Subpoenaed for Therapy Records? What to Do Before You Send Anything

If a subpoena for a client's records just arrived, don't ignore it and don't send anything yet. A subpoena almost always needs a response, but responding is not the same as disclosing. In most situations you need your client's written authorization or a judge's order before confidential records leave your office. Today: put the deadline on your calendar, call your malpractice carrier's risk-management line, and hold off on talking to the attorney who sent it.

The first hour: four rules

1. Don't ignore it. A subpoena signed by an attorney rather than a judge still requires a timely response. Failing to respond can lead to fines, penalties or a waiver of your rights.^1,2
2. Don't send records yet. The APA's Committee on Legal Issues puts it plainly: “a subpoena alone will generally not be sufficient” to justify disclosing confidential information.¹
3. Don't discuss the client with the requesting attorney. That attorney is not your attorney and may represent interests different from yours or your client's.¹ Risk-management guidance for counselors advises discussing the subpoena only with your own attorney.²
4. Calendar the response date. Note the compliance date and any earlier objection deadline. In federal civil cases, written objections to a document subpoena must be served before the earlier of the compliance date or 14 days after service.³ State courts set their own timelines, so ask your attorney which applies.

Subpoena or court order? What HIPAA actually says

The HIPAA Privacy Rule treats the two differently in 45 CFR 164.512(e).

With a court order (including an order from an administrative tribunal), you may disclose, but only the protected health information the order expressly authorizes.⁴

With a subpoena, discovery request or other lawful process that has no court order, you may disclose only if you receive “satisfactory assurance” from the party seeking the records. That means a written statement and documentation showing one of two things:^4,5

• Notice to the client. The requester made a good-faith attempt to give your client written notice, with enough information about the case for the client to object. The time to object has also passed, with no objections filed or all objections resolved.
• A qualified protective order. The requester has asked the court for one. The order must bar use of the information outside the case and require that it be returned or destroyed when the case ends.

The rule also lets you make those reasonable efforts yourself: notifying the client or seeking a qualified protective order.⁴

Psychotherapy notes are a separate category

HIPAA defines psychotherapy notes as notes a mental health professional records about the contents of a counseling session that are kept separate from the rest of the record. The definition excludes medication monitoring, session times, treatment modalities and frequencies, test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress.⁷ So if you don't keep separate process notes, you likely have no “psychotherapy notes” in the HIPAA sense.

If you do, they need their own authorization for almost any disclosure. An authorization for psychotherapy notes can only be combined with another psychotherapy-notes authorization.⁸ A subpoena on its own does not fit the narrow exceptions. Those exceptions do include disclosures required by law, a category HIPAA defines to include court orders.^8,9 If a court order covers your notes, the APA suggests asking the court to shield separately kept psychotherapy notes from production.¹

The privilege usually belongs to your client, and you may have to raise it

In Jaffee v. Redmond, 518 U.S. 1 (1996), the Supreme Court held that confidential communications between a licensed psychotherapist and a patient during diagnosis or treatment are protected from compelled disclosure in federal courts under Federal Rule of Evidence 501. The Court applied the privilege to licensed social workers providing psychotherapy and rejected case-by-case balancing. A footnote notes that the patient may waive it.¹⁰

Jaffee does not settle every case. In a civil case where state law supplies the rule of decision, state privilege law governs, even in federal court.¹¹ Divorce and custody cases are typically heard in state courts, so your state's privilege statute usually controls.

According to the APA, in most jurisdictions the privilege belongs to the client, not the therapist. The clinician is expected to assert it unless the client has waived it or signed a valid release, an exception applies, or a court orders disclosure.¹ Watch for the patient-litigant exception. A client who puts their own mental condition at issue, as can happen in custody or personal-injury claims, may have waived the privilege. How broadly that applies varies by jurisdiction.¹

Stricter rules: substance use records and state law

42 CFR Part 2. Part 2 covers federally assisted programs that hold themselves out as providing, and do provide, substance use disorder diagnosis, treatment or referral.^12,13 HHS's 2024 final rule was published February 16, 2024, with a compliance date of February 16, 2026.¹⁴ Under the current rule, a subpoena alone cannot unlock Part 2 records. A court must enter an authorizing order under Part 2's own procedures, and a subpoena or similar mandate is what then compels disclosure.¹⁵ In non-criminal matters, the court must find that other ways of getting the information are unavailable or ineffective. It must also find that the public interest outweighs the potential injury to the patient and the treatment relationship, and limit disclosure to the essential parts of the record.¹⁶ Part 2 records also can't be used in proceedings against the patient without consent or a court order.¹³ Whether your practice is a Part 2 program is a legal question; if you provide SUD treatment, ask.

State mental health confidentiality laws. Many states have their own confidentiality and privilege statutes for mental health professionals, which can be stricter than HIPAA or require specific notice or court procedures. Because more stringent state privacy law survives HIPAA preemption,⁶ check your state's rules, not just the federal ones.

What to do this week, step by step

1. Read the subpoena closely. Note who issued it, the case and court, whether it asks for records, testimony or both, the date, and whether a court order or client authorization is attached.
2. Call your malpractice carrier. Counselor risk guidance says to contact your insurer immediately.² Some carriers include free consultation. The Trust offers free risk-management consultation to psychologists it insures through its Advocate 800 service.¹⁷ CPH Insurance lists two hours of free attorney consultation per policy period for counselors.¹⁸ Check whether yours does. If the carrier assigns an attorney, it may be handled as a claim.¹⁹
3. Consider your own attorney. Look for one who knows health information law and your state's confidentiality statutes.^1,2
4. Contact your client, and document it. Explain what's being requested, by whom and for what purpose.¹ With the client's consent, talk with the client's attorney. Courts are generally more receptive to a motion to quash or a protective order filed by the client, so their lawyer may take the lead.¹ Note the date, what you discussed and what the client decided.
5. If the client wants records released, get it in writing. Use a HIPAA-compliant authorization, with a separate one for psychotherapy notes.⁸ For couples or family records in a divorce or custody case, you may need authorization from both parties.¹⁹
6. If there's no authorization and no court order, respond in writing. Assert the privilege, and state that you won't produce confidential information without a valid authorization or a court order. Send it before the deadline. In federal cases, you must expressly claim the privilege and describe what's withheld without revealing it.³ A sample letter is below.
7. Send only what's covered. A court order limits you to what it expressly authorizes.⁴ HIPAA's minimum necessary standard applies to many disclosures, though not to those made under an authorization or required by law.²⁰ Psychologists should also know that test materials, as opposed to a client's test data, may call for a court order to protect test security.¹
8. Keep a record. Keep copies of the subpoena, your correspondence and everything you produce. Don't alter the clinical record once legal action has begun.² Clients have a right to an accounting of many disclosures made in the prior six years. Disclosures under an authorization are exempt, but judicial and administrative proceedings are not on the exemption list, so log the date, recipient, a description of what was disclosed and the purpose.²¹

What the professional associations say

• APA. The Committee on Legal Issues' “Strategies for Private Practitioners Coping With Subpoenas or Compelled Testimony for Client/Patient Records or Test Data or Test Materials” (revised 2016) covers checking validity, contacting the client, negotiating, motions and depositions.¹
• ACA. Under the 2014 ACA Code of Ethics (B.2.d), when a court orders disclosure without the client's permission, counselors seek the client's written, informed consent or take steps to prevent the disclosure or limit it as narrowly as possible.²²
• NASW. Standard 1.07(j) asks social workers to protect client confidentiality in legal proceedings to the extent the law permits. When ordered to disclose without consent in a way that could harm the client, social workers should ask the court to withdraw or narrow the order, or keep the records under seal.²³

If you're asked to testify, especially in a custody case

As a treating clinician, you are usually called as a fact witness, testifying about what you observed and did in treatment. An expert or custody evaluator is a different role, retained or appointed to form opinions for the court.

Mixing the two roles is where clinicians get into trouble. The APA's 2022 Guidelines for Child Custody Evaluations in Family Law Proceedings list conducting a custody evaluation with a current or former therapy client as an example of a multiple relationship. They also say treating psychologists should try to refrain from recommending custody, parenting time or decision-making arrangements.²⁴ Counselor risk guidance adds a practical point: don't volunteer to testify for one parent without a subpoena, because being subpoenaed helps you avoid looking biased.² If you're deposed, the APA advises having your own counsel present.¹

Sample letter: subpoena without a court order or authorization

[PRACTICE LETTERHEAD]
[DATE]
Via [EMAIL / CERTIFIED MAIL]

[ATTORNEY NAME], [FIRM], [ADDRESS]
Re: Subpoena dated [DATE], [CASE NAME], [COURT], Case No. [NUMBER]

Dear [NAME]:

I was served with the above subpoena on [DATE OF SERVICE]. It requests [RECORDS / TESTIMONY] concerning [NAME AS WRITTEN IN SUBPOENA]. Nothing in this letter confirms or denies that any person named is or was a client of this practice, or that responsive records exist.

Information of the kind requested would be confidential and privileged under [STATE PRIVILEGE STATUTE / RULE], and I am obligated to assert that privilege. It would also be protected health information under the HIPAA Privacy Rule, which does not permit disclosure in response to a subpoena alone (45 C.F.R. § 164.512(e)).

I will not produce records or testify about confidential information unless I receive (1) a written authorization signed by the individual [OR LEGAL REPRESENTATIVE] that meets 45 C.F.R. § 164.508 [AND STATE REQUIREMENTS], or (2) an order signed by a judge of a court of competent jurisdiction directing the disclosure.

Please treat this letter as my written objection under [APPLICABLE RULE]. Direct further communication about this matter to [MY ATTORNEY, CONTACT INFORMATION].

Sincerely,
[NAME, CREDENTIALS, LICENSE NUMBER]

Using AI to read a subpoena

A subpoena usually names your client, the parties and the case number, and it may mention treatment dates. That is client information, so don't paste it into a consumer chatbot. (More on that in Can therapists use ChatGPT?)

Hey Eduardo is a Mac menu-bar app that runs its AI model on your Mac by default. Nothing you capture is sent to Hey Eduardo or any AI company, and a Local/Cloud badge always shows which mode you're in. Highlight the subpoena and press ⌥⇧E for a plain-language rewrite that lists hard terms with their meanings, or ⌥⇧D to pull out the dates, names and figures. The “What should I watch out for?” preset lists deadlines and what the document asks of you, based only on what the text says. If it came as a fax or scanned PDF, ⌥⇧C reads the text using Apple's on-device text recognition. “How do I respond?” drafts a reply for you to edit, and writes [...] where it needs a fact the document doesn't give.

It won't tell you whether the subpoena is valid, what your state requires or whether to comply. It isn't legal advice and doesn't replace your attorney. It gets you to that call knowing what's being asked, by whom and by when. For clinical work, turn off Recent history, which is on by default, in Settings → Reading → Recent.

Related: See how Hey Eduardo fits clinical work on our therapists and psychologists pages, read whether therapists can use ChatGPT under HIPAA, and review what the APA says about AI for psychologists.