You want me to do what? Subpoenas for Confidential Medical Records

You want me to do what? Subpoenas for Confidential Medical Records

By: The Firm•

Healthcare practice today is more highly regulated than ever and is subject to an ever-increasing number of federal and state statutes and regulations. The average healthcare practitioner has neither the time nor the inclination to wade through the regulatory morass that is the current state of affairs. Unfortunately, however, the unprepared practitioner may find herself in this scenario without the guidance of competent counsel. More significantly, without appropriate legal direction, a well-intentioned practitioner may find herself on the wrong side of the law, even in the course of attempting to help out a patient.

Such a conundrum is perhaps nowhere more salient than in the context of the interplay between the undeniable—and federally-protected—confidentiality of medical records and compulsory service of process. A common scenario appears as follows: Healthcare Worker sees Patient regularly in the State of Maryland. During the course of treatment, Healthcare Worker receives a subpoena demanding that Healthcare Worker turn over the entirety of Patient’s medical record. What does Healthcare Worker do? Is she required to turn over Patient’s medical record? Is she permitted to speak with the person or entity propounding the subpoena? May she disclose any information concerning Patient? Is the industry in which Healthcare Worker is employed relevant to the inquiry? Is the purpose for which the medical record is sought important in determining whether and to what extent Healthcare Worker may—even must—hand over documents? Is it important or relevant who is requesting the medical record?

The reality is that resolution of these important questions depends on an in-depth understanding of state and federal confidentiality laws and procedures. Whereas Healthcare Worker may not ignore the subpoena, she is not required to produce or otherwise disclose the apposite medical record unless certain assurances are met. For example, Maryland’s Confidentiality of Medical Records Act requires that, in certain situations, a healthcare practitioner first receive written assurance that the patient whose medical records are sought has received notice of the subpoena and an opportunity to object (and that said objection, if any, has been resolved). See, e.g., Md. Code Ann., Cts. & Jud. Proc., § 4‑306. Even where disclosure pursuant to a subpoena is permitted or required, however, in certain situations only those portions of a patient’s medical record which are relevant to the purpose for which the records are sought may be disclosed. This means that, in certain scenarios, the healthcare practitioner must also understand the rationale underlying the compulsory process. This must be done, however, in such a way so as not to violate statutorily-protected client confidences, which prohibit most healthcare practitioners from disclosing or admitting that a given individual is even a patient of that practitioner. In addition to the foregoing, there are further statutory protections when a healthcare practitioner works in the field of mental health. Where mental health records are sought by compulsory process, not all types of records are required to be disclosed, and the records are subject to certain restrictions not applicable to other types of records.See, e.g., Md. Code Ann., Cts. & Jud. Proc., § 4‑307.

Complicating matters further is the federal Health Insurance Portability & Accountability Act of 1996, better known by the acronym “HIPAA.” HIPAA also governs the protection and confidentiality of medical records and, where more protective than applicable state law, preempts and overrides state law. Consequently, resolution of a particular inquiry regarding confidentiality requires a healthcare practitioner to compare the law of the state where she practices and/or the state from which the compulsory process has issued with HIPAA: where protection from disclosure under HIPAA is more restrictive, the healthcare practitioner follows HIPAA. HIPAA has its own set of rules for, among other things, the types of assurances a healthcare practitioner must receive prior to disclosing a medical record in response to a subpoena. See, e.g., 45 C.F.R. § 164.512.

Finally, there are an additional set of rules where records are sought for the purpose of investigating various crimes such as child abuse or neglect, or even abuse or neglect of a vulnerable adult. In such cases, although medical records are still privileged and protected, a healthcare practitioner may be subject to certain disclosure and reporting requirements—regardless of whether compulsory process ever issues. Failure to comply could potentially result in criminal or other civil and professional liability.

Intended as a primer and an illustration of the procedural, statutory, and regulatory quagmire in which healthcare practitioners regularly find themselves, the foregoing barely scratches the surface of some of the most pressing legal concerns confronting healthcare practitioners in their everyday practice. Successfully navigating the tributaries of state and federal privacy law requires more than being an adept and intelligent citizen; a healthcare practitioner requires the experience, understanding, and results-oriented focus of an attorney well-versed in these serious issues.

If you would like to learn more about Kelly|Dorsey’s business, litigation, and alternative dispute resolution practice groups, please fill out and send the Contact Form on our Contact Us page. You can also connect with Kelly|Dorsey through FacebookTwitter, and Linkedin. Attorney Darren H. Weiss can be reached via email at or telephone at (410) 740-8750.

No Comments

Sorry, the comment form is closed at this time.