To subpoena medical records, you issue a subpoena duces tecum to the provider’s custodian of records and give the provider written proof that HIPAA’s disclosure conditions have been met — either that you notified the patient and the objection period passed, or that a qualified protective order is in place. Without that proof, the provider can legally refuse to hand anything over, and most will. Learning how to subpoena medical records is mostly learning what documentation the provider needs before it will open the file.
Court Order or Subpoena: Two Different Paths
HIPAA treats a judge’s order and an attorney’s subpoena as very different things. Under 45 CFR 164.512(e), a provider may release protected health information in response to a court order, but only the specific information the order describes.1eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required The signed order is the authorization. Nothing else is required from you.
A subpoena issued by an attorney or a court clerk is not a court order. Providers cannot release records on that subpoena alone. Before responding, they must receive written proof that either the patient was notified and given time to object, or a qualified protective order was sought or obtained.2U.S. Department of Health and Human Services. Court Orders and Subpoenas HIPAA calls this “satisfactory assurance.” No assurance, no records.
Providing Satisfactory Assurance
This is where most medical records subpoenas fail. You have two options, and you only need one.
Option 1: Notify the Patient
Send the patient written notice of the subpoena and give them time to object in court. HIPAA requires documentation showing three things: you made a good-faith attempt to give the patient written notice, the notice contained enough information about the case for the patient to raise an objection, and the time to object has passed with either no objections filed or all objections resolved.1eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required If you don’t know where the patient is, mailing notice to the last known address satisfies the good-faith requirement.
The notice should identify the case, describe the records you’re requesting, and explain that the patient can file an objection with the court. After the objection window closes, send the provider a written statement confirming that all three requirements are met. Only then can the provider disclose.
If the subpoena itself shows on its face that the patient received proper notice, the time to object has passed, and no objections were filed, the provider generally does not need additional documentation.3U.S. Department of Health and Human Services. For Disclosures for Judicial and Administrative Proceedings, When Is a Copy of the Subpoena Itself Sufficient Satisfactory Assurance of Notice to the Individual
Option 2: Get a Qualified Protective Order
The alternative is a qualified protective order. Under HIPAA, it must do two things: prohibit the parties from using the health information for any purpose other than the specific proceeding, and require the return or destruction of all copies once the case ends.1eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required The parties can stipulate to one and present it to the court, or the requesting party can move for one. Either way, once you have it (or have filed the motion), you send the provider a copy along with your satisfactory assurance statement.
Drafting the Subpoena
Under Federal Rule of Civil Procedure 45, an attorney authorized to practice in the issuing court can issue and sign the subpoena directly. A self-represented party must ask the court clerk to issue one, signed but otherwise blank, for the party to complete before service.4Legal Information Institute (LII). Federal Rules of Civil Procedure Rule 45 – Subpoena State rules follow the same pattern in most places.
The document you need is a subpoena duces tecum, which compels production of records rather than live testimony. Use the court’s official form and complete every field. An incomplete subpoena gives the provider grounds to object. Include at a minimum:
- Patient’s full legal name and date of birth.
- Full name and address of the facility, directed to the custodian of records.
- Specific treatment dates. “All records related to right shoulder injury treatment from March 1, 2023 through September 30, 2024” is far better than “all medical records.”
- Record types: treatment notes, imaging reports, billing statements, surgical records, discharge summaries — whatever you actually need.
- A compliance deadline that gives the provider reasonable time to respond.
Narrow requests survive challenges. Asking for “any and all medical records” invites a motion to quash for overbreadth, and if the provider does comply, you’ll pay per-page copying fees for records you didn’t need.
Serving It on the Right Person
A subpoena has no legal effect until it is properly served. The two reliable methods are personal delivery by a process server and certified mail with return receipt requested. Personal service produces the cleanest proof of delivery and is accepted everywhere. Certified mail works in many states but not all courts, particularly for certain proceedings.
Direct service to the custodian of records at the facility. That’s the person responsible for maintaining and releasing patient files. Handing a subpoena to the front desk may not be valid service under your jurisdiction’s rules. Keep the process server’s affidavit or the signed return receipt; you’ll need it if the provider doesn’t comply and you have to move to compel.
Records a Standard Subpoena Cannot Reach
Two categories of records carry protections that override the ordinary HIPAA subpoena process. If your case involves either, a regular subpoena will fail no matter how clean your paperwork is.
Substance Use Disorder Treatment Records
Records from federally assisted substance use disorder treatment programs are governed by 42 CFR Part 2, which is stricter than HIPAA. A subpoena is never enough on its own. The regulation requires a court of competent jurisdiction to enter a specific authorizing order under Part 2’s own procedures before the holder may disclose.5eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records Even with that order, you still need the subpoena to compel production. Two documents, not one.
Psychotherapy Notes
Psychotherapy notes are the therapist’s private observations and session impressions, kept separate from the regular medical file. Under 45 CFR 164.508(a)(2), a covered entity must obtain a specific patient authorization before disclosing them, with only narrow exceptions.6eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required The judicial proceedings exception does not override that requirement. The regular mental health treatment record — diagnoses, treatment plans, progress notes, medication history — is not subject to this heightened protection and can be subpoenaed through the standard HIPAA process. For the separate psychotherapy notes, you generally need the patient’s signed authorization or a court order specifically compelling their disclosure.
Response Timing and Costs
Under federal rules, a person served with a subpoena for documents must object within 14 days of service or by the compliance date, whichever is earlier.4Legal Information Institute (LII). Federal Rules of Civil Procedure Rule 45 – Subpoena State timelines vary. Set a compliance date that gives the provider reasonable time; too short a window is itself grounds to quash.
Providers charge for locating, copying, and producing records. Costs vary by state and can include per-page charges, a flat retrieval fee, and sometimes staff time. Some states cap the fees by statute; others don’t. Digital delivery, where available, tends to cost less. Ask about the fee schedule before the compliance deadline so a billing dispute doesn’t stall production.
If the Subpoena Is Challenged
Either the provider or the patient can push back. Under federal rules, a written objection served before the compliance deadline or within 14 days of service shifts the burden to you: the records don’t come until you file a motion to compel and the court rules.4Legal Information Institute (LII). Federal Rules of Civil Procedure Rule 45 – Subpoena
A court must quash or modify a subpoena that fails to allow reasonable time, requires disclosure of privileged or protected information without a proper waiver, or subjects the recipient to undue burden.4Legal Information Institute (LII). Federal Rules of Civil Procedure Rule 45 – Subpoena The common grounds for challenging a medical records subpoena are:
- Overbreadth — the request sweeps in records unrelated to the case.
- Privilege — the request reaches psychotherapy notes, attorney-client material, or Part 2 records.
- Procedural defects — improper service, missing satisfactory assurance, or a compliance window that’s too tight.
- Undue burden — the cost or effort to produce is grossly disproportionate to the records’ value.
If your subpoena is challenged, you may need to narrow it, supply missing documentation such as proof of patient notice, or argue relevance and reasonableness to the court. Precision in the original subpoena avoids most of these fights before they start.