HIPAA and Testifying in Court: Orders, Subpoenas, and Authorization

HIPAA applies when a healthcare provider is testifying in court, not just when records leave the file room. A doctor, nurse, or therapist can testify about a patient’s protected health information only if the patient has signed a valid written authorization, a judge has issued a court order that covers the testimony, or a subpoena arrives with proof that the patient was notified and given time to object, or with a qualified protective order in place.¹ Grand jury subpoenas follow their own rule, and certain records — psychotherapy notes and substance use treatment files — need more than any of these.

Oral Testimony Counts as a Disclosure

The Privacy Rule protects individually identifiable health information “in any form or media, whether electronic, paper, or oral.”² Answering a deposition question about a patient’s diagnosis or describing therapy statements from the witness stand is a disclosure of protected health information (PHI), and every restriction that would apply to producing a chart also applies to speaking about it aloud. Treating the courtroom as somehow outside HIPAA’s reach is a costly mistake.

The baseline is simple. A covered entity may not use or disclose PHI unless the Privacy Rule specifically permits it or the patient has authorized it in writing.² For a provider called to testify, that means identifying which of the recognized pathways actually applies before answering questions about a patient.

Patient Authorization

The cleanest pathway is the patient’s own written authorization. When a patient signs a valid authorization, the provider can testify to or share the specified information with the designated recipient without violating HIPAA. A valid authorization must contain six elements:³

A specific description of the information to be disclosed.
The name or identification of the person or class of persons authorized to make the disclosure.
The name or identification of who will receive the information.
A description of each purpose of the disclosure. If the patient initiates it, “at the request of the individual” is sufficient.
An expiration date or triggering event, such as “at the conclusion of the litigation.”
The patient’s signature and date (or an authorized representative’s signature with a description of that authority).

The authorization must be written in plain language.³ A vague or open-ended form that fails to specify the information, the recipient, or the purpose is invalid, and a provider who relies on a defective authorization has no HIPAA defense.

Patients can revoke an authorization at any time, but the revocation must be in writing and takes effect only when the covered entity actually receives it. Anything already disclosed in reliance on the authorization stays lawful; the revocation only stops future releases.⁴

Court Orders

A court order signed by a judge or an administrative tribunal compels disclosure. When a provider receives one, compliance is mandatory — but only for the information the order specifically describes.¹ An order about a patient’s knee surgery does not open up the rest of the chart, and testimony should be kept to the subject matter the order identifies.

The “minimum necessary” standard that normally governs HIPAA disclosures does not apply to disclosures required by law, including court orders.⁵ The order itself sets the boundaries. If it directs the provider to produce or testify to something, the provider does not need to second-guess each page.

Subpoenas Without a Court Order

A subpoena issued by an attorney or a court clerk, rather than signed by a judge, does not carry the same automatic authority. A provider who receives a bare subpoena cannot simply take the stand and start answering questions about a patient. The Privacy Rule requires one of two preconditions.¹

Notice to the Patient

The party seeking the information must provide the covered entity with written documentation showing three things: a good-faith attempt to give the patient written notice, notice that included enough detail about the proceeding for the patient to object, and that the time to object has passed — either without any objection or with all objections resolved by the court.¹

Qualified Protective Order

Alternatively, the requesting party can secure a qualified protective order. It must prohibit the parties from using the PHI for any purpose other than the litigation and require the return or destruction of all copies once the proceeding ends.¹ The parties can either agree on terms and submit them, or the requesting side can ask the court to issue one. Either satisfies HIPAA. Until one of the two preconditions is met, the provider should not testify or produce records in response to the subpoena.

Grand Jury Subpoenas

Grand jury subpoenas are treated differently. A covered entity may disclose PHI in response to a grand jury subpoena without the patient notification or protective order requirements that apply to ordinary litigation subpoenas.⁶ Providers should still verify the subpoena is authentic, but they do not need to independently confirm that the patient was notified.

Psychotherapy Notes Need Their Own Authorization

Psychotherapy notes — a therapist’s personal notes analyzing the content of counseling sessions, kept separate from the rest of the chart — sit in a protected category of their own. With very few exceptions, a covered entity must obtain the patient’s specific authorization before disclosing psychotherapy notes for any reason, including for treatment by another provider.⁷ The narrow exceptions that exist, such as mandatory abuse reporting and duty-to-warn situations, do not include a general carve-out for litigation subpoenas. A subpoena on its own will not compel a therapist to testify about psychotherapy notes.

What does not qualify as psychotherapy notes: medication records, session start and stop times, treatment frequency, clinical test results, and summaries of diagnosis, prognosis, and progress. Those follow the standard disclosure rules even when the treating clinician is a mental health provider.⁷

Substance Use Treatment Records

Records from federally assisted substance use disorder treatment programs are governed by 42 CFR Part 2, which is stricter than HIPAA. Even a judge cannot simply order disclosure. The court must first find “good cause,” meaning no other effective way exists to obtain the information and the public interest outweighs the harm to the patient and the treatment relationship.⁸

When the records are sought for a criminal investigation or prosecution of the patient, the bar is even higher. A court must find that the crime is “extremely serious” — on the level of homicide, armed robbery, or child abuse — and that there is a reasonable likelihood the records contain information of substantial value to the case.⁸ A routine civil lawsuit will almost never clear this threshold.

Keep Testimony to the Minimum Necessary

For most litigation-related disclosures, particularly subpoena responses, the minimum necessary standard applies. A provider must make reasonable efforts to limit disclosure to the PHI actually needed for the request.⁵ If the subpoena concerns a car accident injury, testimony should stay with that injury. Volunteering an unrelated mental health history or substance use history goes beyond what the request calls for.

The rule has some give. A covered entity may reasonably rely on the requesting party’s judgment that the information sought is the minimum necessary when the request comes from another covered entity, a public official, or a professional workforce member or business associate. Independent judgment is still the safer practice. The minimum necessary standard does not apply to disclosures required by law, such as those made under a court order, or to disclosures the patient has authorized.⁵

When the Provider Is a Party to the Lawsuit

A provider who is itself a plaintiff or defendant, such as a hospital defending a malpractice suit, may use and disclose PHI as part of its own healthcare operations without patient authorization. The minimum necessary standard still applies. In-house or outside counsel acting as business associates must limit the PHI they disclose in depositions, briefs, and trial testimony to what is necessary for the litigation. HHS has noted that the minimum necessary standard “may in some cases limit disclosures more significantly than would be required to meet a ‘relevance’ standard” applied by courts in discovery.⁹ Seeking a protective order to shield PHI from public portions of the proceeding is often prudent.

State Privilege Laws Can Restrict Testimony Further

HIPAA sets a federal floor, not a ceiling. Under the preemption rule, state laws that are “more stringent” — meaning more protective of patient privacy — are not overridden by HIPAA.¹⁰ Most states have physician-patient privilege laws that may block testimony or record disclosure even when HIPAA would allow it. Satisfying HIPAA’s subpoena rules does not eliminate the risk of violating a state privilege statute. Providers should confirm with counsel how state privilege law applies before answering.

What Patients Can Do

Patients whose records or testimony have been subpoenaed have room to push back. When the requesting party sends the required notice, it must include enough information about the proceeding for the patient to file an objection.¹ A patient can move to quash the subpoena, arguing that the information is irrelevant, that the request is overbroad, or that the privacy intrusion outweighs the need for the material. Courts regularly narrow or quash medical records subpoenas, especially when they reach into unrelated treatment history. A patient who previously signed an authorization can also revoke it in writing; the revocation prevents future releases under that authorization once the covered entity receives it.⁴

Penalties for Testifying Improperly

Providers who disclose PHI in litigation without a proper legal basis face real consequences. The HHS Office for Civil Rights investigates complaints and can impose civil monetary penalties on a tiered scale, with amounts adjusted annually for inflation. As of 2026, the top tier — willful neglect that is not corrected within 30 days — reaches $73,011 to $2,190,294 per violation, with the same $2,190,294 annual cap for identical violations that applies to the lower tiers.¹¹ Penalties apply per violation, so one improper disclosure that affects multiple patients can multiply quickly.

Intentional violations can also trigger federal criminal prosecution. Knowingly obtaining or disclosing PHI in violation of HIPAA carries up to $50,000 in fines and one year in prison; committing the offense under false pretenses raises the ceiling to $100,000 and five years; acting with intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm reaches $250,000 and ten years.¹² Criminal prosecutions for litigation-related disclosures are rare, but the possibility is reason enough to treat every request for testimony as a compliance question.

Before You Take the Stand

When a subpoena, deposition notice, or trial subpoena lands, the first question is what the document actually is. A court order signed by a judge compels testimony on exactly what it specifies. A subpoena from an attorney or clerk requires the provider to pause and verify that either the patient was properly notified and given time to object, or a qualified protective order is in place.¹³ A grand jury subpoena stands alone.⁶

From there, check whether the testimony would touch heightened-protection categories like psychotherapy notes or substance use treatment records, apply the minimum necessary standard when the disclosure is subpoena-based, and confirm what state privilege law adds. When any question remains, the safer course is to consult counsel before answering, rather than after.

1
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
2
U.S. Department of Health and Human Services (HHS). Summary of the HIPAA Privacy Rule
3
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which Authorization Is Required
4
U.S. Department of Health & Human Services. Can an Individual Revoke His or Her Authorization
5
U.S. Department of Health & Human Services. Minimum Necessary Requirement
6
U.S. Department of Health & Human Services. When Does the Privacy Rule Allow Covered Entities to Disclose Protected Health Information to Law Enforcement Officials
7
U.S. Department of Health & Human Services. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information
8
eCFR. 42 CFR Part 2 Subpart E – Court Orders Authorizing Use and Disclosure
9
U.S. Department of Health & Human Services. May a Covered Entity That Is a Plaintiff or Defendant in a Legal Proceeding Use or Disclose Protected Health Information for the Litigation
10
eCFR. 45 CFR 160.203 – Preemption of State Law
11
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
12
Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
13
U.S. Department of Health & Human Services. Court Orders and Subpoenas