HHS advises how to handle patient info for lawsuits

Physicians should check HIPAA privacy rules when subpoenaed for patient records.

By Joel B. Finkelstein, AMNews staff. Feb. 7, 2005.

Washington -- Recently published federal guidance helps clarify when and how physicians should release patient information when it is requested for litigation.

The information spelled out in this new advice from the Health and Human Services Dept. falls under the Health Insurance Portability and Accountability Act's patient privacy protections.

For example, a physician who is not party to a lawsuit should know before giving up records that HIPAA requires that a good-faith effort be made to inform the patient that his or her medical records have been requested. The request could come via subpoena, discovery, board of medicine inquiry or other legal process. The patient also must be given sufficient time to respond, object or try to limit the scope of the request.

In many cases, a copy of the subpoena or request can serve as adequate notice.

But the privacy regulation left open the question of whether it is OK to release protected health information even if the notification was sent to the patient's lawyer and not directly to the patient, said Sharon Lee Johnson, an attorney at Stearns, Weaver, Miller, Weissler, Alhadeff & Sitterson in Miami.

The answer is yes, notification to the lawyer will suffice, according to the new guidance, which was published as an addition to HIPAA frequently-asked-questions materials.