HIPAA violations in divorce happen at the healthcare provider or health plan, not at your spouse’s kitchen table. The law restricts what covered organizations do with your medical information; it does not directly regulate what your spouse or their lawyer does with a document they already have. So if your ex reads a medical bill left on the counter, that is not a HIPAA violation. If your spouse’s attorney pressures your therapist’s office into releasing records without a valid court order or proper subpoena safeguards, that office can face civil penalties ranging from $145 to more than $2.1 million per year depending on culpability.
Who HIPAA Actually Binds
HIPAA applies only to “covered entities” and their business associates. Covered entities are healthcare providers who transmit information electronically (doctors, hospitals, pharmacies, psychologists), health insurance companies, and healthcare clearinghouses.1U.S. Department of Health and Human Services. Covered Entities and Business Associates Anyone outside those categories has no HIPAA obligations at all.
Your spouse is not a covered entity. Neither is your spouse’s attorney. If your spouse finds a prescription bottle in the medicine cabinet and quotes it in a custody filing, HIPAA has nothing to say about it. State privacy laws, tort claims for invasion of privacy, or court-imposed protective orders may give you a remedy, but not HIPAA. The compliance risk during a divorce sits with the providers and plans holding your records.
How Medical Records Legitimately Reach the Court
Courts often need medical information to decide custody, support, or fitness questions. HIPAA does not block that; it channels it. The two most common channels behave very differently.
Court Orders
When a judge signs an order directing a provider to release records, the provider may disclose the protected health information the order expressly authorizes, and nothing more.2eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required Your consent is not required, but the scope is fixed by the order. If the order covers outpatient treatment from January through June 2025, the provider cannot release the full chart.
Attorney-Issued Subpoenas
A subpoena from an attorney, without a judge’s signature, is not enough on its own. Before releasing records, the provider must receive “satisfactory assurances” that either you were given written notice and time to object, or the requesting party has sought a qualified protective order limiting how the information can be used.2eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
In practice, a lawyer cannot just mail a subpoena to your doctor and expect the file to appear. The provider has to verify that you had a chance to fight the request or that a protective order is in place. Many smaller practices refuse to release anything without an actual court order, even when a subpoena would technically qualify. A provider that hands over records without either safeguard is the party on the hook.
Whether Your Spouse Can Access Records Directly
During a marriage, HIPAA often treats a spouse as a “personal representative” with the same access rights as the patient, if state law gives a spouse authority to make healthcare decisions for the other.3U.S. Department of Health and Human Services. HIPAA and Marriage – Understanding Spouse, Family Member Access That is fine until it isn’t.
Once a divorce is finalized and your former spouse no longer holds decision-making authority under state law, providers should stop treating that person as a personal representative. The awkward stretch is the divorce itself, when you are still legally married but clearly adversarial. A provider who keeps giving your estranged spouse full access without checking current authority is running a real compliance risk. If you are worried about this, tell your providers in writing that you do not authorize your spouse’s access.
Children’s Records in a Custody Fight
A parent with legal custody generally qualifies as the child’s personal representative under HIPAA, with the same access rights as the patient.4eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information General Rules There are important exceptions. A parent is not treated as the child’s personal representative when:
- The minor consented independently to care that state law lets them consent to alone (mental health treatment is a common example), and the records concern that care.
- A court ordered the treatment or appointed someone else to authorize it.
- The parent agreed that the child and provider could have a confidential relationship, to the extent of that agreement.
A provider can also refuse to treat a parent as the personal representative if it reasonably believes the child has been or may be subjected to abuse, neglect, or domestic violence by that parent, or that access could endanger the child. That call is a patient-specific professional judgment, not a blanket policy.5U.S. Department of Health and Human Services. The HIPAA Privacy Rule and Parental Access to Minor Childrens Medical Records Some states add further limits on parental access to mental health and reproductive health records.
Records That Carry Extra Protection
Psychotherapy Notes
Psychotherapy notes are the therapist’s personal notes analyzing a session’s content, kept separate from the main medical record. They receive a higher level of confidentiality than the rest of the chart, and even a patient’s health insurer cannot demand them for payment audits. In a divorce, they are often exactly what the other side wants. A provider generally needs your specific written authorization to release them; the usual court order and subpoena exceptions that apply to ordinary records are narrower here.
Some things in a therapy file are not psychotherapy notes: medication records, session dates and times, treatment plans, diagnoses, and progress summaries are part of the standard record and follow the normal disclosure rules. The heightened protection covers only the therapist’s private analytical notes.
Substance Use Disorder Records
Federal law adds another layer for substance use disorder treatment records under 42 CFR Part 2. These records cannot be used or disclosed in legal proceedings against a patient without the patient’s consent or a specific court order accompanied by a subpoena.6U.S. Department of Health and Human Services. Understanding Confidentiality of Substance Use Disorder Patient Records or Part 2 To get such an order, the court must find “good cause”: that no other way of getting the information is available or workable, and that the public interest in disclosure outweighs the harm to the patient and the treatment relationship.7eCFR. 42 CFR 2.64 – Procedures and Criteria for Orders Authorizing Uses and Disclosures for Noncriminal Purposes A spouse alleging untreated addiction cannot clear this bar with a standard discovery subpoena.
What a Violation Costs the Provider
Civil penalty tiers are adjusted for inflation each year. The 2026 amounts are:8Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
- No knowledge of the violation: $145 to $73,011 per violation, up to $2,190,294 per year.
- Reasonable cause, not willful neglect: $1,461 to $73,011 per violation, up to $2,190,294 per year.
- Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, up to $2,190,294 per year.
- Willful neglect, not corrected within 30 days: $73,011 to $2,190,294 per violation, up to $2,190,294 per year.
Criminal penalties also exist for knowingly obtaining or disclosing protected health information without authorization, running up to $250,000 and ten years in prison in the most serious tier.9GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information Criminal cases are handled by the Department of Justice and are rare, but they exist for the most egregious conduct.
Reporting a Suspected Violation
Start with the covered entity’s privacy officer. Every provider and health plan is required to have one, and many disputes end there. If the internal route does not resolve it, file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.10U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint
You have 180 days from when you learned about the violation to file, though the Office for Civil Rights can extend that deadline for good cause.11U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint The complaint targets the covered entity, not your spouse. If your spouse obtained records improperly, the provider who released them is the party accountable under HIPAA. Any separate claim against your spouse would live under state law, outside the HIPAA complaint process.