For litigators and criminal defense attorneys, it’s not uncommon for a case to involve “protected health information” during discovery. If you need to issue a subpoena for this information, you probably will run into a significant objection if the party you are requesting information from is subject to HIPAA. HIPAA governs what “covered entities” can disclose in response to a subpoena and under what circumstances those disclosures can be made. The federal regulations under HIPAA clarify when a covered entity is permitted to disclose protected health information in response to a subpoena.
Under 45 CFR § 164.512 (e), there is a standard allowing disclosures for judicial and administrative proceedings. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding in response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal under certain circumstances. In other words, if there’s no explicit court order, and only a subpoena from one party to the case, there’s a couple things that should also happen:
1) The covered entity should receive “satisfactory assurance”, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; OR
2) The covered entity receives “satisfactory assurance” from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section.
What is Satisfactory Assurance?
Satisfactory assurances should be considered to have been provided in one of two ways.
If the covered entity receives from such party a written statement and accompanying documentation demonstrating that:
1) The party requesting such information has made a good faith attempt to provide written notice to the individual (or, if the individual’s location is unknown, to mail a notice to the individual’s last known address);
2) The notice included sufficient information about the litigation or proceeding in which the protected health information is requested to permit the individual to raise an objection to the court or administrative tribunal; and
3) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and:
4) No objections were filed or any objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution.
Satisfactory assurance can also be provided if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:
1) The parties to the dispute giving rise to the request for information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute; or
2) The party seeking the protected health information has requested a qualified protective order from such court or administrative tribunal.
When is a Protection Order Enough?
The federal regulations require a qualified protective order. Qualified protection orders with respect to protected health information requested under paragraph (e)(1)(ii) of this section, are defined as orders of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that:
1) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and
2) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.
Catch All Disclosures
Last but certainly not least, the regulations encompass a catch-all category of sorts permitting disclosure even without “satisfactory assurance” if the covered entity makes reasonable efforts to provide notice to the individual sufficient to meet the requirements or to seek a qualified protective order sufficient to meet the requirements. In other words, the coveted entity themselves can attempt to notify the person whose information is requested or seek a protective order as opposed to relying on the party issuing the subpoena.
Speak to a Trial Lawyer Today!
Unfortunately, cases taking place often involve other parts of the federal regulations and this section specifically states that it is not intended to override any other restrictions so speak with your trial lawyer or criminal defense attorney if your case involves protected health information under HIPPA. You should also bear in mind that certain states have stricter laws than federal regulation so be sure to consult with local counsel.