Guide

CPS Wants the Chart Without a Subpoena: What You May Release

Summary

A Child Protective Services records request that arrives without a subpoena carries no federal right to a client's therapy record. HIPAA permits a clinician to disclose protected health information to a government agency authorized by law to receive reports of child abuse or neglect, and permission is not a command. What can compel production is state law, which also decides whether therapist privilege survives a child protection investigation at all. Florida strips that privilege for communications involving an alleged perpetrator; California leaves the follow-up disclosure to the clinician's discretion.

By Gale Editorial · Updated 2026-09-01. Every figure cited to a dated source. How we write.

Does CPS have a right to the record without a subpoena?

No, not as a matter of federal law. HIPAA lets a covered clinician disclose protected health information to a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The permissive child abuse report channel at (b)(1)(ii) and its 'may disclose' framing; the narrower victim-of-abuse standard at (c) with its three conditions, its carve-out of (b)(1)(ii) reports and its duty to promptly inform the individual with two exceptions; and the (e) rules for a subpoena unaccompanied by a court order versus an order of a court or administrative tribunal.. The verb in that section is may: it permits a release and does not order one, and an investigator's urgency on the phone does not order one either.

What can compel production is the law of your state. Child protection statutes differ on the one question that decides this: whether therapist patient privilege survives a child abuse investigation at all. As of the May 2023 currency date of the federal compilation of those statutes, all but three states and Puerto Rico address privileged communications in their reporting laws, either affirming the privilege or denying it 2Ref 2Child Welfare Information Gateway (2023).Mandatory Reporting of Child Abuse and Neglect.That all but three states and Puerto Rico address privileged communications in their reporting laws, either affirming or denying the privilege, as of the publication's May 2023 currency date; and as the state-by-state lookup a clinician uses to find their own reporting statute..

Two things settle the answer before HIPAA is reached: who's asking for the therapy record, and whether the statute the investigator names reaches privilege in your state.

Which HIPAA permission the disclosure runs on

Two different permissions can cover a disclosure to a child protection agency, and they carry different duties. The child abuse report channel at 164.512(b)(1)(ii) covers a report to an agency authorized by law to receive one. A separate standard at 164.512(c) covers protected health information about a patient the clinician reasonably believes is a victim of abuse, neglect or domestic violence, and it is narrower 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The permissive child abuse report channel at (b)(1)(ii) and its 'may disclose' framing; the narrower victim-of-abuse standard at (c) with its three conditions, its carve-out of (b)(1)(ii) reports and its duty to promptly inform the individual with two exceptions; and the (e) rules for a subpoena unaccompanied by a court order versus an order of a court or administrative tribunal..

Under that narrower standard, disclosure to a protective services agency is permitted where the law requires it, or the individual agrees, or a statute expressly authorizes it and the clinician judges the disclosure necessary to prevent serious harm. Reports permitted by the child abuse channel are expressly carved out of it 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The permissive child abuse report channel at (b)(1)(ii) and its 'may disclose' framing; the narrower victim-of-abuse standard at (c) with its three conditions, its carve-out of (b)(1)(ii) reports and its duty to promptly inform the individual with two exceptions; and the (e) rules for a subpoena unaccompanied by a court order versus an order of a court or administrative tribunal..

The narrower standard also carries a duty the report channel does not. A covered entity that discloses under it must promptly inform the individual, with two exceptions: a professional judgment that informing the individual would place them at risk of serious harm, or a judgment that the person who would be told is a personal representative the clinician reasonably believes is responsible for the abuse 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The permissive child abuse report channel at (b)(1)(ii) and its 'may disclose' framing; the narrower victim-of-abuse standard at (c) with its three conditions, its carve-out of (b)(1)(ii) reports and its duty to promptly inform the individual with two exceptions; and the (e) rules for a subpoena unaccompanied by a court order versus an order of a court or administrative tribunal..

How much of the chart goes

Less than the request usually asks for. A permitted child abuse disclosure is still subject to minimum necessary: the covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the disclosure 3Ref 3U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The minimum-necessary standard at (b) and the closed list at (b)(2) of uses and disclosures it does not reach, which names disclosures required by law under 164.512(a) and does not name the permitted child abuse channel at 164.512(b)(1)(ii).. The standard's own exception list, the uses and disclosures it does not reach, names disclosures required by law under 164.512(a); it does not name the permitted child abuse channel at 164.512(b)(1)(ii) 3Ref 3U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The minimum-necessary standard at (b) and the closed list at (b)(2) of uses and disclosures it does not reach, which names disclosures required by law under 164.512(a) and does not name the permitted child abuse channel at 164.512(b)(1)(ii)..

So the whole chart is never the default answer to an investigative request, and a request phrased as the whole chart does not make it one. What a permitted disclosure carries is the information that serves the stated purpose, and the stated purpose is the allegation in front of you.

A common convention in solo practices is to write that purpose down in one sentence before choosing what to send, so the file later shows why each page went.

The psychotherapy notes lock, and what sits outside it

Psychotherapy notes need an authorization of their own, and the child abuse channel is not on the list that excuses it. Section 164.508(a)(2) requires a separate authorization for any use or disclosure of psychotherapy notes, and the closed exception list names 164.512(a), 164.512(d) as to oversight of the notes' originator, 164.512(g)(1) and 164.512(j)(1)(i) 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The separate-authorization requirement for psychotherapy notes at (a)(2) and the closed exception list at (a)(2)(ii), which names 164.512(a), 164.512(d), 164.512(g)(1) and 164.512(j)(1)(i) and does not name the child abuse channel, the victim channel or the subpoena provision at 164.512(e).. Neither 164.512(b)(1)(ii) nor 164.512(c) appears in it.

But most of what an investigator asks for was never psychotherapy notes to begin with. The definition expressly excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date 5Ref 5U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The definition of psychotherapy notes, including that it reaches notes analyzing a private counseling session kept separate from the rest of the medical record, and the items the definition expressly excludes: medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment, results of clinical tests, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date.. Those items sit in the record as ordinary protected health information, and the permissions above reach them.

The protection follows the document. It attaches to notes a mental health professional records documenting or analyzing the contents of a private counseling session, kept separate from the rest of the individual's medical record 5Ref 5U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The definition of psychotherapy notes, including that it reaches notes analyzing a private counseling session kept separate from the rest of the medical record, and the items the definition expressly excludes: medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment, results of clinical tests, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date.. Whether your own notes meet that description is worth settling before an agency calls.

When a subpoena does arrive

A subpoena on its own is not a release either. Where a request arrives as a subpoena, discovery request or other lawful process that is not accompanied by an order of a court or administrative tribunal, HIPAA permits disclosure only on satisfactory assurance that the patient was given notice, or that a qualified protective order was sought 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The permissive child abuse report channel at (b)(1)(ii) and its 'may disclose' framing; the narrower victim-of-abuse standard at (c) with its three conditions, its carve-out of (b)(1)(ii) reports and its duty to promptly inform the individual with two exceptions; and the (e) rules for a subpoena unaccompanied by a court order versus an order of a court or administrative tribunal.. So the subpoena moves the question rather than settling it.

Subpoena, order, warrant: they are three different instruments, and the regulation answers each one differently.

What arrives	What HIPAA asks before you may disclose
A CPS request naming the reporting statute	Nothing further under 164.512(b)(1)(ii); the permission stays discretionary 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The permissive child abuse report channel at (b)(1)(ii) and its 'may disclose' framing; the narrower victim-of-abuse standard at (c) with its three conditions, its carve-out of (b)(1)(ii) reports and its duty to promptly inform the individual with two exceptions; and the (e) rules for a subpoena unaccompanied by a court order versus an order of a court or administrative tribunal. and minimum necessary still binds 3Ref 3U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The minimum-necessary standard at (b) and the closed list at (b)(2) of uses and disclosures it does not reach, which names disclosures required by law under 164.512(a) and does not name the permitted child abuse channel at 164.512(b)(1)(ii).
A subpoena with no court order	Satisfactory assurance that the patient was given notice, or that a qualified protective order was sought 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The permissive child abuse report channel at (b)(1)(ii) and its 'may disclose' framing; the narrower victim-of-abuse standard at (c) with its three conditions, its carve-out of (b)(1)(ii) reports and its duty to promptly inform the individual with two exceptions; and the (e) rules for a subpoena unaccompanied by a court order versus an order of a court or administrative tribunal.
An order of a court or administrative tribunal	Only the protected health information the order expressly authorizes 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required.The permissive child abuse report channel at (b)(1)(ii) and its 'may disclose' framing; the narrower victim-of-abuse standard at (c) with its three conditions, its carve-out of (b)(1)(ii) reports and its duty to promptly inform the individual with two exceptions; and the (e) rules for a subpoena unaccompanied by a court order versus an order of a court or administrative tribunal.

When the subpoena says 'all records', that phrase sets the sender's scope. The regulation sets yours. Psychotherapy notes in a subpoena keep their separate authorization requirement, because the closed list at 164.508(a)(2) does not include 164.512(e), the subpoena and court order provision 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The separate-authorization requirement for psychotherapy notes at (a)(2) and the closed exception list at (a)(2)(ii), which names 164.512(a), 164.512(d), 164.512(g)(1) and 164.512(j)(1)(i) and does not name the child abuse channel, the victim channel or the subpoena provision at 164.512(e)..

Two states, two answers, and the lookup for yours

State law decides this question, and neighboring states decide it differently. Florida provides that privilege between a professional and their patient or client does not apply to any communication involving the perpetrator or alleged perpetrator in a situation involving known or suspected child abuse, abandonment or neglect, and that the privilege is not grounds for failing to cooperate with the department or to give evidence 6Ref 6Florida Legislature (2026).39.204 Abrogation of privileged communications in cases involving child abuse, abandonment, or neglect.Florida's abrogation of professional-client privilege for communications involving the perpetrator or alleged perpetrator in known or suspected child abuse, abandonment or neglect, the rule that privilege is not grounds for failing to cooperate with the department or to give evidence, and the express carve-outs for attorney-client privilege and section 90.505.. Attorney client privilege and the privilege at section 90.505 are expressly carved out.

California runs the other way on the same facts. Its reporting statute sets what the report itself must contain, then opens a follow-up channel that is permissive and bounded to the incident: information relevant to the incident of child abuse or neglect may be given to an investigator from the agency investigating the known or suspected case 7Ref 7California State Legislature (2026).California Penal Code § 11167 (Child Abuse and Neglect Reporting Act, Article 2.5).California's permissive follow-up channel at (b): information relevant to the incident of child abuse or neglect may be given to an investigator from the agency investigating the known or suspected case, alongside the required contents of the report itself at (a).. May be given, not shall be produced, and the statute does not name the chart.

For every other state, the reporting statute is the document to read, and the federal compilation is the fastest way into it. The Child Welfare Information Gateway's state statutes series on mandatory reporting sets out who must report and under what standard, state by state, and records whether the state affirms or denies privilege 2Ref 2Child Welfare Information Gateway (2023).Mandatory Reporting of Child Abuse and Neglect.That all but three states and Puerto Rico address privileged communications in their reporting laws, either affirming or denying the privilege, as of the publication's May 2023 currency date; and as the state-by-state lookup a clinician uses to find their own reporting statute.. Use it to find your own code section, then read the section itself. The compilation carries a currency date. Your own code section may have been amended since.

The hour after the call

Put the request in writing before you answer it. Asking the investigator to send it on agency letterhead, naming the statute they are proceeding under and the specific incident under investigation, is a common convention rather than a federal requirement, and it hands you the two facts the rest of this page turns on. It also puts the records request in the file, where a later reader can see what was asked and what went out.

Then log the disclosure the way you would log any other: the date, the permission you relied on, the pages that went, and the name of the person who received them. That log is what answers a board inquiry or a client's question two years later, and nothing reconstructs it after the fact.

Counsel earns its fee at three specific triggers. The agency asserts compulsory process you have not been shown. The request reaches a couples or family record where only one adult is the subject of the investigation. Or the matter has moved into a court proceeding, where privilege is argued rather than assumed.

A client's request to destroy records sometimes follows a disclosure like this one. It is a separate question with separate rules.

Common questions

Under federal law, yes. The child abuse reporting channel in HIPAA permits a disclosure without patient authorization, and a permission is not an obligation. Your state's reporting statute is the part that can convert a request into a duty, and Florida is one that does. Read your own state's section before you answer, and ask the agency to put the request in writing first.

Not on the strength of a child abuse request alone. Psychotherapy notes require their own authorization, and the closed list of exceptions to that rule includes neither the child abuse reporting channel nor the abuse victim channel. Most of what an investigator asks for falls outside the definition anyway: diagnosis, treatment plan, session start and stop times, medication monitoring and progress summaries are all excluded from it.

It depends which permission you used. A disclosure under the abuse, neglect and domestic violence victim standard carries a duty to promptly inform the individual, with two exceptions: a professional judgment that telling them risks serious harm, or that the person who would be told is a personal representative you reasonably believe is responsible for the abuse. The child abuse report channel is written without that duty.

Rarely, and never by default. The minimum necessary standard applies to a permitted child abuse disclosure, because the exception list that would switch that standard off does not reach the permitted reporting channel. Send what serves the stated purpose of the investigation, write down what you sent and why, and keep the agency's own request in the file beside it.

It settles privilege, which is one of two questions. Florida, for example, provides that privilege does not apply to communications involving an alleged perpetrator and is not grounds for refusing to cooperate with the department. HIPAA's minimum necessary standard still governs what you send, and psychotherapy notes still carry their separate authorization requirement. An abrogated privilege removes an objection; it does not set the scope.

It changes which HIPAA provision applies. A subpoena that arrives without a court order permits disclosure only on satisfactory assurance that the patient was given notice, or that a qualified protective order was sought. An order of a court or administrative tribunal permits disclosure of the protected health information that order expressly authorizes, and no more than that.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.U.S. Department of Health and Human Services (Office for Civil Rights) (2026). 45 CFR 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required. Electronic Code of Federal Regulations (eCFR), Title 45, Subtitle A, Subchapter C, Part 164, Subpart E. link ✓The permissive child abuse report channel at (b)(1)(ii) and its 'may disclose' framing; the narrower victim-of-abuse standard at (c) with its three conditions, its carve-out of (b)(1)(ii) reports and its duty to promptly inform the individual with two exceptions; and the (e) rules for a subpoena unaccompanied by a court order versus an order of a court or administrative tribunal.
2.Child Welfare Information Gateway (2023). Mandatory Reporting of Child Abuse and Neglect. Child Welfare Information Gateway (HHS ACF). link ✓That all but three states and Puerto Rico address privileged communications in their reporting laws, either affirming or denying the privilege, as of the publication's May 2023 currency date; and as the state-by-state lookup a clinician uses to find their own reporting statute.
3.U.S. Department of Health and Human Services (Office for Civil Rights) (2026). § 164.502 Uses and disclosures of protected health information: General rules.. Electronic Code of Federal Regulations (eCFR), Title 45, Subtitle A, Subchapter C, Part 164, Subpart E. link ✓The minimum-necessary standard at (b) and the closed list at (b)(2) of uses and disclosures it does not reach, which names disclosures required by law under 164.512(a) and does not name the permitted child abuse channel at 164.512(b)(1)(ii).
4.U.S. Department of Health and Human Services (2026). 45 CFR 164.508 - Uses and disclosures for which an authorization is required. Electronic Code of Federal Regulations (eCFR). link ✓The separate-authorization requirement for psychotherapy notes at (a)(2) and the closed exception list at (a)(2)(ii), which names 164.512(a), 164.512(d), 164.512(g)(1) and 164.512(j)(1)(i) and does not name the child abuse channel, the victim channel or the subpoena provision at 164.512(e).
5.U.S. Department of Health and Human Services (2026). 45 CFR 164.501 - Definitions. Electronic Code of Federal Regulations (eCFR). link ✓The definition of psychotherapy notes, including that it reaches notes analyzing a private counseling session kept separate from the rest of the medical record, and the items the definition expressly excludes: medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment, results of clinical tests, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date.
6.Florida Legislature (2026). 39.204 Abrogation of privileged communications in cases involving child abuse, abandonment, or neglect. The 2026 Florida Statutes, Title V, Chapter 39 (Proceedings Relating to Children). linkFlorida's abrogation of professional-client privilege for communications involving the perpetrator or alleged perpetrator in known or suspected child abuse, abandonment or neglect, the rule that privilege is not grounds for failing to cooperate with the department or to give evidence, and the express carve-outs for attorney-client privilege and section 90.505.
7.California State Legislature (2026). California Penal Code § 11167 (Child Abuse and Neglect Reporting Act, Article 2.5). California Legislative Information (leginfo.legislature.ca.gov), Penal Code, Part 4, Title 1, Chapter 2, Article 2.5. link ✓California's permissive follow-up channel at (b): information relevant to the incident of child abuse or neglect may be given to an investigator from the agency investigating the known or suspected case, alongside the required contents of the report itself at (a).

https://www.gale.care/for-providers/pq-cps-records-request-no-subpoena · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers