HIPAA Subpoena Response: Court Order vs Administrative Subpoena (45 CFR § 164.512)

If you received a subpoena for patient records, do not produce anything before identifying the type. HIPAA's disclosure rules at 45 CFR § 164.512 treat court orders, civil subpoenas, grand-jury subpoenas, DEA administrative demands, and state public-health requests under different sub-sections. The wrong response path is itself a HIPAA violation, regardless of whether the underlying records are eventually produced.

Identify the subpoena type

What practices most often confuse is the difference between a court-issued order (must respond, generally as written) and a civil or administrative-tribunal subpoena that triggers the satisfactory-assurances analysis under 45 CFR § 164.512(e)(1)(ii). Law-enforcement administrative subpoenas (DEA, OIG, federal grand jury) follow a separate sub-section at 45 CFR § 164.512(f)(1)(ii)(C) — § 164.512(e) does not apply to them. The four categories that drive the response path:

• Court order or court-ordered subpoena under 45 CFR § 164.512(e)(1)(i). Signed by a judge. Disclose what the order expressly authorizes — no more.
• Civil subpoena (party-issued, no court order) under 45 CFR § 164.512(e)(1)(ii). Most common; arrives from a private attorney. Production is not permitted on the subpoena alone — you need either patient authorization, satisfactory assurances of notice, or assurances that a qualified protective order has been sought.
• Law enforcement subpoena, court order, grand jury subpoena, or administrative request under 45 CFR § 164.512(f). Each has its own sub-path. Grand jury subpoenas almost always include a non-disclosure instruction.
• DEA administrative subpoena under 21 USC § 876 and 45 CFR § 164.512(f)(1)(ii)(C). Self-executing; no court order required. Limited to records relevant to a DEA investigation. Frequently used in controlled-substance and Medicare fraud matters.

Public health disclosures under 45 CFR § 164.512(b) (CDC, state health departments, FDA adverse-event reporting) follow their own permitted-disclosure path and rarely arrive as subpoenas. If a state health department serves one, treat it under (b) — not (e).

When you must respond

A court order signed by a judge or magistrate authorizing disclosure of PHI is the only document that compels production by itself. Disclose the specific PHI the order describes — not more, not less. Document the disclosure in the accounting log under 45 CFR § 164.528 when applicable.

For a civil subpoena without a court order, response is permitted (not required by HIPAA itself, though state procedural rules may compel it) only when one of three conditions is satisfied:

• A signed patient authorization meeting 45 CFR § 164.508 accompanies the subpoena.
• Satisfactory assurances that the patient has been given notice of the request — typically a sworn declaration from counsel attaching the notice and the proof of service, with the time to object having elapsed.
• Satisfactory assurances that the requesting party has sought a qualified protective order — a court-approved order limiting use and requiring return or destruction of the PHI at the end of the litigation.

For a grand jury subpoena, DEA administrative subpoena, or other law-enforcement administrative demand authorized by law, disclosure is permitted under 164.512(f) without a court order — but only the records described, only the minimum necessary, and only after counsel confirms the demand on its face meets the regulatory requirements.

When you can refuse — or must

Refusal (or moving to quash) is the correct response in several recurring scenarios:

• The subpoena seeks psychotherapy notes without a separate authorization specifically referencing them (45 CFR § 164.508(a)(2)).
• The subpoena seeks 42 CFR Part 2 substance use disorder records without a Part 2-compliant court order.
• The subpoena is facially overbroad — e.g., "all records of all patients seen between 2018 and 2024" without a defined relevance basis.
• The subpoena seeks records from another jurisdiction without being domesticated.
• The subpoena is served on the wrong custodian (e.g., delivered to a covered entity that is not the actual custodian of the records).
• The subpoena asks for records of a deceased patient without authorization from the personal representative, where required under 45 CFR § 164.502(g)(4).

Refusal must be in writing, through counsel, and must state the regulatory basis. Do not simply ignore a subpoena — that creates contempt exposure independent of HIPAA.

How to challenge or quash

A motion to quash is the procedural mechanism for refusing a subpoena that is invalid on its face or that conflicts with HIPAA, 42 CFR Part 2, state psychotherapist-patient privilege, or another protection.

• Federal civil subpoena. Rule 45 of the Federal Rules of Civil Procedure governs. The motion is filed in the court for the district where compliance is required.
• Federal grand jury subpoena. Motion to quash filed in the issuing district court. Grounds are narrow — relevance, overbreadth, privilege.
• State civil subpoena. Each state's rules of civil procedure apply. New York CPLR 3122-a requires that subpoenas for medical records be in a HIPAA-compliant form and include the required certifications. California Code of Civil Procedure § 1985.3 requires consumer notice and a 20-day window before records can be released.
• DEA administrative subpoena. Enforced by petition to the federal district court under 21 USC § 876(c). The court reviews relevance and overbreadth. Production is not automatic — the DEA must seek enforcement if the recipient refuses.

The motion must be filed before the response deadline on the subpoena. Letting the deadline pass and then objecting is procedurally weaker than moving to quash within the window.

Documentation you must retain

For six years under 45 CFR § 164.530(j), retain:

• The original subpoena, with envelope, proof of service, and date of receipt
• Any accompanying authorization, court order, declaration, or qualified protective order
• The minimum-necessary determination and the basis for the scope produced
• A copy of every page produced, indexed against the subpoena items
• The cover letter and any objections lodged
• The accounting-of-disclosures log entry under 45 CFR § 164.528 where applicable
• Any motion to quash and the court's ruling

If the production was made to law enforcement under 164.512(f), the accounting log requirement applies for the duration specified in the regulation, and the patient is entitled to that accounting on request (with the law-enforcement temporary suspension exception where applicable).

State-law overlay

State rules frequently impose stricter procedural requirements than HIPAA. The most common ones to map against:

• California — Code of Civil Procedure § 1985.3 requires the subpoenaing party to serve a Notice to Consumer on the patient at least 5 days before service on the custodian, plus 15 days before the production date. CMIA (Civil Code §§ 56–56.37) layers a separate authorization standard.
• New York — CPLR 3122-a requires HIPAA-qualified subpoenas to include a HIPAA-compliant certification and authorization or notice. Mental-health records are governed by Mental Hygiene Law § 33.13.
• Texas — HB 300 (Tex. Health & Safety Code Chapter 181) and Rule 196.1 of the Texas Rules of Civil Procedure layer additional requirements; medical records subpoenas typically require HIPAA-compliant notice or authorization.
• Florida — F.S. § 456.057 controls disclosure of records and generally requires patient authorization, court order, or subpoena with notice; FIPA layers a separate breach-notification path if the production is later challenged as improper.
• Massachusetts — G.L. c. 233, § 79G and the Board of Registration in Medicine regulations layer authorization and notice requirements that overlay HIPAA.

State medical-licensure rules also commonly require record production to the state board on demand without a subpoena. Treat licensure-board requests under their own statutory authority, not under 164.512(e).

What not to touch

• Do not produce on a faxed or emailed subpoena copy until you have confirmed the original or a certified copy.
• Do not call the issuing attorney to "clarify" before counsel reviews. Statements about the chart's contents become admissions.
• Do not redact selectively without a documented minimum-necessary determination. Selective redaction without a basis looks like concealment.
• Do not destroy records referenced by the subpoena, including drafts and email about the patient. Litigation hold runs from receipt.
• Do not notify the patient of a grand jury or law enforcement subpoena until counsel confirms the disclosure is permitted.
• Do not assume a HIPAA authorization signed years ago covers a current subpoena. Authorizations are matter-specific and expire.

How d3rx fits

The d3rx compliance binder maintains the subpoena response workflow inside the disclosure module: intake form, type-identification checklist mapped to 164.512 sub-parts, minimum-necessary worksheet, accounting-of-disclosures log entry templates, and the six-year retention index. The d3rx audit defense workflow walks the first 48 hours from a subpoena's arrival, including the litigation hold, the counsel-engagement letter, and the production cover letter. d3rx is a source-grounded administrative documentation aid. It does not represent the practice in court, does not file motions to quash, and does not replace counsel.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.