Handling Attorney Requests for Medical Records
By Dean McConnell
One of the challenges of being a medical provider is when your world intersects with the legal world. It can place you in situations where confusion and concern may arise when deciding the proper course of action. A common example is when health care providers receive medical records request from an attorney.
These requests can occur in a variety of forms:
When you are treating a patient involved in a motor vehicle accident, or a patient who is under investigation in a criminal situation such as a DUI or an assault and battery.
Custody battles between parents also result in requests for records from attorneys involved.
Requests may involve an attorney investigating whether to bring a medical malpractice claim.
Different legal rules may apply depending on who makes the request, whether it is an informal request or a subpoena, or if the request is tied to a criminal case.
All of this can be very confusing, and before taking any action, providers need to understand the details of their specific situation. In addition, providers should consider legal assistance to ensure they are abiding by the appropriate requirements that can vary by state.
Informal Requests Before a Lawsuit
Who usually requests the records: The patient or the patient’s attorney.
What to know: If the patient, or the patient’s personal representative1 asks that you send all or part of a medical record to an attorney, then the patient’s “right of access” under HIPAA applies and the records must be provided as soon as reasonably possible, but no later than 30 days.
If unusual circumstances exist beyond the control of the provider, such that the records cannot be produced within 30 days, one additional 30-day extension may be obtained by notifying the patient of the unusual circumstances and that an additional 30 days will be required.
If the informal request for medical information does not come through the patient, then the provider must have a HIPAA-compliant authorization, signed by the patient, before care is discussed or copies of records are provided.
Requests After a Lawsuit is Filed
Who usually requests the records: One or more of the attorneys involved.
Informal requests: A HIPAA-compliant authorization signed by the patient or the patient’s personal representative must be obtained before any information may be disclosed, oral or in writing.
Subpoenas: The provider will need to determine if it involves a civil lawsuit or a criminal case:
Most subpoenas involve civil lawsuits including motor vehicle accidents, premises liability claims, and divorce and child custody issues.
Subpoenas in criminal cases usually have a state or federal government entity or agency listed as a party and are signed by a deputy district attorney or assistant attorney general.
Out-of-State Subpoenas
Occasionally, providers receive subpoenas from out-of-state attorneys or record retrieval services.
Generally, a subpoena, whether civil or criminal, is not valid in any state except the state in which the action is pending (unless the attorney goes through a process to get a state court to issue a subpoena for the out-of-state proceeding). Providing records to an invalid subpoena could result in civil claims for breach of confidentiality and administrative action for violation of HIPAA.
Many providers are unfamiliar with the rules pertaining to responding to subpoenas. We encourage you to discuss these principles and educate your staff about properly responding to an attorney’s request for information. If you have any questions, it is recommended that you speak with an attorney or contact your medical liability insurance provider if they are able to provide assistance in these situations.
Dean McConnell JD, is Senior Legal Counsel with COPIC, a leading provider of medical professional liability insurance.
1 Under HIPAA, a person authorized to act on behalf of the patient in making health care related decisions is the patient’s “personal representative.” Typically, this is a person holding a medical power of attorney. An attorney does not usually have the authority to make healthcare decisions for a patient-client and would not normally be a “personal representative.”