Quick answer
Preserving records and disclosing records are different decisions. Route legal process to counsel, retain potentially relevant material under the approved hold, and identify the specific disclosure pathway before production. A subpoena without a court order has conditions that differ from an order or a law-enforcement request. Special record protections and current law can add limits.
A records request can arrive by mail, at the front desk or through a supplier's support queue. The first useful action is to preserve the request and route it promptly to the responsible legal and records teams. It is not to export every record associated with the resident.
HIPAA distinguishes judicial and administrative proceedings from law-enforcement disclosures. A court order, a subpoena without an order and an informal request do not carry identical conditions. Other law may compel or restrict a response; HIPAA permission alone does not decide that question. 45 CFR 164.512(e)–(f).
Open two linked decisions
The preservation decision identifies records and systems that must remain intact while counsel evaluates obligations. Include relevant charts, attachments, messages, audit records and vendor-held copies within the approved scope. Record who can suspend scheduled deletion and how the hold will later be released.
The production decision identifies what may or must leave the organization, for which recipient and purpose, by what deadline and through which route. Keep these permissions separate in the software. A user able to preserve an archive should not automatically gain authority to disclose it.
Test three request patterns
| Request | Review needed before production | Likely operational failure to prevent |
|---|---|---|
| Court order identifies a resident, dates and record classes | Authenticity, jurisdiction, scope and other applicable protections | Exporting unrelated periods because the chart button selects everything |
| Attorney subpoena without an order | Applicable notice or protective-order assurances, or another valid route | Treating the letterhead and deadline as sufficient authority |
| Officer asks informally for the entire chart | Specific law-enforcement provision, required conditions and scope | Applying a narrow identification permission to unrestricted records |
Under the judicial-process provision, satisfactory assurances can involve documented notice and resolution of the objection period or steps toward a qualified protective order. The covered entity also has a route to make the specified reasonable efforts itself. Counsel should identify the exact pathway and evidence; staff should not improvise it from a general “legal request” checkbox.
A qualified protective order has defined limits on use and return or destruction. Preserve those conditions with the production rather than treating the order as an unrestricted downstream license.
Screen for additional record protections
Identify records that may be subject to Part 2 and route them for the applicable proceeding-specific review. A treatment, payment and operations consent does not automatically authorize use of Part 2 records in proceedings against the patient. Source, consent and recipient status matter. HHS Part 2 guidance.
Also verify current law rather than relying on a historic checklist. HHS reports that the June 18, 2025 court order vacated most of the 2024 reproductive-health privacy rule. Do not apply a vacated federal attestation requirement merely because it remains in an old form or displayed rule text; other applicable protections still need review. HHS court-order notice.
Produce a controlled package
Use a synthetic test in which a request covers March and April, the chart spans a year and two attachments fall outside the approved scope. The reviewer should be able to exclude those attachments, retain the untouched source records and explain the exclusion in the internal production record.
The manifest should identify the approved scope, resident match, files or pages, date range, any redactions, final reviewer and delivery recipient. Verify actual receipt through the approved channel. Hashes or file counts can detect a changed package but do not prove the legal scope or resident identity is correct.
Retain the decision and evaluate whether the disclosure belongs in an accounting. Ease's skilled nursing offering is planned; any legal-hold or production capability would need demonstrated separation of preservation, review and release authority.
Questions & answers
Does receiving a subpoena authorize a SNF to send the entire chart?
No. The applicable process, required assurances or other disclosure route, scope and additional protections must be reviewed. A court order permits only the PHI expressly authorized under the relevant HIPAA provision.
Should a legal hold automatically expose records to the requesting attorney?
No. A hold preserves material against loss or deletion. Disclosure requires a separate decision about authority, scope, privilege, special protections and the approved recipient.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.