August 25, 2026

When your organization receives a subpoena demanding patient medical records, your staff's instinct may be to comply — quickly and without question as it appears to be a court document. That instinct can expose your organization to devastating consequences: six-figure civil penalties, criminal prosecution, tort liability, and irreparable reputational harm.

This alert summarizes the critical compliance risks that healthcare organizations face when responding to subpoenas for protected health information ("PHI"), with particular emphasis on the heightened requirements that apply to substance use disorder ("SUD") treatment records under 42 C.F.R. Part 2 ("Part 2"). If your organization treats patients with SUDs, the stakes are even higher, and the margin for error is essentially zero.

A Subpoena Is Not a Court Order, And the Distinction Is Everything

One of the most common and dangerous misunderstandings in this area is the assumption that a subpoena carries the same legal authority as a court order. It does not. A court order is issued and signed by a judge. A subpoena, by contrast, may be issued by a court clerk or even, in some jurisdictions, by an attorney alone. Under HIPAA, a covered entity may disclose PHI without patient authorization in response to a court order, but only to the extent expressly authorized by that order. A subpoena alone is legally insufficient to authorize disclosure.

Under HIPAA, disclosure in response to a subpoena alone requires additional "satisfactory assurances," specifically, that the requesting party has either (a) notified the patient of the request or (b) made reasonable efforts to secure a qualified protective order. Without those assurances, producing records in response to a subpoena is a HIPAA violation, regardless of how official the subpoena appears. This standard is a gray area and is often subject to additional litigation if a patient alleges they were not actually notified or did not consent to the disclosure. This risk makes a court order the vastly preferred option from a health care provider’s standpoint.

Part 2 Imposes Even Stricter Requirements on SUD Records

If your organization either receives federal assistance and holds itself out as providing SUD diagnosis, treatment, or referral for treatment, or receives information from such an organization, then Part 2 applies to you. Under Part 2, SUD treatment records may not be disclosed in a civil proceeding unless the court issues a specialized court order based on a judicial finding of "good cause,” and courts apply a strong presumption against disclosure. Even after such an order is entered, a separate subpoena must still be issued to compel production – the order alone does not require disclosure. Part 2's restrictions also extend to anyone who subsequently receives protected SUD records, including outside counsel.

The Consequences Are Severe

Mishandling a subpoena for PHI or Part 2-protected records can trigger any or all of the following:

Civil penalties under HIPAA ranging from $100 to $50,000 per violation, depending on the violator's mental state. Criminal penalties for intentional violations of up to $250,000 in fines and up to 10 years of imprisonment. Part 2 violations are subject to the same civil and criminal penalties imposed for HIPAA violations. State tort liability may also apply, including claims for negligence, medical malpractice, invasion of privacy, and breach of the physician-patient privilege. And the reputational consequences of a privacy breach involving vulnerable patients (particularly those with substance use disorders) cannot be overstated. Patients who fear that their SUD treatment records may be disclosed are less likely to seek or remain in treatment, compounding the public health crisis.

Where Organizations Get It Wrong

The most common,  and most dangerous,  errors include treating a subpoena as equivalent to a court order and producing records without verifying satisfactory assurances, disclosing SUD records without the required Part 2 court order, and failing to involve compliance officers or legal counsel before any records leave the building. Each of these missteps can independently trigger the full range of penalties described above.

What You Should Do Now

Do not wait for the next subpoena to arrive. Contact your legal counsel immediately to evaluate whether your current subpoena response procedures are adequate,  particularly with respect to the subpoena-versus-court-order distinction and the heightened requirements of Part 2. The consequences of noncompliance fall on the provider,  not on the party that issued the subpoena.

This article is general in nature and does not constitute legal advice.  If you have legal questions, please consult any of the authors: John Neyens (816.265.4152; jneyens@sb-kc.com), John Fuchs (816.265.4228; jfuchs@sb-kc.com), Colby Stone (816.265.4162; cstone@sb-kc.com), or your regular contact at Seigfreid Bingham at 816.421.4460.