A Florida Medical Practice Received a Subpoena: What Should Happen Before Records Are Produced?
A subpoena addressed to a medical practice can look routine: identify the patient, copy the chart, and send it by the stated deadline. That approach is often unsafe.
A request for medical records may implicate HIPAA, Florida confidentiality statutes, physician-patient communications, psychotherapy or substance-use records, objections based on scope or burden, and duties to preserve information. The correct response depends on who issued the demand, what authority supports it, and what information is actually requested.
The first step is not production. It is classification.
Preserve the Request and Calendar Every Date
The practice should preserve the complete subpoena or request, including attachments, definitions, instructions, proof of service, correspondence, and any patient authorization. The response date, objection date, hearing date, and notice requirements should be calendared immediately.
Staff should not contact the requesting lawyer or agency informally to “explain” the records before counsel evaluates the demand. A well-intended conversation can disclose protected information, waive an objection, or create inconsistent statements about what exists.
The practice should also suspend routine deletion or overwriting of potentially responsive materials. The relevant information may extend beyond the clinical chart to billing data, portal messages, audit logs, appointment records, emails, call recordings, policies, or communications with a business associate.
Identify the Source and Legal Authority
Several documents may be called a subpoena even though they operate differently. The response analysis should identify whether the practice received:
A court order signed by a judge.
A subpoena issued by a clerk or attorney in civil litigation.
A criminal subpoena or grand-jury subpoena.
An administrative subpoena, summons, civil investigative demand, or licensing-board request.
A law-enforcement request.
A payer audit or contractual records demand.
A patient authorization or request for access.
A discovery request directed to a party in litigation.
The label does not answer whether disclosure is permitted or required. The practice should confirm jurisdiction, service, issuing authority, patient identity, and whether the proceeding described in the document actually exists.
A court order and an attorney-issued subpoena are not interchangeable. Under the HIPAA Privacy Rule, a covered entity may disclose protected health information in response to a court order, but the disclosure should be limited to the information expressly authorized by the order. 45 C.F.R. § 164.512(e)(1)(i) (2026).
A subpoena or discovery request not accompanied by a court order requires a different analysis.
HIPAA Does Not Treat Every Subpoena as Automatic Authorization
When a covered entity is not a party to the proceeding and receives a subpoena, discovery request, or other lawful process without a court order, HIPAA generally permits disclosure only after specified safeguards are satisfied.
The requesting party may provide satisfactory written assurances that reasonable efforts were made to notify the patient and that the time for objection passed without a protective objection, or that any objection was resolved consistently with the disclosure. Alternatively, the requesting party may provide satisfactory assurances that it sought a qualified protective order. 45 C.F.R. § 164.512(e)(1)(ii)–(v) (2026).
The covered entity may also make its own reasonable efforts to notify the individual or obtain a qualified protective order. The details matter. A cover letter saying that “HIPAA has been satisfied” is not a substitute for the documentation required by the regulation.
The U.S. Department of Health and Human Services specifically advises that a covered entity receiving non-court-ordered process should examine the required assurances and limit any disclosure to the minimum necessary. A practice should retain the documents supporting its conclusion that disclosure was permissible.
Florida Law Adds Its Own Requirements
HIPAA is not the only source of medical-record confidentiality. Section 456.057, Florida Statutes, protects records created by licensed health care practitioners in connection with patient examination or treatment.
In civil or criminal actions, the statute permits disclosure of such records upon issuance of a subpoena by a court of competent jurisdiction and proper notice to the patient or the patient’s legal representative, unless disclosure is otherwise prohibited. It also addresses compelled practitioner-patient communications at deposition, hearing, or trial after proper notice. Fla. Stat. § 456.057(7)(a)(3)–(4) (2026).
Licensed hospitals and certain facilities are governed by a separate statutory framework in section 395.3025, Florida Statutes. Specialized records may also be subject to additional federal or state protections.
The practice should therefore ask not only whether HIPAA permits disclosure, but whether Florida law or another applicable regime imposes a stricter condition. HIPAA generally establishes a federal floor and does not displace more protective state requirements.
Confirm That Any Authorization Is Valid and Sufficient
A patient authorization can provide a basis for disclosure if it satisfies applicable requirements and actually covers the requested information. The practice should review the patient name, recipient, description of information, purpose, expiration, signature, authority of any representative, and required statements concerning revocation and redisclosure. See 45 C.F.R. § 164.508(c) (2026).
An authorization for “medical records” may not necessarily resolve questions involving psychotherapy notes, substance-use-disorder records, genetic information, HIV-related information, or records concerning another person. The practice should identify the categories at issue rather than treat the chart as a single undifferentiated file.
A broad litigation release attached to a subpoena should be reviewed independently. The existence of an authorization does not require production of material outside its scope, and it does not eliminate valid objections to burden, privilege, or relevance.
Apply the Minimum-Necessary Standard
Where the minimum-necessary rule applies, the practice should make reasonable efforts to limit the disclosure to the information needed for the stated purpose. See 45 C.F.R. §§ 164.502(b), 164.514(d) (2026).
This requires more than selecting the correct patient. The practice should examine:
The date range.
The providers or locations involved.
The types of records requested.
Whether billing, clinical, imaging, or communication records are actually sought.
Whether unrelated treatment can be separated.
Whether records identify other patients or third parties.
Whether redaction is appropriate.
Whether a narrower production would satisfy the demand.
The minimum-necessary rule has exceptions, including certain disclosures required by law and disclosures to the individual, but those exceptions should be identified rather than assumed.
Do not send an entire chart merely because it is easier than conducting a responsive review. Overproduction can disclose years of unrelated medical information and create risk that cannot be undone.
Treat Law-Enforcement and Government Requests Separately
HIPAA contains specific provisions for law-enforcement disclosures. A court order, warrant, subpoena, summons, grand-jury subpoena, or administrative request may support disclosure under different conditions. See 45 C.F.R. § 164.512(f) (2026).
For an administrative subpoena, summons, civil or authorized investigative demand, or similar process, the requested information generally must be relevant and material to a legitimate law-enforcement inquiry, specific and limited in scope to what is reasonably practicable, and not reasonably available in deidentified form. 45 C.F.R. § 164.512(f)(1)(ii)(C) (2026).
The practice should verify the identity and authority of the requester. See 45 C.F.R. § 164.514(h) (2026). It should also determine whether the request signals a broader investigation involving billing, supervision, prescribing, data security, licensing, or another operational issue. Counsel may need to coordinate the records response with a wider internal investigation or preservation plan.
A government letter marked “voluntary” should not be treated as compulsory without analysis. Conversely, a compulsory demand should not be ignored merely because the practice disagrees with its scope.
Separate Responsive Business Records From Privileged Communications
The practice may possess communications with counsel, attorney work product, peer-review materials, quality-assurance records, credentialing materials, incident reports, or documents governed by other privileges or protections.
A responsive-document collection should preserve those materials without automatically producing them. Counsel should determine whether a privilege log, redaction, protective order, objection, or court review is appropriate.
The presence of privileged documents does not justify withholding an entire category of nonprivileged records. The response should distinguish the basis for each limitation.
Use a Controlled Collection and Production Process
One person should coordinate the response. That individual should work with counsel, the medical-records custodian, billing personnel, information technology, and relevant vendors. The process should document:
What repositories were searched.
Who conducted the search.
The date ranges and custodians used.
Any records that no longer exist and why.
Redactions and withheld categories.
The legal basis for disclosure.
The transmission method and recipient.
The exact materials produced.
Electronic records should be exported in a form that preserves relevant context without disclosing unnecessary system data. Passwords or secure transmission methods should be communicated separately. The practice should retain a duplicate of the production and the correspondence accompanying it.
If a business associate maintains responsive records, the practice should review the business associate agreement and coordinate collection. The vendor should not respond independently unless authorized and legally permitted to do so.
Object or Confer When the Demand Is Defective or Overbroad
A practice may have grounds to object, move for protection, seek clarification, or negotiate a narrower production. Possible issues include insufficient time, improper service, lack of jurisdiction, excessive breadth, undue burden, ambiguity, privilege, missing notice, defective authorization, or requests for records unrelated to the dispute.
The available procedure and deadline depend on the issuing forum. A telephone agreement to extend the deadline or narrow the request should be confirmed in writing.
The objective is not reflexive resistance. It is a response that is timely, legally authorized, proportionate, and documented.
The First Production Can Shape the Entire Matter
A disciplined response demonstrates that the practice understands its records, privacy duties, and operational controls. A rushed response can disclose protected information, invite broader follow-up demands, and create doubt about the reliability of the practice’s records.
The safest workflow is to classify the demand, preserve information, verify authority, analyze federal and Florida confidentiality rules, narrow the responsive universe, and document the production decision before transmitting anything.
Learn more about Equity Legal’s health care compliance practice at https://www.equitylegalfirm.com/healthcare-compliance.
Equity Legal, PLLC advises medical practices and health care businesses concerning subpoenas, medical-record requests, HIPAA disclosures, government inquiries, and related response strategy. Contact the firm at info@equitylegalfirm.com or request a confidential consultation at https://www.equitylegalfirm.com/contact-8 before producing sensitive records.
This article is for general informational purposes only and does not constitute legal or compliance advice. Reading it does not create an attorney-client relationship.
Comments