News & Insights


HIPAA Compliant – and Revenue Generating – Responses to Subpoenas and Medical Records Requests After Ciox Health

Covered entities and their business associates often receive requests and subpoenas for medical records and other documents that contain protected health information (PHI). Appropriate responses and the fees that may be charged depend on who is requesting or subpoenaing the PHI, what type of document contains the request, and what is included with the request or subpoena.

From 2016 until January 28, 2020, HHS took the position that the “Patient Rate” applied to third-party requests. On January 28, 2020, HHS announced that the fee limitations no longer apply to requests for copies of records to be sent to third parties. This decision arose from a federal court opinion, Ciox Health, LLC v. Azar, et al., No. 18-cv-0040 (D.D.C. January 23, 2020). The change could mean millions of dollars in revenue for covered entities, medical records companies and other business associates.

Unbeknownst to many covered entities, business associates and attorneys, HIPAA does not contemplate a single response to all requests for medical records. Whether a subpoena, court order, warrant, summons, investigative demand or other request is valid, and the responses required, depend on analyses dictated by HIPAA regulations.

In this one-hour roundtable webinar, the panelists will describe the various types of federal and state requests and demands for medical records that covered entities and business associates may receive, how to determine whether the law enforcement exception applies, how to deal with attorneys and others to ensure a request is valid while avoiding unnecessary burden and expense, and how to comply.

Participants will also receive:

  • Checklists;
  • Step-by-step response processes;
  • Examples of how state laws may interact with these federal requirements; and
  • Recommendations for ensuring that policies and procedures adequately describe the requirements and ensure compliance.

Tuesday, February 25, 2020
1:30 P.M. – 2:30 P.M. ET

If you have questions concerning this roundtable webinar, email


King & Spalding is an accredited provider of CLE credit in California, Georgia, Illinois, New York and Texas. We can issue reciprocal credit for attorneys licensed in Connecticut, Florida, and New Jersey. We will apply for credit in Colorado, North Carolina and Virginia (subject to MCLE Board approval). For jurisdictions not listed, attendees are provided with a Universal Certificate of Attendance. New York licensed attorneys: Transitional/Appropriate for newly-admitted and experienced attorneys. Financial aid is available for qualifying lawyers. For CLE-related questions, please contact Gisel Arias, King & Spalding, 1180 Peachtree Street NE, Atlanta, GA 30309. CA Provider #10947.

Event Details

Date: February 25, 2020

Time: 1:30 pm (ET)

Attend This Event

Please register soon. You do not have to be a client to attend, and there is no charge.