Subpoena for Mental Health Records: A Prescriber Playbook

A subpoena for mental health records obligates you to respond by its deadline. On its own, it almost never authorizes you to release the chart. The safe sequence for the first 24 hours: call your malpractice carrier (the legal help is usually already paid for), check whether a judge actually signed the document, and release nothing until the patient authorizes it, the issuing lawyer supplies the assurances HIPAA requires, or a court orders it. The two moves that create real trouble are ignoring the subpoena and mailing the records the day it arrives.

This is practice-operations guidance; it is not legal advice. Mental health records sit under some of the strictest disclosure law in medicine, and the details turn on your state and the case. Make every release decision with your carrier's counsel or your own attorney.

1. Call your malpractice carrier the day you are served

The first call goes to your malpractice carrier, before you answer the attorney who sent the subpoena. Most policies include legal advice for records demands at no added cost; the American Psychological Association's guidance for private practitioners notes that carriers often authorize a legal consultation free of charge, and that the attorney who issued the subpoena represents someone else's interests. The subpoena hotline is a benefit your malpractice policy already includes.

Two things happen on day one regardless of what counsel decides. First, calendar the deadline: in federal court, a written objection must be served before the earlier of the compliance date or 14 days after service under Rule 45, and state windows run comparably short. Second, freeze the chart. No edits, no cleanup, no clarifying additions except entries clearly labeled and dated as late entries. An altered record turns a routine records fight into a credibility problem no lawyer can fix.

"A subpoena obligates you to answer it," says David Cohen, CPA, JD, who reviewed this guide. "It does not, by itself, obligate you to hand over the chart, and almost every prescriber subpoena story that ends badly started with someone collapsing those two duties into one."

2. Identify which of the three documents you are holding

Everything downstream depends on who signed the demand, so read the signature block first. Three documents arrive looking similar and compel very different things:

For an attorney subpoena, HIPAA's judicial-proceedings rule, 45 CFR 164.512(e), lets you disclose only after written "satisfactory assurances": documentation that the patient was notified and the objection window closed with no objection pending, or a qualified protective order limiting use of the records to the litigation and requiring their return or destruction when it ends. Issuing attorneys usually produce this paperwork once asked; the response letter below does the asking.

3. Tell the patient, and let their attorney carry the fight

Contact the patient once you and counsel agree it is appropriate, because the privilege at stake belongs to the patient rather than to you. Federal courts have recognized the psychotherapist-patient privilege since Jaffee v. Redmond in 1996, every state has some version, and your job is to assert it for the patient until they waive it or a court rules.

If the patient consents, get a written HIPAA authorization covering this specific release, and say plainly that they cannot cherry-pick: the release reaches the record as kept, billing entries included. If the patient objects, their attorney is the right person to move to quash or seek a protective order; courts receive that motion better from the person whose privacy is at stake than from the clinician. If the patient is the one suing, most jurisdictions treat a claim that puts mental state at issue as waiving privilege (the patient-litigant exception); whether it applies is the lawyers' fight. Your intake paperwork should already warn patients that a court can defeat confidentiality; if yours skips that line, add it this week.

4. Assume the psychotherapy-notes shield does not cover your chart

The psychotherapy-notes protection most prescribers count on rarely survives contact with the definition. Under 45 CFR 164.501, psychotherapy notes must be kept separate from the rest of the record, and the category excludes medication prescription and monitoring, session start and stop times, modalities and frequency, test results, and any summary of diagnosis, treatment plan, symptoms, prognosis, or progress. That exclusion list covers nearly everything a prescriber documents.

The trap is sharpest if you bill the 90833 therapy add-on. Therapy content documented inside the same med-management progress note is ordinary chart material and travels with any valid disclosure. Only a separately maintained process-note file qualifies, and genuinely separate psychotherapy notes are strongly protected: 45 CFR 164.508 demands the patient's specific authorization for their disclosure, and the judicial-proceedings pathway is missing from its short list of exceptions, so an attorney subpoena with assurances still cannot reach them. A court order expressly naming them can. The separation has to exist in your EHR before the subpoena arrives; this is one more place patient privacy leaks through structure rather than malice.

5. Treat prescribing records as their own risk category

A subpoena that reaches controlled-substance records deserves extra caution, because those pages have an audience beyond the lawsuit. Stimulant and benzodiazepine documentation surfaces in custody disputes, overdose litigation, and criminal matters, and what a plaintiff's attorney reads today a licensing board can read tomorrow. Produce these records exactly as kept, including PDMP checks, refill history, and the signed agreement from your controlled-substance policy; consistent documentation keeps them boring to every audience.

If the demand comes from a licensing board, the DEA, or law enforcement rather than a civil litigant, stop treating it as a records request. Those demands run through different HIPAA pathways (health oversight, law enforcement) and can implicate your own license and registration. Nothing in this category moves before personal counsel reviews it, and your carrier hears about it the same day; some policies cover board-investigation defense.

6. Produce the exact scope, certify it, and log it

Match the production to the demand line by line: the date ranges, the categories, the named clinicians. Overbreadth is a standard objection, and records touching third parties (a spouse in a family session, a sibling in the history) routinely get carved out; flag them to counsel rather than redacting on instinct. Export the record from your EHR as it is kept instead of writing a tidy summary; a summary is a new document you can be cross-examined on.

Most records subpoenas ask for a custodian-of-records certification: a short sworn statement that the copies are true, complete, and made in the ordinary course of business at or near the time of the events. In a solo practice the custodian is you, and many states accept a mailed certification in place of a personal appearance. Keep a duplicate of everything produced with the cover letter, and log the disclosure; releases under the judicial-proceedings rule belong in the accounting of disclosures HIPAA requires.

7. Bill what the rules let you bill

Copying fees for attorney-requested records follow state fee schedules, typically per page plus retrieval and higher than the patient-access rate; your state medical society publishes the numbers. Testimony pays badly by statute: the federal witness attendance fee under 28 U.S.C. 1821 is $40 per day plus mileage, and state fact-witness fees are similarly modest. Whether a treating clinician can charge a professional rate for deposition time varies by state, and retained-expert work is a separate negotiated contract; ask carrier counsel before quoting anyone a number.

Work the patient asks for (records their own attorney wants, letters, coordination) bills like any other paperwork, at the time-block rates you already publish for calls, emails, and forms. The expensive part is usually the canceled clinic day; counsel can often negotiate deposition scheduling, and sometimes fees, so raise it early.

The response letter template

Send a version of this within days of service, after your carrier's counsel edits it for your state and case. It answers on time while releasing nothing.

[Practice letterhead and date]

VIA EMAIL AND CERTIFIED MAIL
[Issuing attorney / firm / address]

Re: Subpoena for records of [patient name], served [date of service]

Dear [Attorney name]:

I am the treating [psychiatrist / psychiatric nurse practitioner] and
custodian of records for the individual named in your subpoena, served
on [date]. This letter is a timely response to the subpoena. No records
are enclosed.

The records you seek are mental health records protected by the
psychotherapist-patient privilege under [state] law and by the HIPAA
Privacy Rule, 45 C.F.R. 164.512(e). I may release them only when one
of the following is provided to my office:

  1. A HIPAA-compliant authorization signed by the patient covering
     this specific release;
  2. Written satisfactory assurances under 45 C.F.R. 164.512(e),
     documenting either (a) notice to the patient with the objection
     period expired and no objection pending, or (b) a qualified
     protective order; or
  3. An order of a court or administrative tribunal, in which case I
     will produce exactly the records the order names.

To the extent the subpoena seeks separately maintained psychotherapy
notes, those are never produced on satisfactory assurances alone; they
require a separate authorization specific to psychotherapy notes or a
court order expressly covering them.

[If applicable] I further object to the subpoena on the following
grounds: [insufficient time to comply / privileged matter with no
applicable exception or waiver / scope reaching records of third
parties or periods unrelated to this matter].

Please direct the documents above, or any questions, to me at
[phone / email] or to my counsel, [name, firm, contact].

Sincerely,

[Name], [credentials]
Custodian of Records, [Practice name]

The checklist

• Day one: carrier called, deadline calendared, chart frozen
• Signature block read: judge, attorney, or patient authorization
• Patient contacted when appropriate; privilege asserted until waived or ordered
• Written authorization, satisfactory assurances, or court order in hand before any release
• Psychotherapy notes separate in the EHR, or they carry no protection; 90833 content travels with the chart
• Board, DEA, or law-enforcement demand: personal counsel before anything moves
• Production matches the demand's scope; custodian certification attached; duplicate retained; disclosure logged
• Copying billed per your state schedule; testimony fees per statute; patient-requested work at published rates