It's a pretty common scenario. One day you're busy treating patients when your office manager knocks on the door with a puzzled expression on her face. There's a man at the front who claims to be a "process server," who just delivered an official-looking document called a "subpoena."
Later that day, you read the document to see what it's all about. The document is from a lawyer demanding copies of medical records for one of your patients. There's just one problem; the lawyer doesn't represent your patient, and there's no release signed by the patient authorizing you to disclose the records.
As an experienced health professional, you know that patient medical records are confidential and are protected under HIPAA (the Health Insurance Portability and Accountability Act), a federal law with stiff penalties for violating patient privacy.
You call a friend of yours, a lawyer, to ask her what you need to do. She tells you that a subpoena is an official court document that requires the recipient to either show up for a deposition or to produce documents to the party requesting the information. Failing to comply with the subpoena could cause you to be in contempt of court. The penalties for contempt are also stiff. You could be fined for every day you don't produce the records or even thrown in jail.
As a federal law, HIPAA generally trumps state laws requiring compliance with court process, including a subpoena or other official request for documents. However, the federal Department of Health and Human Services (DHHS) has promulgated rules which do allow health care professionals to disclose patient records without the patient's consent in certain limited circumstances. For example, if there is an order by a state judge that the records be disclosed, or if one of the parties has applied for a "Qualified Protective Order," then HIPAA does not apply, and the records must be disclosed. Failing to disclose the records under these circumstances could lead to contempt penalties.
Subpoenas or other requests for medical records are often made during a personal injury lawsuit, in which the patient has sued a third-party defendant for damages. In many cases, the patient will agree to sign a release to allow the records to be disclosed without any trouble. A competent personal injury lawyer will also always advise her clients to sign a release, so as to avoid any unnecessary trouble for the treating physicians.
However, in some cases, the lawyer may not know the rules, or the patient may refuse to sign the release, even against the lawyer's advice. In these cases, the doctor is placed in a difficult position of having to navigate both state law requirements and the DHHS HIPPA regulations. The best thing to do in these circumstances is to consult with an experienced litigation attorney with knowledge of the federal HIPAA regulations and state law.
In most cases, the attorney will be able to consult with both parties in the lawsuit and obtain a release. Otherwise, the attorney advise the physician whether or not to disclose the records.