HIPAA PRIVACY RULE
Disclosure Subpoenas
Health Insurance Portability and Accountability Act


What Happens if You Receive a Subpoena?

A sues B for personal injuries that A alleges were caused by B. A’s treating physician is C. Believing that C’s medical records regarding the diagnosis and treatment of A may be helpful in the preparation of the defense of A’s lawsuit, B’s attorney issues a subpoena duces tecum to Physician C directing Physician C to produce a copy of A’s medical records at the law offices of B’s attorney. Physician C is not a party in the lawsuit between A and B. B’s attorney is not seeking a court order to compel Physician C to turn over the records, but is seeking to compel disclosure solely through the subpoena duces tecum.

Is the subpoena duces tecum purporting to require Physician C to produce A’s medical records at B’s attorney’s law offices valid? Should Physician C comply with the subpoena? Will Physician C risk violating the HIPAA Privacy Rule if he complies with the subpoena?

"Disclosure" is the process by which trial lawyers prepare for a trial and inform themselves of the adversary’s position and evidence. Article 31 of the Civil Practice Law and Rules (CPLR) governs the use and disclosure procedures in the discovery of information from other parties and non-party witnesses in civil proceedings.

Whether the subpoena duces tecum served on Physician C who is a non-party witness is valid depends upon when the subpoena duces tecum was served. On September 24, 2002, Governor Pataki signed a new law that is designed to simplify the process of obtaining disclosure from non-party witnesses.1 The new law takes effect on September 1, 2003. Whether the subpoena duces tecum was served on a non-party witness, such as Physician C, on or after September 1, 2003, may likely determine whether the service of the subpoena duces tecum was proper.

[This article solely addresses the use of a subpoena for disclosure purposes and does not address a subpoena issued in conjunction with a trial or hearing. A subpoena (for testimony) or a subpoena duces tecum (for documents) for use at trial, generally, does not raise the concerns as a subpoena or subpoena duces tecum for disclosure purposes. When a subpoena is used to require testimony at a trial or hearing, or when a subpoena duces tecum is used to compel the subpoenaed party to produce documents at a trial or hearing, the subpoena or subpoena duces tecum merely directs the subpoenaed party to be present or to have documents in court so that the court may make appropriate direction with respect to the testimony or the use of the documents. The adverse party is present at the trial or hearing and has an opportunity to raise objections to the testimony or production of documents, e.g. claim that medical records are protected by physician-patient privilege. The court can rule on objections. If a subpoena or subpoena duces tecum is improperly used during disclosure, however, the adverse party may not be aware of the subpoena and has no opportunity to raise objections.] 

I. Subpoena Duces Tecum Served Prior to September 1, 2003 Where a party seeks to obtain disclosure from a non-party witness, Article 31 of the CPLR provides differing procedures depending upon whether a deposition is sought from the non-party witness. A deposition is testimony taken under oath, other than at trial or hearing. Depositions are often referred to as “examinations before trial” (EBTs). A. No Deposition Sought; Non Party Witness is Directed to Produce Documents The far more common situation is that the party does not seek to take the deposition of the non-party witness but only seeks to compel the non-party witness to produce documents. This is the hypothetical situation described above involving A, B, B’s attorney and Physician C. CPLR 3120(b) governs this situation. CPLR 3120(b) provides: “(b) As against non-party. A person not a party may be directed by order to do whatever a party may be directed under subdivision (a). The motion for such an order shall be on notice to all adverse parties; the non-party shall be served with the notice of motion in the same manner as a summons. The order shall contain, in addition to such specifications as the notice is required to contain under paragraph two of subdivision (a), provision for the defraying of the expenses of the non-party”. As described above, as against a non-party witness, a motion must be made for a court order. The notice of the motion for a court order must be on notice to all adverse parties. The requirement of notice to adverse parties is intended to enable any adverse party to oppose the motion for the court order if any adverse party has any legal objection to the motion. In the hypothetical situation described above, B’s attorney failed to comply with CPLR 3120(b). Instead of seeking a court order to compel Physician C to produce A’s medical records and notifying all adverse parties of such motion, B’s attorney served a subpoena duces tecum on Physician C, and the opposing party, B, was not notified of the subpoena. The use of the subpoena duces tecum to attempt to compel disclosure from a non-party to a proceeding, without adherence to CPLR 3120(b) is both improper and abusive, and has been criticized by the courts. Frequently, courts have imposed sanctions against the attorney for such practice.2

2.  If Physician C complied with the invalid subpoena, Physician C could risk charges that he violated the HIPAA Privacy Rule. The HIPAA Privacy Rule at §164.12(e) lists circumstances which a covered entity may disclose protected health information without patient authorization for judicial and administrative purposes. Under the rule, covered entities may disclose protected health information in response to a court or administrative order, provided that only the protected health information expressly authorized by the court or administrative order is disclosed. Covered entities may also disclose protected health information in response to a subpoena, discovery request, or other lawful process without a court or administrative order, but only if the covered entity receives satisfactory written assurances that the party seeking disclosure has made reasonable efforts to ensure that the individual has been notified of the request or that reasonable efforts have been made by the party seeking the information to secure a qualified protective order.3 In the hypothetical situation, B’s attorney neither sought a court order nor provided any written assurance required by 164.512(e). 

While the failure of attorneys to comply with CPLR 3120(b) may sometimes be deliberate, it is believed that the failure of attorneys to comply with CPLR 3120(b) is more often the result of the attorney’s error. 

B. Deposition is Sought from the Non-Party Witness 
A court order is not required to take the deposition of a non-party witness. All that is required is a subpoena. The subpoena must be served on the non-party witness at least 20 days before the deposition.4 The party seeking to take the deposition of the non-party witness, generally, must also give 20 days notice to all other parties advising them of the place and time of the deposition.5 The requirement to give notice to other parties is intended to enable other parties to seek judicial remedy, such as a protective order or a motion to quash the subpoena, if it is believed that the subpoena is defective. 

The non-party witness who is subpoenaed to give a deposition may also be required to bring books, papers or other documents to be used in conjunction with the deposition. 

Some attorneys have sought to avoid the need to obtain a court order required under CPLR §3120(b) to compel a non-party witness to produce documents by subpoenaing the non-party witness to provide a deposition coupled with a document demand, but then canceling the deposition upon advance production of the documents. The practice has been harshly criticized by the courts. In Beiny, an attorney served a subpoena to secure the production of privileged documents. The subpoena required a non-party witness to give a deposition at the attorney’s office. The subpoena required the non-party witness to produce documents that would be used during the deposition. The attorney did not notify any of the adverse parties of the subpoena. The attorney cancelled the deposition when the documents, which were to be produced in conjunction with the deposition, were delivered one week prior to the scheduled deposition. When the opposing counsel learned of the practice, the opposing party sought court sanctions, and the court issued sanctions. The Appellate Division referred to the attorney’s practice as "… a deliberate and thoroughly unprincipled effort to obtain a litigational advantage by whatever means seemed useful, including deceit."6

The CPLR applies to civil proceedings, not criminal proceedings. This article does not apply to subpoenas issued in connection with criminal proceedings. II. Subpoena Duces Tecum Served On Or After September 1, 2003. Pursuant to Chapter 575 of the laws of 2002, the current requirement that a court order be obtained to require a non-party witness to produce documents, is eliminated. Under the new law, an attorney may simply issue a subpoena duces tecum requiring the non-party to produce documents. The party issuing the subpoena duces tecum must at the time serve a copy of the subpoena upon all other parties. Also, the party issuing the subpoena, within 5 days of compliance with the subpoena, must notify each party of the items produced in response to the subpoena duces tecum and that they are available for inspection and copying. The time and place for inspection and copying must be stated. Any party or the non-party witness served with the subpoena duces tecum may file written objections to the subpoena within 20 days of the service of the subpoena. The party seeking disclosure may then move for a court order to compel disclosure. The new law contains safeguards to protect medical records. CPLR 3122 includes language that reads: “A medical provider served with a subpoena duces tecum requesting the production of a patient’s medical records pursuant to this rule need not respond or object to the subpoena if the subpoena is not accompanied by a written authorization by the patient. Any subpoena served upon a medical provider requesting the medical records of a patient shall state in conspicuous bold faced type that the records shall not be provided unless the subpoena is accompanied by a written authorization by the patient.” This article is not intended as legal advice. It is not the purpose of this article to advise a physician what course to take in response to a subpoena. A physician served with a subpoena should consult personal counsel. 

1 Chapter 575 of the Laws of 2002.
2 E.g. see Matter of Beiny v. Wynyard 129 A.D. 2d 126, 517 N.Y.S. 2d 474 (App. Div., 1st Dept. 1987); Appeal dismissed 71 N.Y. 2d 994, 529 N.Y.S. 2d 277 (1988) Safchik v. Board of Education 158 A.D. 2d 277, 550 N.Y.S. 2d 679 (1st Dept. 1990); Estate of Kochovos 140 A.D. 2d 180, 528 N.Y.S. 2d 37 (1st Dept. 1988). Brussels Leasing v. Henne 174 Misc. 2d 535, 664 N.Y.S. 2d 905 (Sup. Ct., Queens Co. 1997)
3 45 C.F.R. §164.512(e) 
4 CPLR §3106 
5 CPLR §3107 
6 129 A.D. 2d at 136