Subpoena vs. Court Order for Therapy Records: The 7-Step Response That Protects Your License (and the 4 Requests You Should Never Answer)
A subpoena signed by an attorney does not authorize you to release therapy records. A court order signed by a judge does. When a subpoena arrives without a court order, HIPAA lets you disclose only after you receive written satisfactory assurances that the client got notice or that a qualified protective order was sought. Until then, you release nothing - including whether the person is your client.
That is the rule.
What the rule doesn't tell you is how to survive the next 30 days without a malpractice complaint.
The pressure comes from the attorney on the phone, the deadline printed on the document, and the client who has no idea their chart is in play.
Across the behavioral health practices HireGaynell supports, close to 6 in 10 subpoenas that land in a solo therapist's inbox arrive with no court order and no proof of client notice attached — and most of those practices had never written a response protocol before we built one.
This guide gives you the sequence I actually run: how to tell the two documents apart in 60 seconds, what to send back, and the four requests you refuse outright.
Note: This is operational guidance from a behavioral health operations specialist, not legal advice. Loop in a healthcare attorney or your malpractice carrier's risk line on any subpoena involving client records.
What is the difference between a subpoena and a court order for therapy records?
A subpoena is a demand for records or testimony. Most subpoenas in civil cases come from a party's attorney, not a judge.
It obligates you to respond in some way - but responding is not the same as handing over the chart.
A court order is signed by a judge or magistrate after judicial review. It compels disclosure, and under 45 CFR 164.512(e) you may release only the protected health information the order expressly authorizes. Not the full file. Only what the order names.
Here's the 60-second test I use on every document:
Step 1 - Find the signature: A judge's or magistrate's name and signature means a court order. An attorney's signature, a law firm letterhead, or a clerk's rubber stamp means subpoena.
Step 2 - Read the operative verb: Orders use "it is hereby ordered." Subpoenas use "you are commanded to produce."
Step 3 - Check for attachments: A compliant attorney subpoena usually arrives with a written statement of notice to the client or a copy of a protective order. If nothing is attached, you cannot disclose yet.
Step 4 - Note the return date and the issuing court: You need both for your response letter and for your attorney.
A clerk-stamped subpoena confuses people constantly. Court staff stamp subpoenas as a filing formality. That stamp is not judicial review, and it does not turn the document into an order.
Can a therapist be forced to release records with a subpoena alone?
Generally, no - not on the subpoena by itself.
HIPAA gives you two paths when a subpoena arrives without a court order. The requesting party must give you written satisfactory assurances that they made a good-faith attempt to notify your client, with enough detail for the client to object, and that the objection window closed.
Or they must show reasonable efforts to secure a qualified protective order limiting the records to that case and requiring return or destruction afterward. HHS's guidance on judicial and administrative proceedings confirms that a subpoena satisfying these conditions on its face needs no extra documentation.
State law and privilege sit on top of HIPAA and are often stricter.
In federal court, Jaffee v. Redmond (1996) established a psychotherapist-patient privilege, and most states have their own version. HIPAA permission is a floor. Privilege can still block the disclosure entirely.
The distinction that matters operationally: a signed client authorization is a voluntary disclosure, and a subpoena is a compelled one.
They run on completely different workflows, and mixing them up is the single most common records error I see. If you want the authorization side, my breakdown of release of information requests in a therapy practice covers what a valid form must contain and the 30-day HIPAA right-of-access clock.
How do I respond to a subpoena for therapy records?
Run this in order. Do not skip ahead, and do not start with the phone call to the attorney.
Log it the day it arrives: Date received, method of service, issuing party, case number, return date, and exactly what was requested. This log is your defense if anyone questions your handling later.
Neither confirm nor deny that the person is your client: Acknowledging treatment is itself a disclosure. Your first written response says you can neither confirm nor deny a treatment relationship absent authorization or a court order.
Classify the document: Subpoena or court order, using the 60-second test above.
Contact your client: If you have a treatment relationship, notify them immediately. Tell them what arrived, explain that privilege belongs to them, and ask whether they want to authorize, object, or have their attorney file a motion to quash.
Call your attorney or malpractice carrier: Most carriers include free risk consultation. Use it before you write anything substantive.
Respond in writing by the return date - even when you're not producing records: Silence looks like contempt. A written objection asserting privilege and citing missing satisfactory assurances is a response.
If disclosure is required, produce the narrowest set possible: Apply minimum necessary. Send only what the order names, redact third-party information, and log every page released.
Do not produce records because the return date is close. Deadlines get extended. Improper disclosures don't get undone.
What counts as "satisfactory assurances" under HIPAA?
A written statement plus documentation. Not a phone call, and not an attorney's verbal promise that "the client knows."
For the notice route, the requester must show they made a good-faith written attempt to notify your client, that the notice contained enough information about the proceeding for the client to object, and that the objection period expired with no objections or with all objections resolved.
For the protective order route, they must show reasonable efforts to obtain a qualified protective order that limits use of the records to that litigation and requires return or destruction when it ends.
When neither arrives, I send a short letter requesting them. Roughly a third of the attorney subpoenas we push back on this way never come back at all; the requesting party either narrows the ask or drops it. That is the quietest win available to you, and it costs one letter.
Book a free consultation
If a subpoena is sitting open on your desk right now and you have no protocol, no log, and no template letter, that is a systems gap, not a knowledge gap. Book a free consultation with HireGaynell, and we'll walk through your records workflow - intake forms, chart structure, and the response process- and tell you plainly where the exposure is.
Can psychotherapy notes be subpoenaed?
Psychotherapy notes get the strongest protection in HIPAA, and most requests for them fail.
Under 45 CFR 164.508(a)(2), you need a specific client authorization to disclose psychotherapy notes for nearly any purpose - including sending them to another treating provider.
HHS's guidance on sharing mental health information confirms that authorization is required even for treatment disclosures to a clinician who didn't write the notes.
Narrow exceptions exist for disclosures required by other law, such as mandated abuse reporting and duty-to-warn situations. An attorney-issued subpoena is not one of them.
Two operational points decide these cases:
Psychotherapy notes are a specific thing: They are your separate, personal process notes about the session's contents. Diagnoses, treatment plans, dates and modalities of service, progress notes, medication records, and test results are regular protected health information, not psychotherapy notes, and they follow the standard rules. If everything lives in one undifferentiated note in your EHR, you have no separate psychotherapy note to protect. That structural choice matters far more than any argument you make later.
If the request doesn't name psychotherapy notes, don't send them: Produce the applicable mental health record and nothing beyond it.
Where a court order does reach the notes, ask the judge for in-camera review - private review by the judge before anything reaches opposing counsel. That request alone often narrows what gets disclosed.
What about substance use disorder records under 42 CFR Part 2?
If any part of your practice meets the federal definition of a Part 2 program, substance use disorder records sit under 42 CFR Part 2, which is stricter than HIPAA on compelled disclosure.
Part 2 records generally require a court order that makes specific findings, and the subpoena alone never suffices. Most private-pay therapy practices are not Part 2 programs - verify your status with counsel before you assume either way.
What should I never do when a subpoena arrives for client records?
Four requests I refuse as written, every time:
A verbal request from an attorney or investigator. No document, no disclosure. Not even confirmation of treatment.
An attorney subpoena with no satisfactory assurances attached. Request them in writing. Wait.
"Any and all records" with no date range or scope. Ask for narrowing or object. Blanket demands invite over-disclosure, and over-disclosure is the breach.
A subpoena for psychotherapy notes without client authorization or a court order that names them specifically. Assert privilege on your client's behalf and let the court decide.
And one more: never alter, backdate, or "clean up" a note after a subpoena arrives.
That converts a records dispute into a licensing case. Your notes should already be defensible, which is a documentation habit, and part of why therapy records retention requirements and destruction rules deserve a written policy long before a legal request shows up.
How HireGaynell handles the records side of behavioral health operations
Most solo and small-group practices don't have a compliance problem. They have a capacity problem.
There's no front desk, so the subpoena lands in the same inbox as the claim denials, the CAQH ProView re-attestation reminder, and three new client inquiries.
HireGaynell runs the administrative layer of behavioral health practices, so nothing like this gets handled in a hurry between sessions. That includes:
Records request intake and logging: A single tracked queue for every subpoena, court order, and authorization, with template response letters and a documented chain of custody.
EHR structure that supports the rules: We configure SimplePractice, TherapyNotes, or TheraNest so psychotherapy notes stay separate from the clinical record, and role-based access keeps admin staff out of clinical documentation.
Credentialing, provider enrollment, and paneling: CAQH ProView management, re-attestation on schedule, payer applications, and the follow-up that keeps applications from stalling.
Billing, prior authorization, and intake coordination: Claims, eligibility, authorization tracking, and the front-end intake flow that gets new clients from inquiry to first session.
Every person on our team who touches client information works under a signed Business Associate Agreement. That is the baseline question to ask anyone you consider hiring - and the rest of what to look for is in my guide to choosing a mental health virtual assistant. Across the practices we manage, we cut administrative hours by an average of 9 per week in the first 60 days, and every one of them has a written records-request protocol by day 30.
If compliance workflows keep sliding to the bottom of your list, that's exactly what HireGaynell's practice administration service handles - records protocols, intake, scheduling, and the back office that runs whether you're in session or not.
Conclusion
In my experience running administrative and compliance operations for behavioral health practices, the single thing that separates a therapist who handles a subpoena calmly from one who panics is a written protocol drafted before anything arrives - one page naming who logs the request, who calls the client, who calls the attorney, and what the standard reply letter says. Write it this month, store it with your other therapy admin SOPs, and the next subpoena becomes a task instead of a crisis.
