When a patient threatens to sue: preservation, carrier notice, unchanged care

A threat is not a suit — but two things change today

A threat to sue is not a lawsuit, and the temptation to react — to defend yourself, edit a note, or end the relationship — is exactly what to resist. Nothing has been filed, no court deadline is running, and your clinical care should continue on its merits. What does change today is proactive and quiet: you preserve the record, and you notify your carrier. Everything else waits for information.

Most threats never become suits, and a calm, documented response is what keeps a bad afternoon from becoming a bad case. Read what you received — a letter, an email, a heated voicemail — and file it. Then work the two moves below in order, and let the medicine, the billing, or the privacy question underneath the threat tell you what the real dispute actually is.

Preserve the record; change nothing in it

The moment a threat is credible, treat the chart as evidence. Place a litigation hold — a common convention is simply to stop any routine purge and make no edits, additions, or deletions — and note the date you learned of the threat. If you believe a note is wrong or incomplete, do not fix it: a late edit to a record under threat is far more damaging than the imperfection it was meant to cure, and electronic systems log every change.

Preserve the surrounding material too — the threat letter itself, appointment history, messages, and billing records — because you do not yet know which piece matters. This is also the moment your ordinary documentation-standards pay off; if a decision was clinically sound, a contemporaneous note showing your reasoning and any informed refusal is worth more than anything you could add now. Custodian, not editor, is the posture.

Notify your carrier — the "circumstance" report

Call your malpractice carrier and ask whether the threat is a reportable circumstance. Many claims-made policies want notice of events that could ripen into a claim, and reporting early tends to protect the coverage rather than trigger a premium jump for a claim that never materializes. The carrier can also advise whether to say anything to the patient at all, and if a suit later lands, the file is already open and counsel is already thinking about it.

This is where your earlier coverage choices matter. Whether a policy is claims-made or occurrence changes how a circumstance report works; pre-suit notice requirements in some states can shorten your runway; and decisions like buying malpractice coverage, adding a provider to the policy, or leaving a carrier all interact with how a threat is handled. If any of those are in motion, tell the carrier now rather than after a complaint is served.

Keep the care clinically appropriate — don't retaliate

Do not let a threat change the medicine. Continuing appropriate care is both the ethical path and the defensible one; retaliating — abruptly discharging the patient, withholding a needed refill, or simply going cold — can create a second problem, abandonment, stacked on top of the first. A threat is not, by itself, grounds to end a relationship in anger.

If the relationship genuinely cannot continue, end it through a proper termination process: reasonable notice, help finding another provider, and coverage for urgent needs during the transition — not a same-day cutoff. And when a patient declines a recommendation, document it as an informed refusal, capturing what you advised and what they chose. That contemporaneous note protects the patient's autonomy and your defense at the same time, without a word of it being retaliatory.

A defensible termination, when one is truly warranted, generally includes a written notice with a reasonable end date rather than an abrupt cutoff, interim coverage for urgent needs during the transition, a clear path for the patient to obtain a copy of their records, and a referral or resource to help them find another provider. None of that changes because a threat was made — if anything, doing it cleanly is your strongest evidence that the exit was clinical rather than punitive. Keep the notice factual and unemotional, and file a copy with the rest of your preserved material.

When the threat is really about a bill

Often the phrase "I'll sue you" is really about a bill, and the forum may not be a courtroom at all. Under the No Surprises Act, uninsured and self-pay patients are owed a good-faith estimate before scheduled care, balance billing is restricted in defined settings, and there is a patient-provider dispute-resolution process for when a final bill substantially exceeds the estimate 1Ref 1Centers for Medicare & Medicaid Services (2026).No Surprise Billing.That the No Surprises Act requires good-faith estimates for uninsured and self-pay patients, restricts balance billing in defined settings, and creates a patient-provider dispute-resolution process — the likely forum when a threat is really about a bill.. The implementing regulation text spells out what the estimate must contain, its timing, and how the dispute works 2Ref 2Office of the Federal Register (2026).45 CFR Part 149 — Surprise Billing and Transparency Requirements.The operative regulation text for the good-faith-estimate content and timing requirements and the patient-provider dispute process..

So before a billing grievance escalates, check whether you met the estimate obligation and whether the patient's real remedy is the dispute process rather than a lawsuit. Offering or reissuing a clear good-faith estimate, and pointing the patient to the dispute pathway, resolves many of these threats on their own terms. Do not, however, waive or adjust a balance in a way that reads as an admission without running it past your carrier first.

When it's about privacy — and how you communicate

When the grievance is about a disclosure, a lost device, or a mis-sent message, run the analysis before you respond. A breach of unsecured PHI requires notice to the individual without unreasonable delay and no later than 60 days, and the Breach Notification Rule sets both that clock and the risk assessment that can rebut the presumption of a reportable breach 3Ref 3HHS Office for Civil Rights (2026).Breach Notification Rule.That a breach of unsecured PHI requires notice to individuals without unreasonable delay and no later than 60 days, and that a documented risk assessment can rebut the breach presumption — the analysis to run when a threat concerns a disclosure.. The Privacy Rule frames whether the use was permitted in the first place 4Ref 4HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule governs whether a use or disclosure of PHI was permitted in the first place, framing whether the conduct the patient is upset about was actually a violation..

How you communicate matters as much as what you conclude. Do not argue in writing, do not post publicly, and do not use the patient's information in any outward-facing way — the marketing rule bars using PHI for testimonials or promotion without authorization, which also means you cannot confirm someone is a patient in response to a review 5Ref 5HHS Office for Civil Rights (2026).Marketing.That HIPAA bars using PHI for marketing or testimonials without authorization, which is why a clinician cannot confirm a patient relationship or reference care when responding publicly to a review.. Keep replies minimal, factual, and — for anything substantive — routed through your carrier or counsel.