Responding to subpoenas is a routine task for risk managers and general counsel, but just because it is routine doesn’t mean it should be taken lightly. There are right and wrong ways to respond, and your actions at this early stage of potential litigation can affect the outcome later.
Subpoenas can demand that you turn over specific documents, and they also can require a person to appear in court. In either case, most of the same precautions apply.
First, you never should take the subpoena at face value and immediately comply, says Christine G. Savage, JD, an attorney with the law firm of Choate Hall and Stewart in Boston. A subpoena must be taken seriously, and failure to comply can result in punitive actions from the court, but the first priority is to ensure the validity of the document.
Start with determining where the subpoena originated. If it comes from a federal or state court, confirm that is signed by a judge or magistrate, Savage advises. If so, the subpoena carries the weight of a court order, she says. The hospital should provide the requested information, even if it is protected health information (PHI) covered by the Health Insurance Portability and Accountability Act (HIPAA).
The same rule applies if the subpoena comes from a law enforcement authority, such as a U.S. attorney’s office, and cites a law enforcement or health oversight need. The hospital can comply with that subpoena without obtaining the patient’s permission
If the subpoena is issued by a plaintiff’s attorney in a civil matter, which Savage says is quite common, the hospital’s response may be different. At that point, there could be a conflict with HIPAA, Savage says.
In most cases, PHI cannot be provided in response to an attorney’s subpoena unless the patient has provided permission or a reasonable amount of time has passed without the patient objecting to the request.
“There are a lot of aggressive civil litigators who will hound risk managers or the people in health information management, saying you have to respond to this subpoena by this deadline. But they don’t send anything along with the subpoena indicating they have complied with the additional requirements of HIPAA,” Savage says. “We spend a lot of time educating those people.”
The case caption also can dictate how you respond. If the hospital or health organization is named in the subpoena’s case caption, the subpoena should be referred to your senior management or legal counsel immediately.
“That suggests that the institution itself is being sued, so you want to have counsel look at it before you provide anything,” Savage says. “If the institution is not named but the patient is named in the case caption, and usually even if they’re not, we would reach out to the person who sent it and ask if they have tried to get the patient’s authorization. If they haven’t, we tell them we’re going to.”
An authorization from the patient can simplify the process, which prevents the need to assess what types of records are involved and how federal and state privacy protections apply, Savage says. Some records still can be released with the patient’s permission, but a blanket authorization eliminates the time involved in assessing each type of record.
Only What’s Required
When complying with a subpoena, be sure to provide only what was requested. In most states, for example, a subpoena must specifically ask for specially protected records such as those pertaining to mental health and substance abuse. A subpoena asking for all of a patient’s medical records would not be sufficient to obtain those documents, Savage explains. The subpoena would have to ask for those records in particular and justify why they should be released.
Federal law makes substance abuse records especially hard to obtain in a subpoena, Savage notes.
“You have to get the patient’s permission unless it is a law enforcement matter, and, even then, I would advise risk managers to talk to someone in senior management at the institution before complying,” she says. “This kind of request signals that something else is going on, possibly something bigger than just this one patient and that could involve the hospital in some way.”
Also, be careful not to volunteer that certain documents exist. If the patient has a history of substance abuse, for example, that information can be redacted, and you do not have to bring it to the other party’s attention.
“However, you don’t want to say that substance abuse records are specially protected, so you’re not going to provide the patient’s records from his stay in rehab,” Savage says. “You’ve just told them that he was in rehab, and that alone is a breach. I’ve seen situations where well-meaning records staff have done that, asking, ‘Were you seeking their mental health records in addition to the medical records?’”
Risk managers can work with legal counsel to write a subpoena and search warrant policy that outlines these precautions for anyone in the institution who might be in a position to receive those demands, Savage suggests. With search warrants, which often come in tandem with subpoenas, many of the same precautions apply. (For more on search warrants, see the story later in this issue.)
Challenge Subpoena
In some cases, the hospital may want to file a motion with the court to quash the subpoena, says Nicholas D. Jurkowitz, JD, partner with the law firm of Fenton Law Group in Los Angeles.
“There may be reasons internally that a hospital would not want these records produced and would want to fight,” Jurkowitz says. “There may be internal policies and procedures that you don’t want out there or sensitive information that could be damaging to the hospital if it were to be made public. That’s when you need a tactical assessment to determine if it’s in the hospital’s best interest to fight it.”
Legal advice is always a good idea with a subpoena, he says. Jurkowitz once had a client who produced records in response to a subpoena before seeking legal advice, but problems arose between the two parties about what constituted compliance. By the time Jurkowitz stepped in, the original subpoena had been followed by court orders that were much more demanding and restrictive.
“They had just done it on their own, thinking they were doing the right thing by handing over the documents,” he says. “Then problems arose, and we were really handcuffed by the court order that might have been avoided, or we might have been able to tailor the court order in a way that was more favorable to my client. We lost a lot of strategic options because mistakes were made very early.”
Watch the Calendar
Once the subpoena is validated, pay attention to the calendar. Note the date by which the records are required, which sometimes can be too soon for the hospital to comply. It is not unusual for a subpoena to request records be delivered within a week, Savage says, and that deadline doesn’t allow enough time if the patient must be contacted for permission.
“In those cases, I recommend just picking up the phone and talking to the lawyer or the law enforcement agency and asking for an extension,” Savage says. “And you also want to put the onus back on them to obtain the necessary authorization. I also would tell them that if they don’t do those two things, I will file a motion with the court to quash the subpoena.”
A hospital can develop a form letter for responding to subpoenas, Savage suggests. The letter can summarize the HIPAA rules as they apply to subpoenas, along with information about specially protected documents and any state rules that may apply.
Savage cautions that you cannot ignore a subpoena, even if it is onerous or insufficient in some way. The subpoena may request specially protected information that you know you can’t release, for example, but you still must respond. Failing to respond can result in the lawyer or law enforcement agency going to court and reporting that you failed to respond to a subpoena.
“That never looks good, even if the subpoena was faulty in the first place,” Savage says. “At that point, you may get a court order requiring you to produce more than the original request, or you may be called into court to explain yourself to the judge.”
SOURCE
-
Nicholas D. Jurkowitz, JD, Partner, Fenton Law Group, Los Angeles. Telephone: (310) 444-5244. Email: [email protected].
