Yes, medical records can be subpoenaed, but the rules for actually obtaining them are strict. HIPAA, physician-patient privilege, and special rules for sensitive records like therapy notes and substance use treatment all limit when your health information can be released in a legal case. In most situations you have the right to receive notice, object, or negotiate the scope of what gets turned over before anything leaves your provider’s office.
What a Subpoena for Medical Records Actually Is
A subpoena is a formal legal command to produce documents or appear as a witness. When medical records are the target, the subpoena is usually served on the records custodian at your healthcare provider’s office rather than on you. Under federal court rules, every subpoena has to identify the issuing court, the case name and number, and describe the specific documents being requested.1Legal Information Institute. Federal Rules of Civil Procedure Rule 45 – Subpoena
The single most important distinction is between a subpoena signed by an attorney and an order signed by a judge. An attorney involved in a case can issue a subpoena on their own authority. A court order comes directly from a judge and carries more weight. When a judge signs an order directing release of your records, your provider generally must comply, even without your permission, but only for the specific information the order describes.2U.S. Department of Health & Human Services. Court Orders and Subpoenas
What HIPAA Requires Before Records Can Be Released
The HIPAA Privacy Rule at 45 CFR 164.512(e) sets the federal baseline. It splits requests into two tracks depending on whether a judge signed the paperwork.3eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
With a Court Order
If a judge or administrative tribunal issues an order, your provider can release the information the order specifically describes. Your consent is not required, and the provider does not need to take extra steps beyond confirming the order is legitimate.2U.S. Department of Health & Human Services. Court Orders and Subpoenas
With Only an Attorney-Issued Subpoena
Without a court order, the rules are stricter. Before your provider can hand anything over, the requesting party has to give “satisfactory assurances” through one of two paths. The first path shows that you received written notice of the request with enough detail about the case to file an objection, and that your time to object has passed without a successful challenge. The second path shows that the requesting party has obtained or applied for a qualified protective order, which restricts how your records can be used and requires them to be returned or destroyed once the case ends.3eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
This is where a lot of subpoena disputes actually happen. If the party requesting your records skips the notice step or fails to pursue a protective order, your provider should not release the records. Providers who understand the rule will push back on incomplete requests rather than simply handing over the file.
Stronger Protection for Sensitive Records
Some categories of medical records get heightened privacy protection. A regular subpoena, and sometimes even a regular court order, is not enough.
Psychotherapy Notes
HIPAA treats psychotherapy notes differently from ordinary medical records. These are notes a mental health professional records during counseling sessions and keeps separate from the rest of your clinical file. Releasing them requires a specific, standalone written authorization from you. Your provider cannot bundle that authorization with a general medical records release.4eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
There are narrow exceptions. The therapist who wrote the notes can use them for your treatment, a provider can use them for training, and a provider can disclose them to defend itself if you sue it. Outside those exceptions, even a court order alone may not be sufficient if state law adds further protections.
Substance Use Disorder Treatment Records
Federal law gives substance use disorder treatment records some of the strongest privacy protections in healthcare. Under 42 USC 290dd-2, records from any federally assisted substance abuse program are confidential and can only be disclosed with your written consent, during a genuine medical emergency, for approved research, or by a special court order.5Office of the Law Revision Counsel. 42 USC 290dd-2 – Confidentiality of Records
A standard subpoena, a general court order, or even a search warrant is not enough. The requesting party has to obtain a Part 2-specific court order, and the judge can only grant it after finding “good cause.” That means the court must determine no other way of getting the information is available or effective, and that the public interest in disclosure outweighs the harm to you, your relationship with your treatment provider, and the treatment program itself.6eCFR. 42 CFR 2.64 – Procedures and Criteria for Orders Authorizing Uses and Disclosures for Noncriminal Purposes
The statute also flatly prohibits using these records to initiate or support criminal charges against a patient or to investigate a patient, except through that same special court order process.5Office of the Law Revision Counsel. 42 USC 290dd-2 – Confidentiality of Records
How You Can Accidentally Waive Your Privacy
Every state recognizes some version of physician-patient privilege, which gives you the right to keep your doctor from testifying about or producing records of confidential treatment communications. The privilege belongs to you, which means you can assert it, and it also means you can waive it.
The most common way people waive it without realizing is by filing a lawsuit that puts their own health at issue. If you sue over injuries from a car accident, you have effectively opened the door to medical records related to those injuries. The waiver only reaches records relevant to the condition you placed at issue, not your entire medical history. But this is where overbroad requests are most common, and where pushing back on scope matters most.
Workers’ compensation works similarly through a separate HIPAA carve-out. If you file a workers’ comp claim, your provider can share treatment records, billing information, and medical reports with employers, insurers, and their representatives to the extent needed to process that claim, without a separate authorization from you.3eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required The disclosure still has to be limited to what the workers’ comp purpose requires, but the practical effect is that filing the claim will result in your treatment records for that injury being shared.
How to Respond If Your Records Are Subpoenaed
Once you learn a subpoena is out for your records, you generally have three moves: consent, negotiate, or fight.
Consenting can make sense when you are a party to the lawsuit and the records support your case. If you are a plaintiff claiming injuries, the relevant treatment records will almost certainly come out anyway. Signing a HIPAA-compliant authorization can speed things up and lets you control the scope more effectively than waiting for the other side to pull records through formal channels.
Negotiating the scope is often the most practical move. You or your attorney can contact the requesting party and try to narrow the request to specific date ranges, specific providers, or specific conditions. Releasing orthopedic records from the past two years is a very different thing from turning over a decade of complete medical history. Most attorneys prefer a negotiated scope over a court fight because it saves time and money on both sides.
If negotiation fails, you can formally object. In federal court, a written objection generally has to be served within 14 days after the subpoena is served, or before the compliance deadline if that comes sooner.1Legal Information Institute. Federal Rules of Civil Procedure Rule 45 – Subpoena You can also file a motion to quash, asking the judge to cancel or limit the subpoena. Common grounds include:
- Lack of relevance, meaning the records have nothing to do with the claims or defenses in the case.
- Physician-patient privilege, where the records involve confidential treatment communications you have not waived.
- Overbreadth, where the request sweeps in far more information than the case actually requires.
- Procedural defects, such as the requesting party failing to provide proper notice or satisfy HIPAA’s requirements for satisfactory assurances.
State court deadlines and procedures vary, but the principle is the same: act before the compliance date. Once that date passes without an objection, your provider may have no reason left to withhold the records.
What Happens If You Ignore a Subpoena
Doing nothing is not a safe option. If a valid subpoena demands your records and no one responds or objects, the requesting party can ask the court to compel compliance. Failure to obey a subpoena is punishable as contempt of court, which can bring monetary sanctions and, in extreme cases, jail time. More commonly, the court will order production of the records and award attorney’s fees to the party that had to file the enforcement motion. Even if you have legitimate grounds to withhold the records, those grounds have to be raised through the proper objection process. Silence is not treated as an objection.