Subpoenas duces tecum vs. HIPAA: which wins?

• Author: Buchanan, Jr., John D.
• Position: Health Insurance Portability and Accountability Act of 1996 - Florida

The struggle between HIPAA's privacy rules and subpoenas for "protected health information" (PHI) is an ongoing issue that needs to be resolved, and this article is intended to assist in that resolution. In this writer's opinion, the Rules of Civil Procedure trump the privacy regulations of HIPAA once litigation has been initiated. While this article will refer to the Florida Rules of Civil Procedure, it is anticipated that the basic substance of these rules is universal enough to allow this information to be of use in multiple jurisdictions. Like Florida, most states have adopted some form of the Federal Rules of Civil Procedure.

Historical Background and Technical Requirements of Subpoenas For PHI

The filing of a civil lawsuit provides the mechanism for the issuance of subpoenas for witnesses and subpoenas duces tecum for the production of documents. As the Rules of Civil Procedure became more streamlined, the mechanics of issuing subpoenas moved from judges and clerks of court to attorneys, who are officers of the court. Under Rule 1.410, Florida Rules of Civil Procedure, the option exists for either an attorney of record or the clerk of court to issue a subpoena. Fla. R. Civ. P. 1.410(a) (2004).

* Service of the Subpoena Duces Tecum

Any person over the age of 18 who is a nonparty may serve a subpoena including the attorney involved in the case. Rule 1.410(c), Florida Rules of Civil Procedure. F.S. [sections]48.021.

Mailing to a nonparty does not constitute service of the subpoena duces tecum.

A valid subpoena duces tecum must be served in the above manner. A lot of attorneys will mail or send by certified mail the subpoena duces tecum. Weighed against HIPAA regulations, that would suggest a valid service by applicable Rule of Civil Procedure. If the subpoena duces tecum has been served by a person over the age of 18, the proof of such service must be filed with the court by an affidavit of the person serving the subpoena duces tecum. Now all requirements have been met for a valid service of a subpoena duces tecum.

For the production of documentary evidence, a subpoena may "command the person to whom it is directed to produce the books, papers, documents or tangible things designated therein." Fla. R. Civ. P. 1.410(c). A subpoena duces tecum must specify with reasonable particularity the documents sought to be produced. Vann v. State, 85 So. 2d 133, 136 (Fla. 1956). This requirement is met where identifiable categories of documents are stated, even if the precise identity of the document is unknown. Id.

* Motion to Quash

The court, "upon motion made promptly and in any event at or before the time specified in the subpoena for compliance therewith, may ... quash or modify the subpoena if it is unreasonable and oppressive." Fla. R. Civ. P. 1.410(c). While the facts must clearly show the unreasonableness or oppressiveness of the subpoena, this determination is within the broad judicial discretion of the trial judge and a trial court's order will not be overturned absent a clear showing of abuse of that discretion. Matthews v. Cant, 427 So. 2d 369 (Fla. 2d DCA 1983); Sunrise Shopping Center, Inc. v. Allied Stores Corp., 270 So. 2d 32 (Fla. 4th DCA 1972). Another ground for quashing a subpoena may be that it is too indefinite to permit an appropriate response. See Vann, 85 So. 2d at 136. A court may also condition the obligation to respond on the advancement of the costs of producing the books, papers, documents, or tangible things sought. Fla. R. Civ. P. 1.410(c). A party who successfully opposes a subpoena duces tecum may be awarded attorneys' fees, but it should be noted that a nonparty witness who successfully quashes a subpoena duces tecum is not entitled to attorneys' fees. Expeditions Unlimited, Inc. v. Rolly Marine Services, Inc., 447 So. 2d 453 (Fla. 4th DCA 1984).

The Purpose of HIPAA

Why was HIPAA enacted? The preamble to the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, states that HIPAA is an act "to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes." Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191,110 Stat. 1936.

The issue of privacy was given special attention in the Administrative Simplification Regulations at 45 C.F.R. [subsections]160, 164. The purpose of the privacy regulations, promulgated under Title II, Subtitle F, [subsections]261-264 of HIPAA was threefold: first, to provide consumers of health care services with enhanced access to their information while controlling access that resulted in misuse; second, to improve the quality of health care by increasing trust in the health care system; and third, to create a nationwide framework for privacy protection consistent with efforts by states and other organizations thereby resulting in increased efficiency. Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,461 (Dec. 28, 2000). Thus, the idea was to facilitate communications between patient and medical practitioner by providing some assurances that the patient's medical information will not be freely disseminated. The rules in 45 C.F.R. [subsections]160, 164 offer patients these assurances by enacting privacy standards that serve as the minimum permissible level of confidentiality. Because these standards represent a floor, states may enact privacy standards that are more stringent than found in the federal regulations.

Florida's Medical Information Statute

Pursuant to F.S. [sections]456.057(5)(a), a patient's medical records may not be furnished to, nor may the medical...