Responding to Subpoenas for Health Department Records

More documents

Recommendations

Info

Health Law Bulletin No. 82 September 2005patient’s permission or an order issued by ajudge or the Industrial Commission.The department must review and comply with allof these laws. While the first two laws identifiedabove would likely allow disclosure of information inresponse to a subpoena (as long as HIPAA’sconditions are satisfied), the third law would not.Therefore, the department must await a court orderbefore disclosing the information requested in thesubpoena.This example highlights an important and highlyrestrictive state law—the physician-patient privilege.It is important for health departments to rememberthat information subject to this privilege (or otherprivileges such as the nurse privilege 44 ) must not bedisclosed in response to a subpoena. Either a courtorder or the patient’s permission is required by statelaw.Once the health department has evaluated theconfidentiality laws that apply to the requestedrecords, it must decide how to respond. The responsewill depend on whether the subpoena is accompaniedby an authorization from the patient.Question 28. How should I respond if thesubpoena for confidential medical recordsis accompanied by an authorization formsigned by the patient?Occasionally an attorney will send anauthorization form with a subpoena. In such cases, ifthe accompanying authorization form is valid (seediscussion below), you should disclose the records asdirected in the subpoena or authorization form. Forexample, if an assistant district attorney is gatheringevidence for a domestic violence prosecution and isseeking copies of the victim’s medical records fromthe health department, the attorney may be able toobtain the victim’s authorization to obtain copies ofthe records. 45When presented with a subpoena and anauthorization form (or an authorization form byitself), a health department should review theauthorization form to determine whether it complies44. G.S. 8-53.13.45. Note that, unless a specific law providesotherwise, district attorneys and other lawyers with publicagencies are subject to the same limitations on theirauthority to obtain information as private attorneys. Theirstatus as public officials or public servants does notestablish additional rights of access to information.with all applicable legal requirements. One of themost specific laws in this regard is the HIPAAPrivacy Rule. For medical information subject to thatlaw, an authorization form must include thefollowing core elements to be valid:• A specific description of the information tobe disclosed• The name of the person or organizationauthorized to disclose the information• The name of the person or organizationauthorized to receive the information• A description of the purpose of thedisclosure 46• An expiration date or event 47• The signature of the patient or the patient’srepresentative 48• A statement explaining the patient’s right torevoke the authorization• A statement explaining the department’sability or inability to place conditions upon apatient’s decision to sign the authorization 49In addition to specifying these core elements, theHIPAA Privacy Rule imposes additionalrequirements and restrictions on authorizationforms. 50 Because of these strict requirements, healthdepartments should either insist upon using their ownHIPAA-compliant authorization forms or carefullyreview authorization forms from other sources toensure that they meet all of HIPAA’s requirements.If the form complies with all applicable laws, thehealth department should disclose the records to theperson specified in the authorization. For example,the authorization form may request that copies of therecords be sent directly to the requesting attorney.46. If the patient initiates the authorization and doesnot wish to describe the purpose of the disclosure, the formmay state “at the request of the individual.” 45 C.F.R.164.508(c)(1)(iv).47. The expiration date or event must relate either tothe individual or to the purpose of the disclosure. 45 C.F.R.164.508(c)(1)(v).48. If it is signed by a patient’s representative, theform must also describe the representative’s authority to actfor the individual (such as “parent,” “guardian,” or “powerof attorney”). 45 C.F.R. 164.508(c)(1)(vi).49. The HIPAA Privacy Rule limits a provider’sability to condition treatment, payment, or enrollment oreligibility for benefits on the authorization. 45 C.F.R.164.508(b)(4).50. 45 C.F.R. 164.508(b).14
September 2005 Health Law Bulletin No. 82If an attorney sends the health department a validauthorization form but no subpoena, the departmentmay still disclose the records. A subpoena istechnically not necessary. The authorization formalone provides sufficient authority for the healthdepartment to disclose confidential information to anattorney or the court.Question 29. How should I respond if thesubpoena for confidential medical recordsis not accompanied by an authorizationform?If the subpoena requests information that issubject to a confidentiality law that requires a courtorder or patient permission, such as the physicianpatientprivilege, the health department should notautomatically disclose the information. It must,however, respond to the subpoena. As a first step, thedepartment (or the department’s attorney) maycontact the attorney requesting the records andexplain that they are confidential. The requestingattorney may choose to withdraw the subpoena ormay take the necessary steps to authorize disclosure(such as obtaining a court order or permission fromthe person who is the subject of the records). If thatdoes not happen, the health department should eithercontest the subpoena (discussed in Question 23,above) or appear at the proceeding with the recordsand await further direction from the court (discussedbelow). You may follow either approach whensubpoenaed to a proceeding in court. 5151. Revised Rule 45(c)(5) establishes a time limit formoving to quash or modify a subpoena that is served morethan ten days before the proceeding—namely, such amotion must be made within ten days of service. (The rulewas not materially revised for subpoenas served less thanten days before the proceeding—the responding party maystill raise challenges at the time of the proceeding.) In ourview, if a subpoena for confidential records is served morethan ten days before a court proceeding, a custodian maybut is not required to make a motion to quash. A custodianstill may bring the records to the proceeding, as directed bythe subpoena, and await further direction from the courtbefore disclosing them. We believe this to be so for tworeasons. First, a custodian who produces records in thismanner is not seeking to quash or modify the subpoena.Nor is the custodian disregarding the subpoena. Rather, thecustodian is seeking to comply with the subpoena’scommands without violating confidentiality laws. Second,confidentiality laws are not personal rights of the custodian,which the custodian may waive by not making a motion toIf you appear at the proceeding with therequested records, you should not immediately turnthem over to the subpoenaing attorney or the court.Because the records are confidential, the healthdepartment has a duty to take affirmative steps toensure that the records are only disclosed aspermitted by law. The exact way to handle eachsituation will depend on the confidentiality laws thatapply, but the approach will be similar in mostinstances. For example, a health department mayreceive a subpoena directing the records custodian toappear in court with certain patient records that areprotected by the physician-patient privilege. Thephysician-patient privilege law allows a district orsuperior court judge to order disclosure of records ifhe or she finds that disclosure is “necessary to theproper administration of justice.” 52 In this situation,the custodian may appear in court with the requestedrecords on the date and at the time specified in thesubpoena. The custodian should not release therecords ahead of time to the party who issued thesubpoena.Once the proceeding begins and the custodian isasked for the records, the custodian should explain tothe judge that the records are protected by thephysician-patient privilege and that a court order isrequired to disclose them. If the records containsensitive information, the custodian (or an attorneyrepresenting the custodian) may request that thejudge review the records in camera—that is, inprivate, in his or her chambers—before decidingwhether to release them. 53 If the records are notquash. Rather, they establish the conditions under whichdisclosure may be ordered by a court (or would bepermissible without a court order, as when the subject ofthe records properly consents to disclosure). In contrast,other grounds for withholding documents in response to asubpoena, such as undue burden, are personal to the recordscustodian and may be waived if not timely asserted.52. G.S. 8-53.53. See, e.g., Pennsylvania v. Ritchie, 480 U.S. 39(1987) (discussing procedure); Zaal v. State, 602 A.2d1247 (Md. 1992) (court may conduct review of records inpresence of counsel or permit review by counsel alone, asofficer of court, subject to restrictions protectingconfidentiality); see also Rios v. Read, 73 F.R.D. 589(E.D.N.Y. 1977) (judge may require in disclosure order thatparties who receive records not reveal their contents exceptto those connected with litigation). In the context ofinformation related to communicable diseases, stateconfidentiality law authorizes in camera review if it isrequested by the subject of the information. See G.S. 130A-143(6).15
Page 1 and 2: HEALTH LAWNumber 82 September 2005R
Page 3 and 4: September 2005 Health Law Bulletin
Page 13: September 2005 Health Law Bulletin
Page 19: September 2005 Health Law Bulletin
Page 22: Health Law Bulletin No. 82 Septembe

Responding to Subpoenas for Health Department Records

Create successful ePaper yourself

Delete template?

Save as template?