Policy & Procedure

Your Company Logo/Name Here

FUNCTION

HIPAA / PRIVACY

NUMBER

RESPONDING TO A SUBPOENA
PRIOR ISSUE

EFFECTIVE DATE

PURPOSE To ensure that the Facility complies with HIPAA Privacy Rule requirements when a subpoena requesting Protected Health Information (PHI) is served. POLICY Protected Health Information may be disclosed pursuant to judicial or administrative process without the written authorization of the resident, or the opportunity for the resident to agree or object, subject to certain conditions. The Facility will disclose PHI in the course of judicial or administrative process in response to a court or administrative tribunal order. The Facility will disclose PHI in response to a subpoena, discovery request, or other lawful process that is not accompanied by a court order, subject to the conditions set forth in this procedure. In either case, the Facility will disclose only that PHI expressly authorized by the subpoena, discovery request, other lawful process, or court order. (The Facility may contact its legal counsel to review and verify the legality of a subpoena requesting PHI served.) PROCEDURE 1. 2. 3. If the subpoena or other lawful request is accompanied by an order of a court or administrative tribunal, the Facility will verify the identity and authority of the individuals requesting PHI. If the order of the court or other administrative tribunal is valid and meets the verification requirements, the Facility will disclose only that PHI expressly authorized by such order. If the subpoena, discovery request or other lawful process (subpoena) is not accompanied by a court order, the Facility will disclose the PHI only after obtaining satisfactory assurances from the party seeking the information that they have made reasonable efforts a. To notify the individual who is the subject of the requested PHI, or
1

Policy & Procedure

FUNCTION

HIPAA / PRIVACY

NUMBER

RESPONDING TO A SUBPOENA
PRIOR ISSUE

EFFECTIVE DATE

b. 4.

To secure a qualified protective order.

Notice to individual. Prior to disclosing PHI when the subpoena is not accompanied by a court order and there is no qualified protective order meeting the requirements of the Privacy Rule, the Facility will obtain a written statement and accompanying documentation from the requesting party that meets all of the following requirements: a. The written statement and documentation must demonstrate that reasonable efforts have been made to give notice of the request to the individual who is the subject of the requested PHI. The notice must contain sufficient information about the litigation or proceeding to permit the individual to raise an objection to the court or administrative tribunal. The written statement and accompanying documentation must demonstrate that: i. ii. iii. Time for raising objections to the court or administrative tribunal has elapsed, and No objections were filed, or The court has resolved all objections filed by the individual or the administrative tribunal and the disclosures being sought are consistent with such resolution.

b. c.

5.

Qualified Protective Order. A qualified protective order means an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: a. b. Prohibits the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which such information was requested; and Requires the return to the Facility or destruction of the PHI, (including all copies made) at the end of the litigation or proceeding.
2

Policy & Procedure

FUNCTION

HIPAA / PRIVACY

NUMBER

RESPONDING TO A SUBPOENA
PRIOR ISSUE

EFFECTIVE DATE

6.

Prior to disclosing PHI when the subpoena is not accompanied by a court order and the above notice requirements are not met, the Facility will obtain from the requesting party a written statement and accompanying documentation demonstrating that: a. The parties to the dispute giving rise to the request for PHI have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute, or The party seeking the PHI has requested a qualified protective order from such court or administrative tribunal.

b. 7.

If the requesting party is unable to meet the requirements for Notice or a Qualified Protective Order, the Facility will notify the requesting party that it is unable to comply with the subpoena. (See sample Response to a Subpoena letter following this Policy.) If the requesting party decides to pursue the request for the PHI without meeting the above requirements, the Facility Privacy Official will contact the Facilitys Legal Counsel for further direction. The Facility Privacy Official shall document the information regarding the subpoena or other legal process that requests PHI in an Accounting of Disclosures Log. The subpoena and any documents produced for the subpoena will be retained according to state and federal regulations.

8.

9. 10.

SAMPLE RESPONSE TO SUBPOENA NOT ACCOMPANIED BY A COURT ORDER AND LACKING SATISFACTORY ASSURANCES OF NOTICE OR QUALIFIED PROTECTIVE ORDER

[Date]

[Attorney Name and Address]

Re: [name of resident]

Dear [Attorney]: The subpoena you caused to be issued dated ___________ requesting copies of protected health information for _______________________ fails to comply with the applicable requirements of the HIPAA privacy regulations, specifically 45 CFR 164.512(e). As a covered entity, we are allowed to release health information only in accordance with these privacy regulations. Accordingly, we recommend you either secure an authorization in conformity with 45 CFR 164.508 directly from [name of resident or his/her personal representative] for release of the requested protected health information or take the following steps pursuant to 45 CFR section 164.512(e): a) b) Secure a Court Order detailing your specific needs pursuant to 45 CFR 164.512(e)(1)(i)); or Provide us with satisfactory assurance as described at 45 CFR 164.512(e)(1)(ii)(A) that you have made reasonable efforts to notify [name of resident] of your request for protected health information. This requires you to provide us with a written statement and accompanying documentation assuring us that you have made a reasonable effort to provide [name of resident] with a written notice of your request. This written statement you provide to us must also attest that the written notice you provided [name of resident] included: 1. Sufficient information about the litigation or proceeding in which the protected health information is requested to permit [name of resident] to raise an objection to the court or administrative tribunal; and that The time for [name of resident] to raise objections to the court or administrative tribunal has elapsed; and
4

2.

3. 4.

No objections were filed; or All objections filed by [name of resident] have been resolved by the court or administrative tribunal and the disclosures or protected health information being sought are consistent with such resolution; or you may

c)

Provide us satisfactory assurance as described at 45 CFR 164.512(e)(1)(iv) that you have made reasonable efforts to secure a qualified protective order that meets the requirements set forth at 45 CFR 164.512(e)(1)(v). The satisfactory assurance you provide us must include a written statement and accompanying documentation demonstrating that: 1. The parties to the dispute giving rise to the request for protected health information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute; or The party seeking the protected health information has requested a qualified protective order from such court or administrative tribunal.

2.

A qualified protective order, as the term is used in paragraph (c) above means: an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: a) b) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.

We respectfully ask that if you are not able to meet one of the identified exceptions above regarding disclosure of protected health information, thereby allowing us to release such information in a manner compliant with the regulations cited, that you withdraw your subpoena request until such time as one of the requirements can be met.

Sincerely,

[Privacy Official]

Cc: [Facility Director or administrator]