The subpoena: the safe sequence before anything leaves the office

The answer: produce nothing yet — run the sequence first

The single most important move when a subpoena arrives is the one that feels wrong: do not send the records yet. A subpoena can look like a command that leaves you no choice, but HIPAA treats a subpoena and a court order very differently, and releasing a chart before you have checked which one you hold — and what protections attach to it — is how a clinician turns a routine legal request into a privacy violation 1Ref 1HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA lets a covered entity release only what a court order authorizes, while a subpoena without a court order requires the patient's authorization, satisfactory assurances of notice, or a qualified protective order before disclosure..

One threshold point first: this framework assumes you are a HIPAA covered entity, which the covered-entity test decides. Assuming you are, the safe sequence is short and you run it in order:

• Log the date received and the response deadline.
• Classify the document: court order, plain subpoena, or something else.
• Identify the patient and any heightened protections.
• Confirm the legal basis — authorization, satisfactory assurances, or a protective order.
• Notify the patient, and their attorney if represented.
• Call your own counsel or malpractice carrier; a subpoena is one of the clearest triggers for legal advice.
• Produce only the minimum necessary, and keep a copy of exactly what you sent.

The rest of this page is that sequence in detail. Note that the deadline is real: you have to respond on time, but a response can be an objection or a request for assurances — responding is not the same as handing over the chart.

First: is it a subpoena or a court order?

Everything downstream depends on this first question, because subpoena, order, warrant, and administrative demand each carry different obligations. A court order — signed by a judge — authorizes disclosure of exactly what the order specifies, and HIPAA permits you to release that and no more 1Ref 1HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA lets a covered entity release only what a court order authorizes, while a subpoena without a court order requires the patient's authorization, satisfactory assurances of notice, or a qualified protective order before disclosure.. A subpoena that is not accompanied by a court order — an attorney-issued subpoena, a notice of deposition, a records request arriving as a law-office letter — does not by itself authorize disclosure of protected health information under HIPAA.

For a plain subpoena, HIPAA requires one of three things before you disclose: the patient's valid authorization, satisfactory assurances that the patient has been notified and given a chance to object, or a qualified protective order — the mechanics are in the next two sections 1Ref 1HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA lets a covered entity release only what a court order authorizes, while a subpoena without a court order requires the patient's authorization, satisfactory assurances of notice, or a qualified protective order before disclosure.. A grand jury subpoena and an administrative subpoena or summons run under their own rules, and a search warrant is different again: it is executed on the spot rather than answered on a deadline.

Your state's rules of civil procedure and any therapist- or physician-patient privilege law sit on top of the HIPAA floor and can raise the bar further. The practical takeaway: read the document carefully enough to name it, because the name determines the path. If you genuinely cannot tell whether you are holding an order or a subpoena, that uncertainty is itself a reason to call counsel before the deadline, not after you have already produced.

The heightened protections: notes, substance-use, minors, the deceased

Some records are protected above the ordinary chart, and a subpoena that reaches them does not automatically override those protections. Psychotherapy notes — the clinician's separately kept process notes — sit outside the ordinary access framework and generally require the patient's specific authorization to release, so a bare subpoena rarely reaches them 2Ref 2HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That psychotherapy notes are excluded from the ordinary access framework and generally require specific patient authorization to release, so a bare subpoena rarely reaches them.. Substance-use disorder treatment records carry their own federal confidentiality regime with stricter release rules than HIPAA. And minors and incapacitated adults raise a prior question: who is even authorized to consent.

For a minor or an incapacitated adult, HIPAA defers to state law on who controls the records, treating the personal representative as the individual, with narrow exceptions in abuse or endangerment situations 3Ref 3HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's or incapacitated adult's records and treats the personal representative as the individual, so authorization or notice must come from the right person.. So the authorization or the notice has to come from the right person — and in a custody dispute, that authority is often contested, which is its own reason to route the request through counsel before releasing anything.

For a deceased patient, PHI stays protected for 50 years, and the personal representative of the estate exercises the rights 4Ref 4HHS Office for Civil Rights (2026).Health Information of Deceased Individuals.That a decedent's PHI remains protected for 50 years and the estate's personal representative exercises the access right, so a subpoena in a matter involving a deceased patient runs through that representative.; a subpoena in a matter involving a decedent still runs through that representative. Substance-use records get the stricter federal path. The rule of thumb across all of these: the more protected the record, the higher the bar the subpoena has to clear, and the more likely you need the patient's specific authorization or an actual court order rather than an attorney's subpoena.

Satisfactory assurances: notice or a protective order

For a subpoena without a court order, HIPAA gives you two lawful paths, and you may not disclose until one of them is satisfied. Either the requesting party provides satisfactory assurances that the patient has been given notice of the request and a chance to object with the court, or satisfactory assurances that the parties have agreed to a qualified protective order — one that limits use of the records to the litigation and provides for their return or destruction afterward 1Ref 1HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA lets a covered entity release only what a court order authorizes, while a subpoena without a court order requires the patient's authorization, satisfactory assurances of notice, or a qualified protective order before disclosure.. Absent either, the safe answer is to withhold and say why.

In practice, satisfactory assurances look like documentation: written proof that notice was sent to the patient or the patient's attorney with enough information to object, and that the time to object has passed or objections were resolved; or a copy of the signed qualified protective order. If the requester provides neither, you have options — ask them to supply the assurances, seek them yourself, or formally object.

The Privacy Rule permits these judicial-proceeding disclosures only under those conditions, and even then it still requires you to limit what you send to the minimum necessary for the stated purpose 5Ref 5HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits judicial-proceeding disclosures only under defined conditions and requires limiting any release to the minimum necessary for the stated purpose.. This is the step a rushed clinician skips most often — treating the subpoena's letterhead as if it were a judge's signature — and it is precisely the step that stands between you and an avoidable disclosure. Slow down here.

Notify the patient — and usually their attorney

Telling the patient a subpoena has arrived is usually both a courtesy and a safeguard, and often it is the very mechanism that produces the assurances HIPAA requires. If the patient is represented, their attorney is frequently the person who will move to quash the subpoena or negotiate a protective order — which means notice to the patient or counsel is not just polite, it is how the objection process actually happens 1Ref 1HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA lets a covered entity release only what a court order authorizes, while a subpoena without a court order requires the patient's authorization, satisfactory assurances of notice, or a qualified protective order before disclosure.. Reach out promptly, in writing, and document that you did.

Notice does real work. It lets the patient object, move to quash, or authorize the release on their own terms. It protects the therapeutic relationship — a patient who learns their clinician released records without a word is a patient you may lose and a board complaint you may earn. And it preserves privilege, which the patient, not you, ordinarily holds; releasing without giving them the chance to assert it can waive a protection that was theirs to keep.

There are narrow situations where notice is not permitted or would be dangerous — some grand jury or law-enforcement contexts, or where notice would endanger a person — which is another reason to route anything unusual through counsel rather than improvising. What you should not do is use "I will tell the patient" as a reason to let the response deadline pass. Do both: notify the patient and meet the deadline, even if meeting it means filing an objection.

What to produce, and how

When you have confirmed the legal basis and the protections, produce only what is actually authorized and no more — the minimum necessary to respond to the specific request, not the entire chart by reflex 5Ref 5HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits judicial-proceeding disclosures only under defined conditions and requires limiting any release to the minimum necessary for the stated purpose.. Match the production to the order's or the subpoena's scope: a request for treatment dates is not a request for the full record, and over-disclosing is itself a privacy problem even when some disclosure is proper. Keep a copy of exactly what you sent.

The mechanics matter as much as the decision:

• Certification. Provide a certified copy or an affidavit of custodian of records if the request asks for one.
• Scope and redaction. Withhold or redact third-party information and anything outside the request; produce a privilege log for anything withheld on privilege grounds.
• Channel and fees. Send through a secure channel, and if reasonable cost-based copy fees apply, invoice them rather than absorbing or inflating them.
• Disposal terms. If a protective order governs, honor its return-or-destruction terms when the matter ends — secure disposal such as shredding for paper.

Keep a disclosure log for every release: what was requested, the legal basis you relied on, what you disclosed, to whom, and when. That log is your accounting-of-disclosures record and your defense if the release is later questioned. If part of a subpoena reaches protected records without the right basis, the answer is rarely all-or-nothing: produce the permitted part and object to the rest.

A response decision path you can run from the front desk

Here is the sequence as a decision path you can run from the moment the envelope lands. Treat every "no" as a stop-and-check, not a stop-and-ignore — you still owe a timely response, but that response may be an objection or a request for assurances rather than a stack of records. When any branch is unclear, the correct next step is counsel, not a guess you cannot take back once the records are out the door.

The through-line is simple: a subpoena starts a process, it is not a handover. Run the path, keep the log, and involve counsel when a branch is unclear — that discipline is what keeps a routine legal request from becoming the board complaint or malpractice exposure that an over-eager release invites.