Last Updated: September 18, 2026
Paralegals managing dozens of active personal injury cases hit recurring bottlenecks in manual retrieval: submit authorizations, chase providers, receive partial records, and race discovery deadlines.
The choice is voluntary record retrieval or compelled disclosure, and the Health Insurance Portability and Accountability Act (HIPAA) sets conditions on the issuing party. The phrase "subpoena duces tecum medical records" refers to a compulsory litigation process that directs a healthcare provider to produce specified patient records.
HIPAA still requires the provider to receive satisfactory assurances of patient notice or a qualified protective order (QPO) before releasing protected health information (PHI), unless a judge signed the order.
What Is a Subpoena for Medical Records?
A subpoena duces tecum commands document production. The Cornell Legal Information Institute translates duces tecum as a command to bring the specified material, and defines the instrument as one requiring a witness to produce documents, books, records, or other evidence relevant to a proceeding.
The Department of Health and Human Services (HHS) subpoena guidance draws a line between a court order and a subpoena issued by anyone other than a judge, such as a court clerk or an attorney in the case. Under Rule 45 of the Federal Rules of Civil Procedure (FRCP), an attorney authorized to practice in the issuing court may issue one. The difference turns on who signed it, and that signature sets the provider's duties under § 164.512(e) of the Code of Federal Regulations (CFR).
- Court orders signed by judges or administrative tribunals permit direct PHI disclosure under § 164.512(e)(1)(i), limited to the information the order expressly authorizes.
- Attorney-issued subpoenas fall under § 164.512(e)(1)(ii) and require documented patient notification or a QPO first.
Attorneys reach for a medical record subpoena when cooperation fails. It is one of four request pathways open to a plaintiff firm, alongside a HIPAA authorization, patient-directed access, and a court order.
HIPAA Legal Framework for Medical Record Subpoenas
HIPAA's judicial-proceedings provision permits a covered entity to disclose PHI in response to a subpoena unaccompanied by a court order after it receives "satisfactory assurances" from the requesting party.
Route A, notice to the individual (§ 164.512(e)(1)(iii)). The requesting party supplies a written statement and documentation of a good-faith attempt to notify the patient at the last known address, notice describing the litigation well enough to permit an objection, and an elapsed objection period. HHS Office for Civil Rights (OCR) FAQ 707 treats notice to the individual's lawyer as notice to the individual; FAQ 708 confirms a copy of the subpoena suffices when its face shows these facts.
Route B, qualified protective order (§ 164.512(e)(1)(iv)–(v)). The parties stipulate to a QPO presented to the court, or the requesting party moves for one. A QPO must contain:
- A limitation clause barring use or disclosure of the PHI for any purpose other than the litigation for which it was requested.
- A return-or-destruction requirement covering the PHI and all copies at the end of the proceeding.
The minimum-necessary standard applies either way: the covered entity limits disclosure to what is needed to respond (OCR FAQ 711).
Psychotherapy notes require the patient's separate written authorization under 45 CFR § 164.508 for nearly every disclosure (OCR FAQ 546), and a subpoena does not supply it. The HIPAA authorization requirements governing voluntary release provide a separate form of permission.
Minors' records require a separate state-law check, because authority to consent to treatment and authority to authorize disclosure can turn on age, emancipation, the service involved, and whether a parent or guardian is the minor's personal representative. A subpoena does not resolve those questions.
State Law Variations in Medical Record Subpoenas
State law and federal special-category rules sit above the HIPAA floor, so satisfying § 164.512(e) alone does not authorize production everywhere. Mental health, substance use, and HIV records each carry separate consent or court-order conditions.
- Mental health treatment records: the Privacy Rule applies uniformly to mental health information, with psychotherapy notes as the one federal exception (HHS mental-health guidance). State confidentiality statutes can add conditions the Privacy Rule does not.
- SUD treatment records: under 42 CFR § 2.61(b), a court of competent jurisdiction must enter an authorizing order on good-cause findings under § 2.64, and a subpoena or similar legal mandate must separately compel the disclosure. A subpoena alone reaches nothing.
- HIV documentation: California's Health and Safety Code § 120975 bars compelling any person, in a civil, criminal, administrative, or legislative proceeding, to identify the subject of an HIV test. New York requires a court order under Public Health Law § 2785, and 10 NYCRR 63.6 states that confidential HIV-related information is not released on a subpoena.
The substance use disorder (SUD) 2024 Final Rule (Federal Register (FR) Document No. 2024-02544) took effect April 16, 2024, with a compliance and enforcement date of February 16, 2026 per the HHS fact sheet. It created a protected class of SUD counseling notes requiring separate specific consent that a general treatment, payment, and health care operations (TPO) consent does not reach.
California: For records-only production, the governing instrument is Judicial Council form SUBP-010, directed to the custodian with no personal appearance.
The California Code of Civil Procedure (CCP) classifies medical records as "personal records" under CCP § 1985.3, so a Notice to Consumer (form SUBP-025) must reach the patient at least 10 days before production and at least 5 days before the custodian is served. Proof of notice or the consumer's signed authorization must precede production. CCP § 2020.410 sets the compliance date no earlier than 20 days after issuance or 15 days after service, whichever is later.
Evidence Code § 1560 gives the custodian five days after receipt in a criminal action and 15 days in a civil action to deliver records in a sealed inner envelope, with the § 1561 affidavit certifying them as true, complete, and made in the ordinary course of business. Where the subpoena goes directly to a custodian and the records sit at the witness's place of business, Evidence Code § 1563 caps the compliance fee at $15 plus third-party retrieval costs.
Consumers may move to quash under CCP § 1987.1 or serve a written objection. California's Senate Bill (SB) 497 (2025) bars release of gender-affirming care records in response to a foreign subpoena grounded in another state's law that interferes with the right to seek or provide that care.
New York: Under the New York Civil Practice Law and Rules (CPLR), CPLR Rule 3122(a)(2) requires a subpoena duces tecum for a patient's medical records to state, in conspicuous bold-faced type, that records will not be provided unless the subpoena is accompanied by the patient's written authorization or a court directive. Objections are due within 20 days after service.
Retrieval vs Subpoena: Strategic Analysis
Voluntary retrieval depends on provider cooperation, while a subpoena creates compulsory process enforceable through a motion to compel and contempt.
Neither route dominates. Voluntary retrieval costs less and risks less where the provider cooperates, while a subpoena buys enforceability at the price of procedural exposure.
1. Legal Force and Enforceability
A subpoena's force is conditional. Enforcement follows only where the issuing court reaches the custodian, service was proper, and the HIPAA assurances traveled with the document; absent any of those, the motion to compel fails.
2. Speed and Timeline Control
A patient's own access request under 45 CFR § 164.524 must be answered within 30 days, with one 30-day extension permitted under § 164.524(b)(2)(ii)(B). A third-party request made on the patient's authorization under § 164.508 carries no HIPAA deadline, and HIPAA also sets no subpoena compliance deadline. The issuing party sets the subpoena date within court-rule floors: FRCP 45 requires a "reasonable time," and California's CCP § 2020.410 sets a harder minimum.
3. Risk and Compliance Burden
Compliance risk sits mainly with the producing provider. The provider, as the covered entity, bears the HIPAA civil money penalty for an improper disclosure, and those penalties reach an annual cap of $2,190,294 after the January 2026 inflation adjustment. California's Confidentiality of Medical Information Act (CMIA) adds private damages under Civil Code § 56.35.
4. Scope and Control
Precise limits matter. In Davis v. Superior Court (Williams), 7 Cal. App. 4th 1008 (1992), a defendant subpoenaed a treatment center for all records relating to the plaintiff "from the Beginning of Time to Date." The Court of Appeal held that filing a personal injury action for pain and suffering does not by itself place the plaintiff's mental condition at issue, and that ordering disclosure violated her constitutional right of privacy. Categories and date ranges tied to the injury pleaded survive a motion to quash; open-ended demands invite one.
When to Subpoena Medical Records
A medical records subpoena becomes appropriate once a documented request has failed. The firm's own escalation calendar, not a HIPAA clock, determines when silence or partial production counts as a stall.
- Provider non-response after documented follow-ups with no acknowledgment.
- Incomplete production, where treatment histories arrive partial or imaging is omitted.
- Provider refusal despite a valid, properly scoped authorization.
- Imminent discovery deadlines, where a court-enforceable compliance date is the only reliable lever.
The first three triggers share a precondition: a documented request already on file, without which the escalation reads as premature. The fourth turns on the calendar instead, since a discovery deadline can justify going straight to a subpoena.
How to Execute a Subpoena for Medical Records
This sequence takes a subpoena from drafting through production, with federal and California requirements diverging at the notice and compliance-date steps.
- Identify the records and custodians. List each provider, the treatment notes and imaging needed, and the date range tied to the injury at issue.
- Select the correct process and form. Use Rule 45 in federal court or SUBP-010 for records only in California. A New York subpoena requires the CPLR 3122(a)(2) bold-faced statement.
- Document satisfactory assurances. Prepare the § 164.512(e)(1)(iii) statement of patient notice, or stipulate to a QPO with the limitation and return-or-destruction clauses, and attach the documentation.
- Give required notices. FRCP 45(a)(4) requires notice and a copy of the subpoena to every party before the custodian is served. In California, serve the SUBP-025 Notice to Consumer at least 10 days before production and 5 days before custodian service.
- Serve the provider. Serve the custodian of records at the correct address and tender any statutory witness fee. Set a compliance date clearing the jurisdictional floor.
- Wait out the objection window. Under FRCP 45(d)(2)(B), written objections are due before the compliance date or 14 days after service, whichever is earlier. Calendar the state equivalent and resolve any consumer objection before production.
- Review production against the subpoena. Check the custodian's certification and compare the categories and date ranges to the request. Log gaps for a follow-up subpoena.
Steps 3 and 4 are where most subpoenas fail. Assurances and party notice have to exist before the custodian is served, not after an objection arrives.
Subpoena Validation and Assessment
A valid subpoena directed to a non-party custodian names the court and jurisdiction, the case caption and docket number, the custodian, the records sought with particularity, the date and place of compliance, and the signature of the issuing attorney or clerk. Place-of-compliance limits under Rule 45 govern federal production, while state records-only subpoenas follow the custodian-location rules of the issuing state.
What the Custodian Checks Before Producing
A subpoena that clears the records department's review moves faster than one that triggers a call to counsel.
- Signature. A judge-signed order permits direct disclosure; an attorney- or clerk-signed subpoena routes to § 164.512(e)(1)(ii).
- Jurisdiction and service. Whether the issuing court reaches the custodian, and whether Rule 45(a)(4) notice went to the parties first.
- Assurances on the face. A patient-notice statement or QPO present in the document, not promised in a cover letter.
- Special categories. Part 2, psychotherapy notes, HIV, and minors' records pulled for separate handling.
- Scope. Categories and date ranges narrow enough to satisfy minimum necessary.
- Compliance date and fee. A date clearing the statutory floor, with any witness fee tendered.
A subpoena that survives all six enters the production queue. One that fails any of them comes back as an objection or a phone call.
Handling Objections and Limiting Scope in Medical Record Subpoenas
Challenges cluster around defects the issuing party controls.
- Defective service: wrong custodian, or no notice to the parties under Rule 45(a)(4).
- Missing assurances: no patient-notice statement and no QPO.
- Overbreadth: "any and all records" with no condition or date limit.
- Special-category records: Part 2, psychotherapy notes, HIV, or minors' records absent a court order or authorization.
An objection served after the FRCP 45(d)(2)(B) window closes raises waiver. When a properly served custodian neither objects nor produces, the issuing party moves to compel in the compliance court, and continued disobedience after enforcement can expose the custodian to contempt under Rule 45(g). Narrowing date ranges or stipulating to a QPO resolves most disputes before that point.
Record Production and Quality Control Under a Subpoena
Under Evidence Rule 902, a business record can be self-authenticating through a custodian's certification that complies with a federal statute, 28 U.S.C. § 1746 for declarations made under penalty of perjury. The proponent must give adverse parties reasonable written notice and access to the record and certification before trial.
Under Rule 45, when a subpoena does not specify a form for electronically stored information (ESI), the custodian may produce it as ordinarily maintained or in a reasonably usable form. Naming the production format, Bates-numbering convention, file-naming system, and secure transmission method in the subpoena itself reduces the chance of an unsearchable image dump.
Combining Medical Record Retrieval and Subpoenas
Escalation works best when the subpoena names what the voluntary production omitted rather than repeating the original broad request.
- Treatment intervals the provider skipped when releasing partial history.
- Diagnostic studies needed for the medical chronology or expert review.
A narrow follow-on request is also easier to defend, since the file already shows what was sought voluntarily and what came back.
Next Steps: Optimizing Your Record Workflow
A subpoena compels production that an authorization only permits, and it works only when the issuing firm documents HIPAA satisfactory assurances, follows state notice rules such as California's CCP § 1985.3, observes special-category limits, and clears the objection window.
Knowing when a request has stalled depends on tracking provider response times across every open matter, which is where retrieval compliance obligations and escalation timing meet. The Levensten Law Firm faced the same discovery bottleneck ahead of trial dates and, after adopting Tavrn's retrieval and chronology tools, saw 75% of record requests reach rapid turnaround.
To learn more, book a demo.
