24/7 call for a free consultation 212-300-5196




When you’re facing a federal issue, you need an attorney whose going to be available 24/7 to help you get the results and outcome you need. The value of working with the Spodek Law Group is that we treat each and every client like a member of our family.

Federal Subpoenas for Medical Records: HIPAA Privacy Protections

Federal Subpoenas for Medical Records: HIPAA Privacy Protections

When federal agencies issue subpoenas for medical records, it can put healthcare providers in a tricky situation. On one hand, they have a duty to comply with valid legal requests. On the other hand, they also have a duty to protect patient privacy under HIPAA. This article will examine how HIPAA applies to federal subpoenas for medical records, including the notification requirements and permitted disclosures.

What is HIPAA?

HIPAA, or the Health Insurance Portability and Accountability Act, is a federal law that provides privacy protections for patient health information. The HIPAA Privacy Rule lays out requirements for how covered entities like doctors, hospitals, and health plans can use and disclose protected health information (PHI).

PHI refers to any information in a medical record that could identify the patient, including things like names, birthdates, social security numbers, diagnosis codes, and treatment details. Under HIPAA, patients have certain rights over their PHI, and healthcare providers have certain responsibilities to safeguard it.

When Can a Federal Agency Issue a Subpoena for Medical Records?

Federal agencies like the Department of Justice (DOJ), Drug Enforcement Administration (DEA), and Office of Inspector General (OIG) have authority to issue subpoenas as part of investigations. For example, they may issue a subpoena for medical records as part of a healthcare fraud investigation or drug diversion investigation.

The subpoena gives them the power to compel the production of documents, including protected health information. Healthcare providers that receive a federal subpoena for medical records are legally required to respond in a timely manner to avoid being held in contempt of court.

HIPAA Notification Requirements

Under HIPAA, a covered entity can only disclose PHI in response to a subpoena if certain notification requirements are met[1]:

  • The covered entity must notify the patient in writing that their PHI is being sought via subpoena.
  • This written notice must be sent to the patient prior to disclosing any PHI.
  • The patient must have an opportunity to object to the disclosure before it occurs.

These notification requirements apply even if the subpoena orders the covered entity not to inform the patient. HIPAA supersedes that, giving patients a right to object before their medical records are turned over.

Christine Twomey
Christine Twomey
Just had my Divorce case settled 2 months ago after having a horrible experience with another firm. I couldn’t be happier with Claire Banks and Elizabeth Garvey with their outstanding professionalism in doing so with Spodek Law Group. Any time I needed questions answered they were always prompt in doing so with all my uncertainties after 30 yrs of marriage.I feel from the bottom of my heart you will NOT be disappointed with either one. Thanks a million.
Brendan huisman
Brendan huisman
Alex Zhik contacted me almost immediately when I reached out to Spodek for a consultation and was able to effectively communicate the path forward/consequences of my legal issue. I immediately agreed to hire Alex for his services and did not regret my choice. He was able to cover my case in court (with 1 day notice) and not only was he able to push my case down, he carefully negotiated a dismissal of the charge altogether. I highly recommend Spodek, and more specifically, Alex Zhik for all of your legal issues. Thanks guys!
Guerline Menard
Guerline Menard
Thanks again Spodek law firm, particularly Esq Claire Banks who stood right there with us up to the finish line. Attached photos taken right outside of the court building and the smile on our faces represented victory, a breath of fresh air and satisfaction. We are very happy that this is over and we can move on with our lives. Thanks Spodek law 🙏🏼🙏🏼🙏🏼🙏🏼🙌🏼❤️
Keisha Parris
Keisha Parris
Believe every single review here about Alex Z!! From our initial consultation, it was evident that Alex possessed a profound understanding of criminal law and a fierce dedication to his clients rights. Throughout the entirety of my case, Alex exhibited unparalleled professionalism and unwavering commitment. What sets Alex apart is not only his legal expertise but also his genuine compassion for his clients. He took the time to thoroughly explain my case, alleviating any concerns I had along the way. His exact words were “I’m not worried about it”. His unwavering support and guidance were invaluable throughout the entire process. I am immensely grateful for Alex's exceptional legal representation and wholeheartedly recommend his services to anyone in need of a skilled criminal defense attorney. Alex Z is not just a lawyer; he is a beacon of hope for those navigating the complexities of the legal system. If you find yourself in need of a dedicated and competent legal advocate, look no further than Alex Z.
Taïko Beauty
Taïko Beauty
I don’t know where to start, I can write a novel about this firm, but one thing I will say is that having my best interest was their main priority since the beginning of my case which was back in Winter 2019. Miss Claire Banks, one of the best Attorneys in the firm represented me very well and was very professional, respectful, and truthful. Not once did she leave me in the dark, in fact she presented all options and routes that could possibly be considered for my case and she reinsured me that no matter what I decided to do, her and the team will have my back and that’s exactly what happened. Not only will I be liberated from this case, also, I will enjoy my freedom and continue to be a mother to my first born son and will have no restrictions with accomplishing my goals in life. Now that’s what I call victory!! I thank the Lord, My mother, Claire, and the Spodek team for standing by me and fighting with me. Words can’t describe how grateful I am to have the opportunity to work with this team. I’m very satisfied, very pleased with their performance, their hard work, and their diligence. Thank you team!
Anthony Williams
Anthony Williams
Hey, how you guys doing? Good afternoon my name is Anthony Williams I just want to give a great shout out to the team of. Spodek law group. It is such a honor to use them and to use their assistance through this whole case from start to finish. They did everything that they said they was gonna do and if it ever comes down to it, if I ever have to use them again, hands-down they will be the first law office at the top of my list, thank you guys so much. It was a pleasure having you guys by my side so if you guys ever need them, do not hesitate to pick up the phone and give them a call.
Loveth Okpedo
Loveth Okpedo
Very professional, very transparent, over all a great experience
Bee L
Bee L
Amazing experience with Spodek! Very professional lawyers who take your case seriously. They treated me with respect, were always available, and answered any and all questions. They were able to help me very successfully and removed a huge stress. Highly recommend.
divesh patel
divesh patel
I can't recommend Alex Zhik and Spodek Law Firm highly enough for their exceptional legal representation and personal mentorship. From the moment I engaged their services in October 2022, Alex took the time to understand my case thoroughly and provided guidance every step of the way. Alex's dedication to my case went above and beyond my expectations. His expertise, attention to detail, and commitment to achieving the best possible outcome were evident throughout the entire process. He took the time to mentor me, ensuring I understood the legal complexities involved to make informed decisions. Alex is the kind of guy you would want to have a beer with and has made a meaningful impact on me. I also want to acknowledge Todd Spodek, the leader of the firm, who played a crucial role in my case. His leadership and support bolstered the efforts of Alex, and his involvement highlighted the firm's commitment to excellence. Thanks to Alex Zhik and Todd Spodek, I achieved the outcome I desired, and I am incredibly grateful for their professionalism, expertise, and genuine care. If you're in need of legal representation, look no further than this outstanding team.

Permitted Disclosures

Once proper notification is given, HIPAA does permit some disclosures of PHI in response to a federal subpoena[2]:

  • The covered entity may disclose the specific PHI requested in the subpoena.
  • They may also disclose additional PHI if it is needed to identify the individual or put the information in context.
  • However, any PHI disclosed must be limited to the minimum necessary to comply with the request.

For example, if a subpoena requests John Doe’s medical records from January 1 – March 31, 2022, the provider may disclose records from that timeframe. They may also include a face sheet with John Doe’s name, DOB, address, etc. if needed to identify him. But they should not disclose John Doe’s full medical history without limitation.

Requirements for Law Enforcement

If the subpoena for medical records comes directly from a law enforcement official, HIPAA has some additional requirements[6]:

  • There must be a written statement that the information is relevant to a legitimate law enforcement inquiry.
  • The request must be specific and limited in scope.
  • De-identified information should be disclosed when possible.

For law enforcement, the minimum necessary standard does not apply. However, disclosures should not exceed what is reasonably relevant and necessary for their lawful purpose.

Responding to Improper Subpoenas

If a healthcare provider receives a subpoena that does not meet HIPAA requirements, they should not ignore it. The proper response is to file a motion to quash or modify the subpoena[3].

Reasons to quash or modify a subpoena may include:

  • It requests more records than reasonably needed
  • It fails to allow time for proper patient notification
  • It asks for records outside the statute of limitations
  • It seeks records that are privileged or protected

This allows the provider to comply with lawful requests while still upholding their duty to safeguard HIPAA rights. The court may decide to uphold or modify the subpoena accordingly.

Penalties for HIPAA Violations

If a covered entity does improperly disclose PHI in response to a subpoena, there can be stiff penalties under HIPAA[4]:

  • Fines of $100 to $50,000 per violation, up to a maximum of $1.5 million per year
  • Potential criminal charges if the violation was willful

Plus, the covered entity may be open to private lawsuits from patients whose privacy was violated.

That’s why it’s critical to take care in responding to subpoenas for medical records. Here are some best practices:

  • Carefully review the subpoena to ensure it is valid and enforceable. Check that it is signed by a judge and complies with state laws.
  • Notify the patient as required under HIPAA, even if the subpoena orders you not to. Give the patient a chance to file objections.
  • Only disclose the minimum necessary PHI to comply with the subpoena after notifying the patient.
  • If the subpoena is improper, file a motion to quash or modify it rather than ignoring it.
  • For law enforcement requests, ensure there is a written statement of need and that the request is specific and limited.
  • Consult with an attorney if you are unsure how to respond to a particular subpoena.
  • Document your response to the subpoena for your records.

Responding properly to subpoenas can be complex, but is important for complying with both HIPAA and legal obligations. Healthcare providers should develop clear policies and train staff on handling subpoenas. With the right preparation, covered entities can respond appropriately while still protecting patient privacy.


[1] https://www.camft.org/Resources/Legal-Articles/Chronological-Article-List/responding-to-a-subpoena

[2] https://www.norcal-group.com/library/taking-the-fear-out-of-responding-to-subpoenas-for-medical-records

[3] https://www.legal.io/articles/5170764/How-to-Respond-to-a-Third-Party-Subpoena-for-Documents

[4] https://www.reliasmedia.com/articles/138548-you-must-respond-carefully-when-you-are-served-with-a-subpoena

[5] https://www.apa.org/monitor/2016/07-08/ce-corner

[6] https://www.magmutual.com/learning/article/step-step-guide-responding-medical-record-subpoenas/

Schedule Your Consultation Now