A healthcare provider handling a medical record subpoena for HIPAA compliance cannot release anything until it confirms one of two things: either the patient was properly notified of the request and given time to object, or a qualified protective order is in place limiting how the records will be used. That rule comes from 45 CFR 164.512(e), and it applies to every subpoena that isn’t signed by a judge. Skip the verification step and the provider owns the regulatory risk alone.
Why a Subpoena Is Not a Court Order
A court order signed by a judge already reflects a judicial decision that disclosure is appropriate. The judge has weighed the patient’s privacy interest against the need for the information, and the provider can release the records described in the order without additional verification.
A subpoena issued by an attorney or a court clerk is different. No judge has reviewed it. No one has decided the patient’s privacy should give way. Because of that gap, HIPAA layers on extra requirements before records can move. Treating a bare subpoena the same as a court order is one of the most common compliance failures in this area.
The Satisfactory Assurances Requirement
For a subpoena without a judge’s signature, the provider needs what the regulation calls satisfactory assurances from the requesting party. Two paths exist, and either is enough.
Written Proof That the Patient Was Notified
The requester must submit a written statement with documentation showing a good-faith effort to notify the patient. The notice has to go to the patient’s last known address and has to include enough detail about the lawsuit or proceeding for the patient to decide whether to object. Something vague like “your records have been requested” doesn’t meet the standard. The patient needs the case name, the court, and a description of the records being sought.
The requester also has to show that the objection window has passed and that either no objection was filed or the court ruled on any objection consistently with the planned disclosure. Only then can the records go out.
One point that gets overlooked: the provider itself can handle the notice instead of waiting on the requesting attorney’s paperwork. HHS guidance for non-party disclosures allows the provider to notify the patient directly using the same standards, or to seek a qualified protective order on its own.
A Qualified Protective Order
The second path is a qualified protective order, meaning a court order or a stipulated agreement between the parties that does two specific things. It prohibits use of the medical records for any purpose outside the litigation at hand, and it requires the return or destruction of all copies when the case ends. If the requester can show that such an order exists, the provider has the assurance it needs.
This route is usually faster than the notice route because it skips the waiting period for patient objections. When the parties have already stipulated to a protective order as part of standard discovery, the provider just verifies the order and proceeds.
When the Patient Objects or the Paperwork Looks Thin
If a patient receives notice and files an objection with the court, the records stay put. Disclosure can only proceed once the objection period passes with no filing, or once the court rules on the objection in a way that’s consistent with the disclosure.
The same conservative posture applies when the satisfactory assurance documentation looks incomplete. If notice appears deficient, if it’s unclear whether the patient was properly informed, or if any element of the required proof is missing, the safest move is to hold the records and let the requesting party go back to court for an order compelling production. A provider that releases records in an ambiguous situation absorbs all the enforcement risk.
Patients who want to fight a subpoena can file a motion to quash or modify it. In federal court, written objections must be served within 14 days after the subpoena is served or before the compliance deadline, whichever is earlier. State deadlines vary. Once an objection is filed, the dispute moves to the judge and the provider waits.
Send Only the Minimum Necessary
Meeting the procedural requirements does not authorize a full chart dump. HIPAA requires that any disclosure be limited to the minimum amount reasonably necessary to fulfill the request. If a subpoena asks for records from 2024, sending everything from 2018 forward violates that standard.
That means someone at the facility has to read the subpoena’s scope, pull records that fall within the specified date range and treatment categories, and remove anything outside it. The regulation requires providers to develop criteria for limiting disclosures and to apply those criteria to each request. A “just send the whole file” habit is an enforcement action waiting to happen.
Records a Subpoena Alone Cannot Reach
Some categories of health information carry protections that satisfactory assurances do not unlock. A subpoena response workflow has to flag these before anything moves.
Psychotherapy Notes
Psychotherapy notes have a uniquely protected status under HIPAA. These are the personal notes a mental health professional records during a counseling session and keeps separate from the rest of the medical record. They do not include medication records, session start and stop times, treatment plans, diagnoses, or progress summaries; those items are part of the regular medical record and follow the normal subpoena rules.
For the notes themselves, the provider must obtain the patient’s written authorization before disclosing them for almost any purpose, including in response to a subpoena. The exceptions are narrow: use by the originator for treatment, use by the provider to defend itself in a lawsuit brought by the patient, and disclosures required by law such as mandatory abuse reporting or duty-to-warn situations involving imminent threats. Outside those, a subpoena and satisfactory assurances are not enough. The patient has to sign.
Substance Use Disorder Treatment Records
Records from federally assisted substance use disorder treatment programs carry a separate layer of protection under 42 CFR Part 2. A 2024 final rule brought Part 2 into closer alignment with HIPAA effective February 16, 2026, allowing a single patient consent to cover future treatment, payment, and healthcare operations disclosures and permitting recipients to redisclose under standard HIPAA rules.
The key exception survives the alignment: substance use disorder records still cannot be used in legal proceedings against the patient without specific written consent or a court order meeting Part 2’s requirements. A Part 2 court order is harder to get than a typical discovery order. The court must find good cause, meaning that other ways of getting the information have been exhausted and that the public interest in disclosure outweighs the potential harm to the patient and the treatment relationship. In criminal cases against the patient, the bar climbs higher: the crime must be extremely serious, and the court must find a reasonable likelihood the records will yield information of substantial value to the prosecution. Any subpoena for these records needs a Part 2 analysis before a response goes out.
Log the Disclosure for the Accounting Requirement
Every patient has the right to request an accounting of who received their protected health information and why, covering the six years before the request. Records released in response to a subpoena under 45 CFR 164.512(e) have to be included.
For each disclosure, the provider must be able to produce the date, the recipient’s name and address, a brief description of what was disclosed, and a short explanation of why. When multiple disclosures go to the same recipient for the same purpose during the accounting period, the log can document the first disclosure in full and note the frequency and date of the last one.
Disclosures made with the patient’s written authorization and disclosures for treatment, payment, and healthcare operations are exempt from the accounting requirement. A subpoena disclosure fits neither category, so it goes in the log every time. A provider that doesn’t track these disclosures can’t fulfill an accounting request, and that failure is itself a violation.
Penalties for Getting It Wrong
Releasing records without satisfactory assurances, ignoring the minimum necessary standard, or disclosing psychotherapy notes without authorization can trigger both civil and criminal liability.
HHS enforces a four-tier civil penalty structure, with 2026 inflation-adjusted amounts applying to violations occurring on or after February 18, 2009. At the low end, a violation the provider did not know about and could not reasonably have known about starts at $145 per violation. Violations resulting from reasonable cause without willful neglect start at $1,461. Willful neglect corrected within 30 days of discovery ranges from $14,602 to $73,011 per violation. Willful neglect that is not corrected within 30 days ranges from $73,011 to $2,190,294 per violation, with an annual cap at the same top figure.
The jump between corrected and uncorrected willful neglect is where the real exposure sits. A provider that discovers a problem and fixes it promptly caps out at $73,011 per violation. One that sits on it faces a floor of $73,011 and a ceiling thirty times higher. Speed matters when something goes wrong.
Criminal prosecution is handled by the Department of Justice and targets individuals who knowingly obtain or disclose protected health information in violation of federal law. Penalties escalate with intent, running up to $50,000 and one year in prison for general violations, up to $100,000 and five years for offenses committed under false pretenses, and up to $250,000 and ten years for offenses committed for commercial gain or malicious harm. Criminal charges against a provider for mishandling a subpoena are rare; the more common targets are employees who snoop and individuals who obtain records under false pretenses. The civil exposure alone is enough to warrant careful handling.
State Law Adds a Second Layer
HIPAA is a federal floor, not a ceiling. State laws that provide stronger privacy protections are not preempted and apply on top of the federal requirements. In practice, the provider’s obligation is set by whichever rule is more protective of the patient.
Some states require providers to file a motion to quash rather than serve written objections. Others impose shorter response deadlines, require specific forms of notice to the patient, or extend heightened protections to categories of records beyond what HIPAA reaches. Mental health records, HIV/AIDS status, genetic testing results, and reproductive health records frequently carry additional state safeguards. A provider that follows HIPAA to the letter but misses a stricter state rule is still in violation. A subpoena response workflow has to account for both layers.