The law-office letter: authorization first, privilege always

Is an attorney's letter a court order?

Start by identifying what actually landed on your desk, because the three most common things an attorney sends carry very different obligations. A demand letter on law-office letterhead compels nothing by itself. A subpoena is a legal process, but a subpoena without a judge's signature is not the same as a court order. And a court order tells you to disclose exactly what it specifies — no more 1Ref 1HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA distinguishes a court order (disclose only what it authorizes) from a subpoena without a court order (disclose only with satisfactory assurances of notice or a protective order).. Naming the document sets everything that follows.

The mistake that costs licenses is treating a persuasive letter as an obligation to produce the chart. It isn't. Slow down long enough to classify the request, and the right next step becomes obvious.

Authorization first: the release that unlocks the file

For anything short of a court order, the key that unlocks the file is a valid, signed authorization from the client — not the attorney's word that the client consents. Under the Privacy Rule you may disclose protected health information to a third party only with that authorization or another permitted basis, and you release only the minimum necessary for the stated purpose 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits third-party disclosure only with authorization or another permitted basis and limits it to the minimum necessary.. The client also has a right to obtain their own records directly 3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That the client may obtain their own records within 30 days (one extension) for a cost-based fee, and that psychotherapy notes are excluded from the access right..

• The access timeline. When the client requests their own record, HIPAA gives you 30 days, with one 30-day extension, and permits only a reasonable, cost-based fee, in the form and format requested where you can produce it 3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That the client may obtain their own records within 30 days (one extension) for a cost-based fee, and that psychotherapy notes are excluded from the access right..
• Who signs matters. For a minor, who holds the authority to authorize a release depends on state law and who controls the record; teen records are not automatically the parent's to release 4Ref 4HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's or deceased client's records, with the personal representative treated as the individual.. For records after a client dies, the personal representative — often the executor of the estate — steps into the client's shoes 4Ref 4HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's or deceased client's records, with the personal representative treated as the individual..
• Two clients, two signatures. For couples records, a release generally needs every adult whose information is in the file, not just the one the attorney represents.

Psychotherapy notes aren't in the record you release

Psychotherapy notes are the trap in an attorney request. Under HIPAA they are the therapist's own process notes, kept separate from the rest of the record, and they require the client's specific authorization to disclose — a general records release does not reach them 5Ref 5HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are kept separate and require the client's specific authorization to disclose.. They are also excluded from the client's own right of access 3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That the client may obtain their own records within 30 days (one extension) for a cost-based fee, and that psychotherapy notes are excluded from the access right.. If you keep true psychotherapy notes, they do not travel with the chart you produce.

• Separate means separate. The protection depends on keeping these notes physically or logically apart from the medical record; notes folded into the progress note lose the distinction.
• Name the distinction in your response. When you release the record, state that psychotherapy notes are withheld absent a separate, specific authorization — do not silently drop them and hope no one asks.

If it's a subpoena, HIPAA adds a step

If what you received is a subpoena rather than a court order, HIPAA adds a gate before you disclose. For a subpoena not accompanied by a court order, you may release records only with satisfactory assurances that the requesting party has notified the client — giving them a chance to object — or has secured a qualified protective order 1Ref 1HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA distinguishes a court order (disclose only what it authorizes) from a subpoena without a court order (disclose only with satisfactory assurances of notice or a protective order).. A court order, by contrast, authorizes disclosure of only what the order names.

• Don't treat the subpoena as a green light. The subpoena obligates a response, not necessarily production; a timely objection or a motion to quash by the client's counsel can be the correct response.
• Document your assurances. Keep the notice or protective order that let you disclose, so the file shows why you released and what you withheld.

Substance-use records carry their own consent rules

Substance-use records can carry a second, stricter regime. If your practice is a federally defined Part 2 program, records identifying a client as having a substance use disorder require consent that meets Part 2's own standard, and redisclosure by the recipient is limited — protections that reach attorneys and courts, not just other providers 6Ref 6Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That Part 2 requires heightened consent and limits redisclosure for SUD records, with the 2024 rule aligning consent more closely with HIPAA.. The 2024 final rule aligned Part 2 consent more closely with HIPAA, but the heightened consent for SUD records remains 6Ref 6Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That Part 2 requires heightened consent and limits redisclosure for SUD records, with the 2024 rule aligning consent more closely with HIPAA..

• Confirm whether Part 2 applies. Not every clinician who treats substance use is a Part 2 program; the definition turns on how the program is held out and funded, so verify before you assume either way.
• A general authorization may not be enough. Where Part 2 governs, a routine records release does not satisfy its consent and redisclosure requirements.

Privilege is the client's, not yours

Privacy and privilege are different tools, and the difference decides your posture. Privacy law governs whether you may disclose; privilege governs whether the record can be used as evidence, and it belongs to the client, not to you. It is not yours to waive, and assuming it away is the error — assert confidentiality, disclose only the minimum necessary, and let the client's attorney or the court resolve whether privilege yields 7Ref 7National Association of Social Workers (2021).NASW Code of Ethics.The ethical duty to protect client confidentiality when handling records and disclosure requests..

The ethical duty to protect client confidentiality does not pause because a lawyer is involved 7Ref 7National Association of Social Workers (2021).NASW Code of Ethics.The ethical duty to protect client confidentiality when handling records and disclosure requests.. When you are unsure whether privilege has been waived, the safe posture is to say so in writing to the requesting party and produce nothing until the client's counsel or the court has spoken.

Your response sequence

Put it together as a sequence you run every time a legal request arrives. Identify the document, verify authorization, protect the special categories, satisfy the subpoena's assurances, and disclose only the minimum necessary — pausing for counsel at any step you cannot answer confidently. The same discipline governs law enforcement requests and requests about a client who has died: confirm the authority before you produce a page.

A workable order of operations:

1. Name the document — demand letter, subpoena, or court order 1Ref 1HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA distinguishes a court order (disclose only what it authorizes) from a subpoena without a court order (disclose only with satisfactory assurances of notice or a protective order).. 2. Require a valid authorization signed by the client or their representative before any voluntary release 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits third-party disclosure only with authorization or another permitted basis and limits it to the minimum necessary.. 3. Pull the special categories — withhold psychotherapy notes and Part 2 SUD records absent their own specific consent 5Ref 5HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are kept separate and require the client's specific authorization to disclose.6Ref 6Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That Part 2 requires heightened consent and limits redisclosure for SUD records, with the 2024 rule aligning consent more closely with HIPAA.. 4. For a subpoena, get your assurances — notice to the client or a protective order 1Ref 1HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA distinguishes a court order (disclose only what it authorizes) from a subpoena without a court order (disclose only with satisfactory assurances of notice or a protective order).. 5. Release the minimum necessary, log what went out and why, and keep a copy 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule permits third-party disclosure only with authorization or another permitted basis and limits it to the minimum necessary.. 6. When in doubt, get counsel — a records dispute is exactly the trigger where a solo clinician's own attorney earns the fee.