When a subpoena is presented to HIM professionals, the first thing that needs to be determined is if the subpoena is valid. The HIM professional doesn't need to do anything unless it is valid. Otherwise, HIPAA requires a prompt response when it is a valid subpoena. HIPAA requires a patient's written consent when disclosing to Covered Entity (CE) under HIPAA Privacy Rule that includes a patient's records for use other than treatment, healthcare, and payment. However, HIPAA states the patient's consent is not required for disclosure of information when required by law. It is common practice to send notice to the patient when this occurs and allow the patient to oppose. There are two types of subpoenas: court-issued and grand jury subpoenas, and subpoenas that are issued by attorneys for legal discovery.
The first type, court issued and grand jury subpoenas can be challenged but when there aren't grounds for objection the healthcare organization or other CE is required to disclose patient information specifically requested by the court order and no more. If additional documentation was provided other than what was asked for, this becomes impermissible disclosure of personal health information (PHI). The HIM professional can navigate this successfully by redacting PHI within the documents that are requested by the subpoena. Protecting patient's private health information is covered at all times by HIPAA regulations.
The second type is a little more involved. To satisfy a subpoena request made by an attorney or by court clerks, HIPAA requires one of three conditions to be met by the requesting party:
good faith attempt made to request information from patient or patient's legal team,
written statement attesting to information requested is limited to its use and protected while in custody and returned upon end of its use, and lastly,
reasonable efforts have been made to notify the patient and allowing a response. A valid HIPAA authorization will have to be obtained from the patient for release of information (ROI) specific to the subpoena request for documentation.
It is important to make a note that if the subpoena requested documentation cannot be provided, the valid subpoena cannot be ignored. You may request to quash or object to the subpoena if time constraint cannot be met. It is also extremely important that the HIM professional or its department keep a log of all requested information.
[USC02] 42 USC 17935: Restrictions on certain disclosures and sales of health information; accounting of certain protected health information disclosures; access to certain information in electronic format. (n.d.). Retrieved January 7, 2021, from https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17935&num=0&edition=prelim