Can you fax medical records on a subpoena?
Not on a subpoena alone. With no court order, 45 CFR 164.512(e) allows release in three cases: assurance of notice to the patient, assurance of a protective order, or the practice acting first.
Not on a subpoena alone. With no court order, 45 CFR 164.512(e)(1) lets a practice release records in three cases: the requester gives satisfactory assurance of notice to the patient, the requester gives satisfactory assurance of a qualified protective order, or the practice makes one of those efforts itself. A court order releases only the records it expressly authorizes.
Which route releases what?
| Demand | What has to be in place first | Rule |
|---|---|---|
| A court or tribunal order | The order itself; the release stops at what it expressly authorizes | 164.512(e)(1)(i) |
| Subpoena with no order, notice path | The requester's statement and documents showing notice to the patient, a lapsed objection time and no open objection | 164.512(e)(1)(ii)(A), (iii) |
| Subpoena with no order, protective-order path | The requester's statement and documents showing a qualified protective order agreed and presented, or requested | 164.512(e)(1)(ii)(B), (iv), (v) |
| Subpoena with no order, the practice acts first | The practice's own reasonable efforts to give that notice or to seek that order | 164.512(e)(1)(vi) |
| Psychotherapy notes | The patient's authorization, or an exception such as a disclosure required by law that meets 164.512(e) | 164.508(a)(2); 164.512(a)(2) |
| Part 2 records, on a subpoena | A Part 2 court order authorizing the disclosure, plus a subpoena or similar mandate that compels it | 42 CFR 2.61 |
Is a subpoena the same as a court order?
No. An order comes from a court or administrative tribunal and limits the release to the protected health information it expressly authorizes (164.512(e)(1)(i)). A subpoena, discovery request or other lawful process that arrives without an order runs under (e)(1)(ii). MagMutual, an insurer, tells providers to look for a judge's signature, since a subpoena signed by a clerk or an attorney is not a court order.
What does a subpoena without an order need?
On the notice path, the requester sends a written statement and documents showing a good-faith attempt to give the patient written notice, a notice that described the proceeding well enough for the patient to object to the court or tribunal, and an objection time that has run with no objection filed or every objection resolved in a way that fits the release (164.512(e)(1)(iii)).
On the protective-order path, the statement and documents show that the parties agreed to a qualified protective order and presented it to the court, or that the requester asked the court for one (164.512(e)(1)(iv)). Qualified means the order, or the parties' stipulation, bars the parties from using or disclosing the records outside the case and requires every copy back or destroyed when the case ends (164.512(e)(1)(v)).
A practice may rely on a statement and documents that meet these terms on their face when that is reasonable under the circumstances (164.514(h)(2)(i)). It can also act first: after reasonable efforts to give that notice or seek that order, it may release without the requester's assurance (164.512(e)(1)(vi)). A patient's signed authorization is a separate route, covered in records requests by fax.
Does HIPAA set a deadline?
No. The rule counts no days. On the notice path, release waits until the patient's time to object has run and any objection is resolved (164.512(e)(1)(iii)(C)), so an objection time still open on the subpoena's return date means that path is not met yet.
What does a safe fax look like?
Section 164.512(e) names no delivery method, so a fax answers to the Privacy Rule's safeguards duty in 164.530(c), and a safe one has three parts.
- A verified number. The fax number is confirmed by calling the requesting office at a number looked up independently, since a fax that lands at the wrong number is presumed a breach under 45 CFR 164.402 (wrong-number faxes).
- A cover sheet without PHI. Page one carries the sender, the recipient and the page count while the patient's name, date of birth and case caption stay on the pages behind it, and neither Part 160 nor Part 164 of 45 CFR mentions a cover sheet (cover sheet requirements).
- A delivery certificate. Every Fax Pigeon plan includes one for every delivered fax, with the date and time, the pages and a confirmation ID (what a vendor should show).
The release also goes on the patient's accounting of disclosures, because a 164.512(e) disclosure is not among the exceptions in 164.528(a)(1). The record is kept six years (164.528(d), 164.530(j)(2); retention periods). The business associate agreement (BAA) that 164.502(e) calls for when a fax service keeps the pages comes signed at signup with every Fax Pigeon plan (plans).
Where does the rule stop for psychotherapy notes?
Psychotherapy notes are a mental health professional's notes on a counseling session, kept apart from the rest of the medical record (45 CFR 164.501). Disclosing them takes the patient's authorization, with listed exceptions (164.508(a)(2)). One covers a disclosure that 164.512(a) permits, meaning one required by law, and 164.512(a)(2) sends that disclosure through the 164.512(e) conditions. The consent post lists what the definition leaves out.
Section 164.103 defines required by law as a mandate that compels the disclosure and is enforceable in a court of law, and it lists subpoenas or summons issued by a court, a grand jury, an inspector general or an administrative body. Whether a given subpoena meets that definition decides the question. MagMutual's guide advises releasing psychotherapy notes only with the patient's authorization or on a court order that specifically requests them, and not on a subpoena a lawyer signed.
Does 42 CFR Part 2 change the answer?
For records Part 2 covers, yes: records that identify a patient as having or having had a substance use disorder and come from a federally assisted program for its diagnosis, treatment or referral (42 CFR 2.11, 2.12(a)(1)). A person holding them may not use or disclose them in response to a subpoena unless a court of competent jurisdiction enters an authorizing order under Part 2 (2.61(b)(1), as amended by the rule published February 16, 2024). That order authorizes a disclosure and does not compel it, so a subpoena or similar mandate must still issue (2.61(a)).
Does HIPAA still require an attestation for reproductive health records?
No. The Northern District of Texas vacated the 2024 rule that required one on June 18, 2025 (Purl v. HHS, No. 2:24-cv-00228). That rule added 45 CFR 164.509, a signed attestation before a release of protected health information potentially related to reproductive health care under 164.512(e). The Fifth Circuit dismissed the appeal on September 10, 2025. The Electronic Code of Federal Regulations still prints the section.
Does a grand jury or law enforcement subpoena follow the same rule?
No. Process for a law enforcement purpose, such as a grand jury subpoena or a subpoena issued by a judicial officer, runs under 164.512(f)(1)(ii), which has conditions of its own. Paragraph (e) does not supersede the rest of the section (164.512(e)(2)), and a state privacy law more stringent than the federal rule is not preempted (45 CFR 160.203(b)), so either can add a requirement. The call on any one subpoena belongs to the practice's counsel.
* Fax Pigeon prices and plan terms as of October 14, 2026.
Frequently asked questions
- Can you fax medical records on a subpoena with no court order?
- Yes under HIPAA, after one of three things happens: the requester gives written assurance that the patient was given notice, the requester gives written assurance of a qualified protective order, or the practice makes reasonable efforts to give that notice or seek that order itself (45 CFR 164.512(e)(1)(ii) and (vi)). A return date printed on the subpoena is not one of the three.
- Is a subpoena the same as a court order for medical records?
- No. A court order releases only the protected health information it expressly authorizes (45 CFR 164.512(e)(1)(i)), with no assurance step. A subpoena with no order permits release under 164.512(e)(1)(ii) only once the notice or protective-order assurance arrives, or the practice makes those efforts itself under (vi). MagMutual, an insurer, treats a subpoena signed by a clerk or an attorney as no order.
- How long do I have to respond to a subpoena for medical records?
- HIPAA sets no number of days, and the subpoena states its own return date. On the notice path, release waits until the patient's time to object to the court or tribunal has run with no objection filed or every objection resolved (45 CFR 164.512(e)(1)(iii)(C)). The protective-order path has no waiting period in the rule. A return date is not one of the 164.512(e) conditions.
- Can psychotherapy notes be faxed on a subpoena?
- Not on the notice or protective-order assurance alone. Psychotherapy notes need the patient's authorization unless an exception in 45 CFR 164.508(a)(2) applies. The exception that reaches a subpoena covers a disclosure required by law (164.512(a)), and 164.512(a)(2) sends that disclosure through the 164.512(e) conditions. Whether a particular subpoena is required by law under 164.103 is a question for the practice's counsel.
- Do I have to log a subpoena disclosure in the accounting of disclosures?
- Yes. A disclosure under 164.512(e) is not among the exceptions in 45 CFR 164.528(a)(1), so it belongs on the patient's accounting, which covers the six years before a request. Each entry needs the date, the recipient's name and address if known, a description of what was sent, and either a purpose statement or a copy of the written request (164.528(b)(2)).
- Does a HIPAA subpoena assurance release drug and alcohol treatment records?
- No. For records a federally assisted substance use disorder program holds, 42 CFR 2.61(b)(1) bars use or disclosure in response to a subpoena unless a court of competent jurisdiction has entered an authorizing order under Part 2. That order permits the disclosure and does not compel it, so a subpoena or similar mandate must still issue (2.61(a)). A 164.512(e) assurance is not that order.
Fax Pigeon
HIPAA-compliant fax with a signed BAA on every plan
Plans start at $4.99 a month, billed annually, for 200 pages, with your own number and unlimited people. Your first fax is free.
- Free porting of your local number
- Fax from your email
- AI summary of every inbound fax
- E-signatures
- Contact management
- Delivery proof
Know a practice that still faxes? Refer it through the referral program and earn 20% of its plan, every month it stays.