|
Satisfactory Assurances.
A covered entity may disclose PHI pursuant to subpoenas, discovery requests, or other civil process only after obtaining “satisfactory assurances” that the requesting party has made a reasonable effort to provide written notice of the request to the individual or to obtain a “qualified protective order.”
“Satisfactory assurances” of notice means a written declaration and documentation of the following:
-
a good faith effort to provide the individual with written notice sufficient to permit the patient to raise objections to disclosure;
-
the individual’s failure to raise a timely objection following notice, or
-
the resolution of the individual’s objection by the court or other tribunal.
“Satisfactory assurances” of efforts to obtain a qualified protective order means a written declaration and documentation of an order submitted to a court either jointly by the parties or by the requesting party.
A “qualified protective order” is an order of a court that prohibits the use of PHI for any purpose other than the case in which the order is issued. A qualified protective order must also provide for the return or destruction of PHI after the case has closed, with no copies retained.
Disclosures pursuant to subpoenas, discovery requests and other process are subject to the “minimum necessity” standard. That is, only PHI expressly called for by the request may be disclosed or made available to the requesting party.
Implementation Tip: Create a Subpoena Checklist. A checklist should be used for each subpoena received. The HIPAA penalties for wrongful disclosures of information make it more important than ever to systematically handle subpoena requests. In addition to the administrative steps and procedures required, the checklist should include the following legally relevant information:
-
The identify of the tribunal (State or federal? An Oregon or out of state court? An administrative agency or a court?)
-
If the subpoena is issued in a federal court action, then what precisely is requested? (The scope of the subpoena’s demand defines the minimum necessary disclosure). Also, if the federal court is not located in Oregon, where does it call for production of records? There are special limits and procedures that out of state federal litigants must follow to have the subpoena issued within Oregon.
-
If the subpoena is not issued in a court action, but by an administrative agency, then is the agency a “health oversight agency”? If it is, then there is no need to determine whether the information requested is the minimum necessary. (See discussion and definition of “health oversight agency” above). If the agency is not a health oversight agency, then is the subpoena accompanied by the representations and information necessary to make the three-part determination demanded of the provider? (See discussion above regarding the three-part test).
-
If the subpoena is issued by a state court, then determine if it is an Oregon court. Subpoenas issued by state courts or litigants from other states are generally not binding on health care providers in Oregon. If the subpoena is issued in an Oregon court action, then determine if the requirements of ORCP 55 have been met. Health care practitioners must make sure that proof of adequate prior service on the individual is apparent on the face of the subpoena, or that the subpoena is accompanied by the required affidavit of counsel. (See discussion below regarding “Oregon Rules of Civil Procedure”). “Satisfactory assurances” of efforts to supply notice or obtain a protective order must be made in any event.
 Top
Oregon’s Rules of Civil Procedure.
ORCP 55H. ORCP 55H previously governed subpoenas for hospital records. The 2003 Legislative Assembly amended this provision to govern subpoenas for all individually identifiable health information and to reflect HIPAA terms and concepts. As revised, ORCP 55H requires a litigant seeking individually identifiable health information to provide to the holder of the information satisfactory assurance that the litigant made a good faith attempt to obtain a qualified protective order that meets the requirements of 45 CFR sec. 164.512(e)(v) and ORCP 55H(1)(b), or to provide at least 14 days prior notice to the subject of the information. Assurance of notice will take the form of an attorney affidavit or declaration accompanied by supporting documentation demonstrating:
-
That the party has made a good faith attempt to provide written notice of the requested disclosure to the individual or their attorney more than 14 days before the subpoena was served. If the individual is not represented and the individual’s location was not known, then the notice was sent to the last known address of the individual; and
-
That the notice included the proposed subpoena described the litigation or proceeding, and described the individually identifiable health information being requested; and
-
That the time for the individual to raise an objection has lapsed and either no objection to the requested disclosure of individually identifiable health information was raised, or any objections were resolved and the information sought by the subpoena is consistent with that resolution; and
-
That upon request, the party will allow the individual or their attorney to inspect and copy of the records received pursuant to the subpoena.
ORCP 55I. ORCP 55I governed subpoenas directed to licensed health professionals. The 2003 Legislative Assembly repealed this provision.
ORCP 44. ORCP 44 governs discovery of medical examinations of a party to litigation claiming damages for injuries. The rule requires only a request between attorneys, and the claimant is thereafter responsible for obtaining the records from his or her physician or other health care provider. This means that the individual makes a request for his or her own records, and no determination of minimum necessity is required. Hospital records of an injured party are obtained by subpoena, however, under ORCP 55H. See our comments above regarding ORCP 55H.
Provision of Notice. Both Oregon law and HIPAA speak to notice directly to the subject of the records. Parties to a lawsuit, however, typically are represented by counsel. Oregon law permits a litigant to provide the notice discussed above to the patient’s attorney rather than directly to the patient. It is unclear, however, whether HIPAA allows this substitute notice. Practitioners should consider obtaining a declaration from the patient’s attorney that the patient has waived the right to receive notice directly.
Scope of Oregon’s Rules of Civil Procedure. The amended ORCP 55H controls subpoenas seeking “individually identifiable health information.” Attorneys and hospital/employers should be aware that individually identifiable health information, as defined in HIPAA and included in ORCP 55H, includes medical records held by employers. This means that if an attorney subpoenas employment records from a hospital and the records contain individually identifiable health information, the subpoena must comply with ORCP 55H.
More Assistance. For more assistance with subpoenas, see the sample Affidavit in Support of Subpoena for Individually Identifiable Health Information and Subpoena Checklist, both included in “Sample Forms/Policies” on this website.
Top
Federal Rules of Civil Procedure.
Federal subpoenas are subject to the HIPAA regulations. This means a subpoena issued in federal court must provide the satisfactory assurances discussed above. Unlike the Oregon Rules of Civil Procedure, HIPAA does not provide for a specific notice period, but rather requires that the subject of the records receive notice sufficient to allow the subject to object to the request. The minimum necessity requirement applies in the same manner as for Oregon subpoenas.
Top
|
