Court-Ordered Disclosure of Medical and Substance Use Records

A judge can order your doctor, hospital, or treatment program to release your files, but the court-ordered disclosure of medical records is tightly regulated: the order has to be specific, the records at issue determine which rulebook applies, and you have the right to object before anything leaves the provider’s office. Neither a court order nor a subpoena alone automatically forces a healthcare provider to hand over your file. Both require specific procedural steps, and providers that release records without following them face civil penalties that reach over $2 million per year for the most serious violations.

Two Federal Rulebooks Decide What Comes Out

The Health Insurance Portability and Accountability Act sets the baseline. HIPAA generally bars hospitals, insurers, and other covered entities from releasing your protected health information without your written authorization, but it carves out exceptions for judicial and administrative proceedings.¹ When a court order is involved, a covered entity may disclose the specific information described in that order without needing your permission.²

Substance use disorder treatment records are different. They fall under 42 CFR Part 2, a stricter set of rules Congress backed because people avoid addiction treatment when they fear their records will surface in court or reach an employer. To get a court order authorizing disclosure of Part 2 records, the requesting party must show “good cause.” That means proving the information cannot be obtained any other way and that the public interest in disclosure outweighs the potential harm to the patient, the treatment relationship, and the program’s ability to serve other patients.³ That standard is deliberately harder to meet than what HIPAA requires for ordinary medical records.

Which framework applies turns on the type of record, not the type of case. A single lawsuit can trigger both: ER notes from an accident under HIPAA, methadone clinic records from the same patient under Part 2.

Court Order vs. Subpoena: Not the Same Thing

People use the two terms interchangeably, and it causes real problems. A court order carries a judge’s signature. A subpoena is often issued by an attorney or court clerk without a judge seeing it. HIPAA treats them very differently.

When a provider receives a court order, HIPAA lets it disclose whatever the order specifically describes.⁴ When a provider receives a subpoena without a court order, the requesting party must show it made reasonable efforts either to notify you (so you can object) or to obtain a qualified protective order from the court.² If neither showing is made, HIPAA says the provider should not comply.

For substance use records under Part 2, the gap is even wider. A Part 2 court order only authorizes release. It does not compel it. A separate subpoena or other compulsory process must accompany the court order to actually force production. If the subpoena has expired or been quashed, the provider can refuse to hand over Part 2 records even though a court order exists.⁵ Many attorneys miss this and assume a court order alone is enough.

Psychotherapy Notes Sit in a Separate Lane

Within mental health records, psychotherapy notes get stronger protection than almost anything else in your chart. These are a therapist’s personal notes analyzing counseling sessions, kept separately from the rest of your medical record. They do not include session start and stop times, medication information, treatment plans, diagnoses, or progress summaries. Those items live in your regular medical record and follow standard HIPAA rules.⁶

Psychotherapy notes require your written authorization before a provider can disclose them for almost any purpose. The narrow exceptions include the therapist using their own notes for your treatment, the provider defending itself in a lawsuit you brought against it, and mandatory reporting such as abuse or an imminent threat of serious harm.⁷ The standard judicial proceedings exception that applies to ordinary medical records is not on that list. Litigants trying to pull your session notes face a harder path than those trying to pull your lab results.

The U.S. Supreme Court reinforced this in Jaffee v. Redmond, recognizing a federal psychotherapist-patient privilege that shields confidential communications with licensed therapists, psychologists, and clinical social workers from compelled disclosure.⁸ The Court rejected a case-by-case balancing test, reasoning that people will not speak honestly in therapy if they can never predict whether their words will stay confidential. The privilege is not absolute. It can yield when necessary to avert a serious threat, but the baseline protection is strong.

What a Valid Order Has to Say

An order that fails to meet the regulatory requirements can be challenged and potentially voided. Under HIPAA, the scope rule is simple: a covered entity may disclose only the protected health information “expressly authorized” by the order.² A vague directive to “produce all medical records” without specifying conditions, date ranges, or providers gives the entity legitimate grounds to push back.

For substance use records the requirements go further. A court must find that other means of getting the information are unavailable or ineffective, and that the public interest in disclosure outweighs the potential damage to the patient, the treatment relationship, and the program’s services to other patients.³ The order itself must name the specific program authorized to release the files, identify who may receive them, and limit the scope to what is genuinely necessary. Judges will not sign off on a fishing expedition through years of treatment notes when only a narrow window is relevant.

When substance use records are sought for a criminal investigation, Part 2 adds more guardrails. Identifying information must be removed from anything made available to the public, and information obtained through the order cannot be used to prosecute the patient for a substance-related crime.⁹

Your Right to Object

You are not powerless when someone comes after your records. In federal civil cases, Rule 45 of the Federal Rules of Civil Procedure lets you file a written objection to a subpoena before the compliance deadline, or within 14 days of service, whichever comes first.¹⁰ You can also move to quash, asking the court to throw out or narrow the subpoena entirely.

Courts must quash a subpoena that demands privileged or otherwise protected material when no exception or waiver applies, or that subjects you to an undue burden.¹⁰ In practice, that means arguing the records sought go beyond what the case requires, that a privilege like the psychotherapist-patient privilege applies, or that the requesting party skipped the required notification or protective-order procedures. State courts have analogous rules, though specifics vary.

If you previously consented to release of your substance use records, you generally have the right to revoke that consent in writing. Revocation does not undo disclosures the program already made in reliance on your consent before you revoked it.¹¹ If your participation in a treatment program was a condition of a criminal case disposition, your consent remains in effect until the criminal matter is resolved.

In sensitive cases a judge may conduct an in camera review, examining the records privately in chambers before deciding what, if anything, to release. That step keeps irrelevant or damaging material out of the opposing party’s hands entirely because the judge acts as a gatekeeper rather than letting both sides sift through everything.

How Released Records Can Be Used

Getting records released is only half the question. Judges almost always impose limits on what can be done with them afterward.

The most common restriction is a protective order limiting who can see the files. Access is typically confined to the attorneys, their staff, and retained experts. Some courts go further with an “attorneys’ eyes only” designation, meaning even the parties themselves cannot view the raw medical data. Only legal counsel, consulting experts, mediators, court reporters, and the court itself may access the material.¹²

When records are filed with the court as part of a motion or as trial exhibits, judges frequently order them sealed to keep the information off the public docket.¹² Under HIPAA, a qualified protective order must do two things: prohibit the parties from using the information for any purpose other than the litigation at hand, and require the return or destruction of all copies at the end of the case.² The destruction requirement is what keeps the breach of privacy temporary.

Penalties for Improper Disclosure

Providers that release records without following the proper procedures face tiered civil penalties under HIPAA, adjusted annually for inflation. The 2026 figures published in the Federal Register are:

Unknowing violations: $145 to $73,011 per violation, with an annual cap of $2,190,294.
Reasonable cause (not willful neglect): $1,461 to $73,011 per violation, same annual cap.
Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, same annual cap.
Willful neglect, not corrected within 30 days: $73,011 to $2,190,294 per violation, with the annual cap also at $2,190,294.

Those figures come from the 2026 inflation adjustment.¹³ A provider that hands over substance use records in response to a bare subpoena, without either patient consent or a court order meeting the Part 2 good cause standard, faces exposure at the higher tiers because the regulatory requirements are well established. For patients, that exposure is leverage. The threat of a seven-figure annual penalty gives providers strong reason to push back on improperly issued requests rather than simply comply.

A provider that receives a facially valid court order and accompanying subpoena but refuses to comply faces the other side of the ledger: contempt of court, with escalating daily fines until the records are produced. Judges have broad discretion to set sanctions high enough to compel compliance. The practical result is a system where providers verify an order’s authenticity and confirm its scope matches what the regulation requires before releasing anything, and where you have real room to object before that release happens.

1
Centers for Disease Control and Prevention. Health Insurance Portability and Accountability Act of 1996 (HIPAA)
2
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
3
eCFR. 42 CFR 2.64 – Procedures and Criteria for Orders Authorizing Uses and Disclosures for Noncriminal Purposes
4
U.S. Department of Health & Human Services. Court Orders and Subpoenas
5
eCFR. 42 CFR Part 2 Subpart E – Court Orders Authorizing Use and Disclosure
6
U.S. Department of Health & Human Services. Does HIPAA Provide Extra Protections for Mental Health Information Compared with Other Health Information
7
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
8
Justia US Supreme Court. Jaffee v. Redmond, 518 U.S. 1 (1996)
9
eCFR. 42 CFR 2.66 – Procedures and Criteria for Orders Authorizing Use and Disclosure for Noncriminal Purposes
10
Legal Information Institute (LII). Federal Rules of Civil Procedure Rule 45 – Subpoena
11
eCFR. 42 CFR Part 2 Subpart C – Uses and Disclosures With Patient Consent
12
United States District Court for the District of Nebraska. Protective Order – With AEO No HIPAA
13
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment