Therapists and others in the mental health community are often unsure what to do when confronted with a request for a client's therapy records. Here are a few practice pointers based on what I have learned over the years in this evolving area of law.

First, how was the request made?

Sometimes a request is made in the form of a stern letter, email, telephone call from a person who is not your client, such as an attorney. Unless your client provides written consent, you are prohibited from releasing the records.  

More often you will get a subpoena.

This is where it can get a little complicated. If you are in receipt of a subpoena, before you comply you must determine whether it is a HIPAA compliant subpoena.

What is a "HIPAA compliant" subpoena?

A HIPAA complaint subpoena is one that should provide you with written evidence that  reasonable efforts had been made to:

• Notify the person who is the subject of the information about the request, so the person has a chance to object to the disclosure, or
• Seek a qualified protective order for the information from the court.

(Source: United States Department of Health and Human Services)

When you are served with at HIPAA compliant subpoena, it will most likely come with an additional document, usually a letter to your client, informing them that their records are being requested and providing them a time within which to file an objection.

When you get a proper HIPAA compliant subpoena, you should contact your client immediately and make sure they are aware of it. Keep a record of this communication. Make sure that your client understands that if the time period for objection passes and they have taken no action, you are required to comply with the terms of the subpoena. 

If you receive an objection, it will likely be in the form of a letter notifying you that an objection is being made and requiring you to maintain confidentiality. This letter should also be accompanied a filed motion to quash the subpoena. In this instance, you should not release anything unless the court orders it after it has heard, and denied, your client's motion. 

Therapists sometimes think they are responsible for determining if the contents of their records are related to the litigation before the records can be released.  This is not correct and issues of relevance and admissibility are governed by court rules. That's the purpose of HIPAA's notice provision; to allow your client time to object and make his legal arguments to the court to try to keep the records private.