Can a North Carolina lawyer subpoena a HIPAA-covered provider and demand compliance without giving the HIPAA notice or protective-order assurances?

Plain-English summary

The opinion addresses the HIPAA Privacy Rule's treatment of subpoenas for protected health information in litigation. Under 45 C.F.R. §164.512(e), a covered entity may disclose protected health information in a judicial or administrative proceeding in response to a court order, or in response to a subpoena if it receives satisfactory assurance that the requesting party made reasonable efforts to give the patient notice or to secure a qualified protective order; alternatively, under §164.512(e)(1)(vi), the entity may disclose in response to a subpoena without those assurances if it makes its own reasonable efforts to notify the patient or seek a protective order.

On Inquiry #1, the opinion concludes a lawyer may send a HIPAA-covered entity a subpoena and demand compliance without providing the Privacy Rule assurances, assuming the subpoena complies with the Rules of Civil Procedure. As a matter of professional courtesy, the lawyer may include a letter alerting the entity that the health information may be subject to state or federal privacy laws and that it may delay compliance for a reasonable time to comply with those laws, citing Rule 1.2(a)(2) (a lawyer does not violate the Rules by treating others with courtesy). The opinion notes it may also serve the client's interest to encourage compliance with privacy laws, to avoid later objections that cause delay, expense, or exclusion of the materials.

On Inquiry #2, the opinion addresses the situation where the provider receiving the subpoena is also a firm client in an unrelated matter. If the client seeking the records and the provider/client share the same interest in producing the records lawfully, the lawyer may, with both clients' informed consent confirmed in writing, advise the provider/client about the privacy rules and give it a reasonable time to comply. But if the lawyer advises the provider/client and a conflict then arises over the subpoena (for example, the provider/client wants to quash it, or the records-seeking client must move to compel or for sanctions), the lawyer may not represent either client on enforcement of the subpoena unless both give renewed informed consent confirmed in writing.

In practice

Under the North Carolina rules as they stood at the time of the opinion, conduct in which a lawyer serves a Rules-of-Civil-Procedure-compliant subpoena on a HIPAA-covered provider and demands compliance is permitted without the Privacy Rule assurances; the opinion frames the assurances as a HIPAA matter for the entity, not an ethics prerequisite for the lawyer. Per the opinion, sending a courtesy letter that flags the privacy laws and allows reasonable time to comply is consistent with Rule 1.2(a)(2) and may serve the client's interest in avoiding later objections.

The opinion's conflict guidance is the operative limit when the provider is also a firm client: the lawyer may give the provider/client privacy-rule advice only with both clients' informed consent confirmed in writing, and must not represent either client on enforcement of the subpoena if an actual conflict develops absent renewed written consent under Rule 1.7.

Common questions

Q: Can a North Carolina lawyer subpoena medical records without giving the HIPAA assurances?

A: Yes. Opinion #1 says a lawyer may send a HIPAA-covered entity a subpoena and demand compliance without providing the Privacy Rule assurances, assuming the subpoena complies with the Rules of Civil Procedure.

Q: Should the lawyer warn the provider about privacy laws anyway?

A: The opinion treats it as a courtesy option. Opinion #1 says the lawyer may include a letter alerting the entity that the information may be subject to privacy laws and that it may delay compliance for a reasonable time, citing Rule 1.2(a)(2), and notes this may also serve the client's interest.

Q: What if the subpoenaed provider is also a client of the lawyer's firm?

A: Opinion #2 says that if both clients share the same interest in lawful production, the lawyer may, with both clients' informed consent confirmed in writing, advise the provider/client about the privacy rules and give it reasonable time to comply.

Q: What happens if a conflict arises over the subpoena between the two clients?

A: Opinion #2 says that if the lawyer advised the provider/client and a conflict then arises, for example a motion to quash or a motion to compel or for sanctions, the lawyer may not represent either client on enforcement of the subpoena unless both give renewed informed consent confirmed in writing.

Background and rules framework

The opinion applies North Carolina Rule 1.2 (scope of representation, the analogue of Model Rule 1.2), citing Rule 1.2(a)(2) for the principle that a lawyer does not violate the Rules by treating others with courtesy, and Rule 1.7 (conflict of interest: current clients, the analogue of Model Rule 1.7) to govern the situation where the subpoenaed provider is also a firm client.

The substantive backdrop is the HIPAA Privacy Rule, 45 C.F.R. §164.512(e), which sets the conditions under which a covered entity may disclose protected health information in response to a court order or subpoena. The opinion treats those conditions as obligations of the covered entity, not ethics requirements imposed on the subpoenaing lawyer.

Citations and references

Rules of Professional Conduct:

• MR 1.2 / NC Rule 1.2(a)(2) (treating others with courtesy)
• MR 1.7 / NC Rule 1.7 (conflict of interest: current clients)

Regulations:

• 45 C.F.R. §164.512(e) (HIPAA Privacy Rule; disclosure of protected health information in judicial and administrative proceedings)

See also

• NC State Bar 2014 FEO 7: NC Subpoena to an Out-of-State Entity
• NY State Bar Op. 1247: Conflict in Serving Subpoenas on County Departments

Source

• Landing page: https://www.ncbar.gov/for-lawyers/ethics-and-governing-rules/ethics-opinions/opinions/2014-formal-ethics-opinion-4/

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

Introduction:

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the US Department of Health and Human Services (USDHHS) to establish a set of national standards for the protection of certain health information including identifiable medical records of individual patients. Pursuant to this mandate, the USDHHS issued Standards for Privacy of Individually Identifiable Health Information (the Privacy Rule), which established national standards for the protection of protected health information. The Privacy Rule applies to any health care provider who transmits health information in electronic form in connection with certain specified transactions.1

At issue in this inquiry is 45 C.F.R. §164.512(e) of the Privacy Rule, which pertains to disclosure of protected health information in judicial and administrative proceedings. Pursuant to 45 C.F.R. §164.512(e), covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is in response to an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided. Specifically, a covered entity may disclose protected health information if the covered entity receives satisfactory assurance from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the requested protected health information was given notice of the request, or the covered entity received satisfactory assurance from the party seeking the information that reasonable efforts were made by such party to secure a qualified protective order. 45 C.F.R. §164.512(e)(1)(ii)(2013).

However, 45 C.F.R. §164.512(e)(1)(vi) allows a covered entity to disclose protected health information in response to a subpoena without receiving satisfactory assurance from the requesting party if the covered entity itself makes reasonable efforts to provide notice to the individual or to seek a qualified protective order.

Inquiry #1:

May a lawyer send a subpoena to an entity covered by HIPAA and demand compliance without providing the assurances set out in 45 C.F.R. §164.512(e)(ii)?

Opinion #1:

Yes, assuming the subpoena complies with the Rules of Civil Procedure.

As a matter of professional courtesy, if the lawyer does not provide the necessary assurances set out in the Privacy Rule, the lawyer may include a letter with the subpoena alerting the entity that certain health information may be subject to state and/or federal privacy laws and informing the entity that it may delay compliance with the subpoena for a reasonable amount of time to comply with any applicable privacy laws. See Rule 1.2(a)(2) (lawyer does not violate rules by treating others with courtesy). In addition to being a matter of professional courtesy, it may be in the client’s best interest to seek compliance with federal and state privacy laws to avoid subsequent objections to the disclosure of the produced materials that may cause delay, additional expense, or prohibit the use of the produced materials.

Inquiry #2:

Would the response to Inquiry #1 be different if the health care provider receiving the subpoena is also a client of the lawyer’s firm in an unrelated matter?

Opinion #2:

Assuming that the client seeking the medical records and the provider/client have the same interest in seeing that the medical records are produced in accordance with applicable law, the lawyer serving the subpoena may, with the informed consent confirmed in writing of both clients, provide advice to the provider/client relative to the requirements of the various privacy rules and may give the provider/client a reasonable amount of time to comply.

If the lawyer provides advice to the provider/client relative to the subpoena and a conflict arises pertaining to the subpoena (i.e., provider/client desires to quash the subpoena or, upon the provider/client’s failure to respond to the subpoena, the client seeking the medical records is required to file a motion to compel or a motion for sanctions), the lawyer may not represent either the client seeking the records or the provider/client relative to the enforcement of the subpoena, unless both clients give their informed consent confirmed in writing.

End Notes

• Summary of the HIPAA Privacy Rule, OCR Privacy Brief, US Department of Health and Human Services, Office for Civil Rights: hhs.gov/ocr/privacy/hipaa/ understanding/summary/index.html.