Yes, an attorney can subpoena medical records, and it happens routinely in personal injury, malpractice, and workers’ compensation cases. But a subpoena alone does not force a healthcare provider to hand anything over. HIPAA, court rules, and extra protections for certain record types all stand between the attorney and your file, and you have the right to object before the records are released.
The Three Ways Attorneys Get Medical Records
There are really only three paths. The one an attorney uses depends on whether you are the client, the opponent, or a third party.
The cleanest path is a signed authorization. When an attorney represents the patient, they draft an authorization form, the client signs it, and the provider releases the records. HIPAA requires the authorization to describe the information being released, name who can disclose and receive it, state the purpose, include an expiration date or event, carry the patient’s signature, and inform the patient of the right to revoke in writing.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required A form missing any of those elements is invalid, and a provider that releases records on a defective authorization risks a HIPAA violation.
The second path is a subpoena, typically issued by an attorney or court clerk. It carries legal force, but it does not let a provider release records on its own.
The third path is a court order signed by a judge. This is the strongest tool. When a provider receives a court order, it can release the specific records described in the order without any further steps, and nothing more.2U.S. Department of Health and Human Services. Court Orders and Subpoenas An attorney who can convince a judge to sign one has the cleanest route to the file.
What HIPAA Requires Before a Provider Honors a Subpoena
A subpoena directed at a healthcare provider’s records custodian compels production of documents, but HIPAA requires the attorney to provide “satisfactory assurances” first. The attorney must submit a written statement and supporting documentation showing one of two things: that the patient received written notice about the request with enough time to object and either did not object or had their objections resolved by the court, or that the parties have agreed to or requested a qualified protective order.3eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
The notice to the patient has to include enough information about the litigation for you to raise an objection with the court. If the attorney does not know where you are, mailing notice to your last known address counts as a good-faith effort.3eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
A qualified protective order is a court-approved agreement that limits what the parties can do with the records once they are produced. It must prohibit use or disclosure of the health information for any purpose outside the litigation and require the return or destruction of all copies once the case ends.3eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required Attorneys often prefer this route because it lets the provider release records without waiting for your objection period to run.
In federal court, Rule 45 adds its own notice requirement. Before serving a document subpoena, the attorney must serve a copy of the subpoena and a notice on every other party in the case.4Cornell Law Institute. Federal Rules of Civil Procedure Rule 45 – Subpoena State rules follow a similar pattern with their own timelines.
Records That Get Stronger Protection
Not every record follows the standard subpoena rules. Three categories carry heightened protections, and a subpoena that overlooks them will get blocked.
Psychotherapy Notes
HIPAA treats psychotherapy notes separately from the rest of a patient’s medical record. These are the therapist’s personal notes from a counseling session, kept apart from the main chart. They do not include medication logs, session times, treatment plans, diagnoses, or progress summaries, all of which sit in the regular record and follow normal rules.5U.S. Department of Health and Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health
For actual psychotherapy notes, the provider needs specific patient authorization before disclosing them for almost any reason. A subpoena is not enough. The narrow exceptions involve mandatory abuse reporting and duty-to-warn situations where a patient threatens serious and imminent harm.6U.S. Department of Health and Human Services. Does HIPAA Provide Extra Protections for Mental Health Information This catches many attorneys off guard.
Substance Use Disorder Treatment
Records from federally assisted substance use disorder treatment programs fall under 42 CFR Part 2, which is significantly stricter than HIPAA. A regular subpoena, a general court order, or even a search warrant is not enough. Getting these records requires either specific patient consent or a special court order that meets Part 2’s own requirements. Substance use disorder records cannot be used in legal proceedings against the patient without that separate written consent or qualifying order.7U.S. Department of Health and Human Services. Fact Sheet 42 CFR Part 2 Final Rule
Reproductive Health Care Records
Since December 2024, subpoenas that could reach reproductive health care records trigger an additional step. The requesting party must submit a signed attestation stating the purpose of the request is not to investigate or impose liability on anyone for seeking, obtaining, providing, or facilitating lawful reproductive health care.8U.S. Department of Health and Human Services. HIPAA Privacy Rule Final Rule to Support Reproductive Health Care The person signing it faces criminal penalties under federal law for knowingly obtaining health information in violation of HIPAA.9U.S. Department of Health and Human Services. HHS OCR Model Attestation Form Re Reproductive Health Care This sits on top of the normal satisfactory assurances process.
How to Object If Your Records Are Subpoenaed
When you receive notice that your medical records have been subpoenaed, you can fight it. The main tool is a motion to quash, which asks the court to invalidate the subpoena or narrow its scope. A related option is seeking a protective order, which lets some records be produced but restricts how they can be used.
The strongest grounds for objecting:
- Irrelevance. The records have nothing to do with the claims in the case. A request for your psychiatric history in a dispute over a broken arm is a textbook example.
- Overbreadth. The subpoena asks for far more than what the case needs. Demanding your entire lifetime medical history when only one provider or time period is relevant is overly broad.
- Privilege. A court must quash or modify a subpoena that requires disclosure of privileged or protected information when no exception or waiver applies.4Cornell Law Institute. Federal Rules of Civil Procedure Rule 45 – Subpoena
- Undue burden. The subpoena imposes an unreasonable burden on whoever was served.
Once a motion to quash is filed, the provider should not release the records until the court rules. Timing is tight. In federal court, objections must be served before the compliance deadline or within 14 days of service, whichever comes first.4Cornell Law Institute. Federal Rules of Civil Procedure Rule 45 – Subpoena Miss that window and you can lose the right to object at all.
Filing a Lawsuit Waives Part of Your Privacy
This is where people get tripped up. If you file a personal injury or medical malpractice lawsuit, you have put your health at issue. Courts in most jurisdictions treat this as a limited waiver of the doctor-patient privilege for medical conditions related to your claims. You cannot sue for a back injury and then refuse to let the other side see your orthopedic records. The waiver covers records relevant to the condition you are claiming, not your entire medical history, which is why fights over scope are so common in these cases.
When a Provider Can Refuse
A provider that ignores a valid subpoena risks contempt of court. Sanctions can include fines and, in extreme cases, the forced surrender of the person who failed to comply.10National Institute of Justice. Legal Guide for the Forensic Expert – Failure to Honor a Subpoena But a provider is justified in withholding records when the subpoena lacks the required HIPAA assurances, when the patient has filed a timely objection, or when the records fall under heightened protections like psychotherapy notes or substance use disorder treatment. The obligation is to comply with valid, complete legal process, not to hand over records whenever an attorney asks.