When a Court or an Agency Asks for Your Health Records

Answer first: the rule permits, it does not order

There is one section covering disclosures that need no authorization and no chance for you to object. It is by far the longest section in the part.

Every standard in it is written the same way. A covered entity may disclose, provided stated conditions are met.

So the section is a list of permissions with conditions attached, not a list of demands anyone has to obey. Whether a particular request must be answered is decided by the law creating the request.

The conditions are the interesting part, because several of them require the requester to have done something first.

The sentence at the top of the section

The opening sentence sets the frame. A covered entity may use or disclose protected health information without the written authorization of the individual, and without the opportunity for the individual to agree or object, in the situations the section covers.

It is subject to the applicable requirements of the section itself and of the attestation section, and it carves out one prohibition described later here.

One procedural detail sits in the same paragraph. Where the section requires the entity to inform you, or lets you agree, the information and the agreement may be given verbally.

That is worth knowing because it means some of this can happen in a conversation, with no document generated on either side.

Required by law, and what the phrase does

The first standard is short. A covered entity may use or disclose information to the extent the use or disclosure is required by law, and the disclosure complies with and is limited to the relevant requirements of that law.

The limiting words carry the weight. A legal requirement to report one thing is not a permission to send everything.

The paragraph then routes three subjects elsewhere. Where a disclosure required by law concerns abuse, a judicial or administrative proceeding, or law enforcement, the conditions in those paragraphs have to be met as well.

There is a second consequence, in a different section. Minimum necessary does not apply to a use or disclosure required by law, because the law creating the requirement is expected to define the scope.

Health oversight, and the exception when you are the subject

A covered entity may disclose information to a health oversight agency for oversight activities authorized by law.

The list of activities is broad: audits, investigations, inspections, licensure or disciplinary actions, and civil, administrative or criminal proceedings.

The oversight has to be of one of four things. The health care system. Government benefit programs where health information bears on eligibility. Entities under government regulatory programs where health information decides compliance. Or entities subject to civil rights laws.

Then comes the exception, and it is written for the person in the record. A health oversight activity does not include an investigation in which the individual is the subject.

That exception has its own limit. It falls away in three situations, each of them tied to health. Where the investigation arises out of, and is directly related to, the receipt of health care. Where it relates to a claim for public benefits related to health, or to qualification for benefits where health is integral to the claim.

A further paragraph says that where a health oversight investigation runs jointly with an investigation into a non-health benefits claim, the joint activity counts as health oversight.

A subpoena on its own is not enough

Disclosures for a judicial or administrative proceeding split into two routes, and the split is the practical heart of the section.

The first route is an order of a court or administrative tribunal. Where there is one, the entity may disclose only the information the order expressly authorizes.

The second route covers a subpoena, discovery request or other lawful process that is not accompanied by such an order. Here the entity needs satisfactory assurance from the party seeking the information, and there are two ways to get it.

One is assurance that reasonable efforts were made to give you notice. The other is assurance that reasonable efforts were made to secure a qualified protective order.

The notice route is defined tightly. The requesting party has to supply a written statement and documentation on three points. That a good faith attempt was made to give you written notice. That the notice carried enough detail for you to object to the tribunal. And that the time to object has passed, with no objection filed or all objections resolved.

There is a third path. The entity may respond to such process without either assurance if it makes reasonable efforts itself to give you that notice or to seek the protective order.

What a qualified protective order is required to do

The term is defined in the same paragraph, and the definition is two clauses long.

It is an order of a court or tribunal, or a stipulation by the parties, that prohibits using or disclosing the information for any purpose other than the proceeding it was requested for.

And it requires the information, including all copies made, to be returned to the covered entity or destroyed at the end of the proceeding.

Both halves matter. One fences the use, the other ends it. A protective order without the destruction clause would not meet the definition.

Law enforcement has six routes, and they are not equivalent

A covered entity may disclose to a law enforcement official for a law enforcement purpose where the conditions of the applicable paragraph are met. There are six paragraphs.

The first covers disclosures required by law, and disclosures in compliance with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena.

The same paragraph covers an administrative request, including an administrative subpoena, a civil or authorized investigative demand, or similar process. That route carries three conditions.

The information sought has to be relevant and material to a legitimate law enforcement inquiry. The request has to be specific and limited in scope to the extent reasonably practicable. And de-identified information could not reasonably be used.

The remaining paragraphs cover five further situations. Identification and location requests, victims of a crime, and decedents where criminal conduct is suspected. Evidence of a crime on the entity's premises, and reporting a crime during an emergency away from those premises.

The victim paragraph is the one with the clearest patient-facing condition. It applies where the individual agrees, or, where agreement cannot be obtained through incapacity or emergency, only on stated representations by the official plus the entity's own judgment of the person's best interests.

The identification list is closed, and so are its exclusions

Where an official asks for information to identify or locate a suspect, fugitive, material witness or missing person, the rule prints exactly what may be given.

Name and address. Date and place of birth. Social security number. Blood type and rh factor. Type of injury. Date and time of treatment. Date and time of death where applicable. And a description of distinguishing physical characteristics.

That description is itself enumerated, down to height, weight, gender, race, hair and eye color, facial hair, scars and tattoos.

Then the rule names what may not be disclosed for that purpose, and the exclusion is specific. Nothing relating to the individual's DNA or DNA analysis, dental records, or typing, samples or analysis of body fluids or tissue.

A closed list plus a stated exclusion is unusually legible for a regulation. It is one of the few places a reader can see the boundary drawn rather than described.

The gate added in 2024, and the prohibition behind it

A section added to the subpart in 2024 puts a document in front of four of these routes.

Where information is potentially related to reproductive health care, a covered entity or business associate is blocked from four routes. It may not use or disclose that information for the health oversight, judicial and administrative, law enforcement, or coroner purposes without first obtaining a valid attestation from the requester.

The attestation has required contents. A description of the information sought, identified specifically. The identification of who is asked to disclose it and who is to receive it. A clear statement that the use or disclosure is not for a prohibited purpose. A statement about criminal penalties. A signature and date.

It has to be written in plain language, and it may not be combined with any other document except where another document is needed to satisfy one of those elements.

The rule also lists five defects that make an attestation invalid, including missing an element, containing an element the rule does not require, and actual knowledge that material information in it is false.

Behind the attestation sits a prohibition. Where stated conditions are met, use or disclosure is barred for three things. Conducting a criminal, civil or administrative investigation into any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care. Imposing liability on any person for that act, or identifying any person for either purpose.

And there is a duty after the fact. Where an entity relying on a facially valid attestation discovers information reasonably showing a representation in it was materially false, leading to a prohibited use or disclosure, it must stop.

What a reader can actually look at

Whether a privacy notice describes disclosures for legal process at all, since the notice is required to put you on notice of purposes that do not need your authorization.

Whether the notice separates a court order from a subpoena, because the rule does and the conditions differ sharply.

Whether it mentions notice to you, or a protective order, as the route the company takes when process arrives without an order.

Whether it says anything about the attestation requirement, which is recent and applies to four named purposes.

And whether a record of any of it would be available to you afterwards, which is the separate subject of the accounting right.

What this does not decide

It does not say what any company does when a demand arrives. Every standard here is a permission with conditions, and a permission describes what a rule allows.

It does not say whether any particular request has to be answered. That is decided by the law creating the request, not by the privacy rule.

It does not cover the whole section. Public health, abuse reporting, decedents, organ donation, research, averting a serious threat, specialized government functions and workers' compensation are all in it and are not described here.

And it is not legal advice. It reports what three provisions of one federal subpart say.