is satisfactory assurance in writing, and what is the minimum to send. Each answer leads to one action, and every path ends with the paperwork filed and any release logged.

Four questions in a fixed order. Every path ends with the paperwork filed and any release logged.

Walk the flow once. Psychotherapy notes and Part 2 records wait for the right authorization, consent or order. An order from a judge or tribunal is answered within its exact terms. A subpoena with written assurance gets the minimum necessary, and one without it gets the hold letter.

Then test it on paper. Run the subpoenas and court orders from the last 12 months through the flow, and check that every release appears in the log with all 4 fields. A gap found now is cheaper than one a patient's accounting request finds.

If you are weighing an AI receptionist for the phone side of this, our FAQ on the No-PHI default and BAA-backed vendors explains what the system collects and what it leaves to your staff.