There is a common belief among the healthcare community that subpoenas calling for testimony or documents to be produced at trial do not need to comply with HIPAA. This misconception likely stems from the notion that the elicitation of testimony or disclosure of documents in a courtroom and in the presence of a judge is implicitly sanctioned or required by the judge. This is simply not the case.
In the absence of a valid authorization, HIPAA permits the disclosure of protected health information in response to a subpoena only if the subpoena is accompanied by an order OR the covered entity receives satisfactory assurances that reasonable efforts have been made to either (1) secure a qualified protective order, or (2) give the patient notice of the subpoena, and the patient has not objected. 45 C.F.R. 164.512(e)(ii). HIPAA makes no distinction between subpoenas issued for purposes of trial and those issued for purposes of obtaining pre-trial discovery. Disclosure of protected health information, even in the presence of a judge, must be accompanied by either the satisfactory assurances discussed above or a valid authorization. We have seen some tortured logic that tries to classify these subpoenas as orders, thereby forcing them under the provisions of 45 C.F.R. 164.512 (e)(1)(i). However, even these types of subpoenas may be challenged in open court and production of information conditioned on a ruling from the judge (i.e., an order).
If we return to one of the foundations upon which the HIPAA Privacy Rule was built - the drug and alcohol patient confidentiality provisions of 42 C.F.R. Part 2 - we see the requirement of an order, and not merely a subpoena for the production of this type of information. As the drafters of the Privacy Rule apparently "borrowed" the authorization provisions of the Privacy Rule from this regulation, it is no wonder that they borrowed the same general distrust of subpoenas for release of medical information in the litigation context.
A subpoena is not an order for purposes of the HIPAA Privacy Rule. Myth busted!