Presented by Jennifer Coughlin Eugene, Oregon April 10, 2013

1. Civil Proceedings: How to Subpoena Medical Records Under HIPAA and Oregon Law 2. Information to Secure 3. Criminal Proceedings: How to Subpoena Medical Records Under HIPAA and Oregon Law 4. Civil vs. Criminal 5. Violations: what happens if you produce records in violation of HIPAA or state Law?

* ORCP55:Subpoenas * ORCP55H: Individually Identifiable Health Information * 55H(1) (a) Definition * 55H(1) (b) Qualified protective order

* 55H(2)(a) * Modes of compliance for attorneys * QPO or affidavit: * 14 day objection * Sufficient information * No objections or resolved * 55H(2)(b) * Mailing within 5 days * Affidavit from records custodian

* Inner envelope * Title and number of action * Name of witness * Date of subpoena * Outer envelope * Court attendance * Deposition attendance * Hearing attendance * To attorney issuing subpoena * Inspection or copy * Requests

* Inspection after filing and giving notice

a) Affidavit or declaration i. Duly authorized custodian ii. True copy of all records responsive iii. Control of or ordinary course of business b) None or part, put in affidavit c) More than one affidavit or declaration

a) Personal attendance “The personal attendance of a custodian of records and the production of original records is required by this subpoena. The procedure authorized pursuant to ORCP 55H(2) shall not be deemed sufficient compliance with this subpoena.” b) More than one subpoena i. Custodian is witness to first party

* Tender and payment of fees Nothing in this section requires tender or payment of more than one witness and mileage fee or other charge unless there has been an agreement to the contrary.

* When was subpoena served? * How and upon whom was it served? * What documents accompanied the subpoena? * Is there a release on file to disclose the information sought? Has the witness: Agreed to the time and date? Talked to the attorney issuing the subpoena?

ORS Medical records may be obtained by subpoena as provided in ORCP 55and shall be sent only to the court or the clerk of the court before which the matter is pending. In relation to grand jury proceedings, notice need not be given as required in ORCP 55H and the medical records shall be sent only to the grand jury.

Is it a subpoena issued by the prosecutor or defense attorney? YES Release on file? YES Produce the Records

Is the subpoena accompanied by a release or court order signed by a judge authorizing the disclosure of the records? YES Produce the records as directed by the subpoena

Was the subpoena accompanied by the assurance affidavit stating: YES Produce the Records Patient was provided notice of subpoena Time for objection has passed or that all objections have been resolved and production of the records is consistent

Attorney has attempted to provide written notice to patient? YES Produce the Records No HIPAA assurance affidavit received, Is there documentation with the subpoena or information in it that establishes: Notice to patient sufficiently described the lawsuit or proceeding to allow the patient to object to the production of the records or information if patient was so inclined Has at least 14 days passed from the date patient actually received the notice and: Patient has not objected; or Patient’s objections have been filed with the court; and The court has ruled on those objections

If no HIPAA assurance affidavit has been provided by the attorney and there is insufficient documentation providing the previously mentioned information… Request that the attorney issuing the subpoena provide a release or an assurance affidavit If that is produced Produce The Records If the attorney refuses to provide a release or an assurance affidavit Appearance required at a deposition? Appearance required in court? Send a letter objecting to the subpoena File a motion to quash

Is the subpoena for drug or alcohol records? YES Is there a release in the file or is the subpoena accompanied by a release authorizing disclosure of the requested information that complies with requirements of 42 CFR 2.31? YES Produce the Records

Does the release contain: Specific name or general designation of the program or person permitted to make the disclosure? Name or title of individual or name of the organization to which disclosure is to be made? Name of patient? Purpose of disclosure? How much and what kind of information is to be disclosed? Signature of the patient or the person authorized to give consent on behalf of the patient? The date on which the consent is signed? A statement that the consent is subject to revocation at any time except to the extent that the program or person which is to make the disclosure has already acted in reliance on it? The date, even or condition upon which the consent will expire if not revoked before? YES Produce the Records

If there is no consent which complies with 42 CFR 2.31, is there a court order signed by a judge (not a clerk) expressly and specifically referring to the drug/alcohol treatment records being sought that states … Patient and healthcare provider had been given sufficient notice of the application to the court for the order to obtain the records; The court finds that other ways of obtaining the same information being sought are “not available or would not be effective”; The court finds that the public interest and need for the disclosure outweigh the potential injury to the patient, the physician-patient relationship and the treatment services; The order names the specific persons to whom the disclosure needs to be made. YES Produce the Records

If there is no court order, and no consent… Appearance required at a deposition Appearance required in court Send a letter objecting to the subpoena File a motion to quash

* Civil: can produce directly to attorney * Criminal: can only produce at court hearing/trial

a) Civil fines i. Individual did not know (and by exercising reasonable diligence would not have known) that he or she violated HIPAA: i. Min: $100/violation ii. Max: $50,000/violation ii. Violation due to reasonable cause and not due to willful neglect: a) Min: $1,000/violation b) Max. $50,000/violation iii. Violation due to willful neglect but violation is corrected within required time period (30 days): a) Min: $10,000/violation b) Max: $50,000/violation iv. Willful neglect not corrected: a) Min: $50,000/violation b) Max: $50,000/violation b) There is no private right to a cause of action under HIPAA. The only remedy is under State law causes of action