Does HIPAA Protect Against Subpoenas in Arizona?

Does HIPAA protect against complying with the subpoena for a medical record in Arizona? And in short, the answer is no. As a healthcare attorney, I think people misuse what HIPAA is. And I’m not going to go through where it applies and when it applies, but it does not apply if there is a valid subpoena for a medical record in Arizona.

Who has the Valid Statutory Authority to Issue a Medical Record Subpoena?

So, who has the valid statutory authority to issue a medical record subpoena? Well, if the patient obviously provides authorization via subpoena, and most of the time, that would be in conjunction with a legal issue that’s going on, either maybe a personal injury case or medical malpractice.

The patient’s attorney may subpoena the records, and that must be accompanied by the patient’s authorization. The second would be through a grand jury proceeding. If there’s some criminal investigation going on, if a grand jury issues a subpoena, then you must comply with that. The third would be just a court. If a court issues the subpoena, the provider will have to provide a medical record. And then last, a healthcare regulatory board.

So, the medical board, nursing board, and psychology board, if they issue a subpoena for medical records to a provider or a facility, for that matter, they need to comply with it, and the record needs to be sent. So, HIPAA does not protect a record, meaning if a board, a court, if a grand jury asks for the record via a valid subpoena, you do not need the patient’s authorization to send the record to that entity.

Now, as I said before if an attorney sends a subpoena to a provider and there isn’t a patient authorization attached to it, then you do not have to comply with that. But if it does have the patient authorization, obviously, HIPAA has nothing to do with that. So, in short, can’t hide behind HIPAA if you don’t want to provide a medical record in those four circumstances. They just simply do not apply.

Arizona Medical Records Subpoena

At some point in your career as a medical practitioner, you will be subpoenaed to either testify or give medical records that will be used to determine cases. The cases may be before a court, a tribunal, or other medical boards.  A subpoena is a legal summon that lawyers, court staff, and other legal experts use to demand the production of important records or demand witness attendance at a hearing

Subpoenas differ from court orders in that a subpoena is a lawyer’s declaration that they are entitled to some information, while a court order determines that the lawyer is entitled to it.  Court orders are signed by a judge or magistrate, while subpoenas are signed by an attorney. A court order has the word  “order” typed on it, and a subpoena has “subpoena” typed on it. The basic rule is that while responding to a subpoena in a certain order, you must do so with the patient’s consent or court order. A subpoena can be contested, while a court order cannot be contested. It is to be complied with to the letter.

Consent means a HIPAA-compliant authorization form if you are a medical practitioner covered by the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Without a court order or consent, your objection must explain why you cannot produce the protected information. Responding to a subpoena generally depends on the authority, scope of request, and time limits given. Failure to follow this may result in serious HIPAA sanctions.

How does one respond to a medical records subpoena in Arizona?

First and foremost, medical practitioners must ensure they have the written authorization of a patient or the patient’s healthcare decision-maker before releasing the records. The release of records without the patient’s consent can only be done when it is ordered by a court or a law requirement (such as the HIPAA Privacy Rule). Persons that receive the records cannot disclose them to other third parties unless the patient consents in writing or re-disclosure are granted by law.

General HIPAA Requirements for Subpoenas

• Signature verification. A subpoena will only have a force of law if it is signed by a registered legal practitioner; Court subpoenas have to be signed by judges. Court-order subpoenas have a higher jaw force, and they cannot be objected to.
• Subpoenas have to be specific. While seeking medical record information, the subpoena has to request specific information. The requirement is so that there is a minimal release of records to fulfill a subpoena.
• HIPAA requires that the patient is given sufficient notice. There is a minimum Necessary Standard outlined in the privacy rule. The patient can therefore decline a subpoena but not a court order.

HIPAA Privacy Rule

It is a national rule that protects individual medical information and records that sets limits on the uses that may be made of such disclosure without a patient’s clearance. It gives individuals a right to obtain their health records, direct an entity to disclose them to third parties, and request any corrections. In Arizona, HIPAA guards against subpoenas by presenting conditions that must be met before medical records are released.

1. For subpoenas issued by a judge or magistrate, the medical practitioners must comply with the information demanded, or attract fines.
2. For subpoenas issued by grand juries, the practitioner must strictly comply with its terms. Since grand jury proceedings are confidential, HIPAA does not require additional protections.

For subpoenas issued by an attorney, the practitioner has to meet the following conditions:

1. The practitioner should contact the patient orally or by letter, explain that they have received a subpoena requiring disclosure of the patient’s information, and notify the patient that they are required to respond unless the patient quashes the subpoena and notifies the practitioner before the deadline for responding to the subpoena. Once the practitioner sends such notice, the burden is on the patient to reject the subpoena if they want to protect their personal information
2. The practitioner may obtain written assurances from the entity issuing the subpoena that either: 

(a) the entity made a good faith attempt to give the patient written notice of the subpoena, the notice included sufficient information to permit the patient to object to the subpoena, and the time for raising objections has passed, or the court ruled against the patient’s objections, or 

(b) the parties have agreed on a protective order, or the entity seeking the information has filed for a protective order. (45 C.F.R. § 164.512(e)(1)(iii)-(iv)).

1. Or the practitioner may obtain a valid HIPAA authorization executed by the patient. To be valid, the authorization must contain the elements and statements required by 45 CFR § 164.508.

If the practitioner cannot satisfy one of the above, they may not disclose protected health information, nor may they ignore the subpoena without subjecting themselves to possible contempt sanctions. The practitioner may need to appear in response to the subpoena, assert an objection based on HIPAA, and wait for the court to order disclosure.

Subpoenas are issued by attorneys in Arizona to obtain patients’ records for use in personal injury claims, medical malpractice claims, or any other kind of civil lawsuit or even a criminal suit.

Consultation with Chelle Law

At Chelle Law, we aim to provide legal assistance to all medical professionals regarding attorney subpoenas. We offer representation with professional and board hearings and appeals and coverage of the HIPAA regulations. Contact us today and have your issue sorted with our experienced subpoena attorneys.