Medical Records Subpoena Guide for Attorneys

By John Mahoney · April 2026 · 16 min read

Every medical malpractice case begins with the medical records. Before you can evaluate liability, before you can retain experts, before you can develop a case theory — you need the records. And getting complete, unredacted, timely medical records is more complicated than it should be.

Medical records custodians are notoriously slow. HIPAA regulations create specific requirements that vary depending on whether you are requesting records for your own client or from a non-party. Some records require patient authorization. Others can be subpoenaed directly. Some categories of records — psychiatric, substance abuse, HIV — have additional layers of protection that can trip up even experienced attorneys.

This guide covers the complete process of obtaining medical records for litigation, from pre-suit authorization requests through formal subpoena, dealing with non-compliance, and the specific issues that arise with electronic medical records. Getting this process right at the beginning of the case saves months of delay and ensures your case is built on a complete evidentiary foundation.

Pre-Suit Medical Records Requests

Before a lawsuit is filed, your primary tool for obtaining medical records is the patient's HIPAA authorization. Understanding how this works — and its limitations — is essential for efficient case development.

HIPAA authorization requirements

Under HIPAA, a patient (or their legal representative) has the right to access their own medical records. To exercise this right on behalf of your client, you need a valid HIPAA authorization form signed by the patient. A compliant authorization must include a description of the information to be disclosed (specific enough to identify the records but broad enough to capture everything relevant), the person or entity authorized to disclose the information (the specific provider or facility), the person or entity authorized to receive the information (your firm), an expiration date or event, a statement of the patient's right to revoke the authorization, a statement that information disclosed may be subject to re-disclosure and may no longer be protected, and the patient's signature and date.

Use a comprehensive authorization that covers all records related to the patient's treatment at the facility, including but not limited to physician notes, nursing notes, laboratory results, imaging studies and reports, operative reports, discharge summaries, medication administration records, therapy notes, and billing records. The more specific your authorization, the harder it is for the custodian to withhold categories of records by claiming they were not covered.

Requesting records from your own client's providers

For records from providers who treated your client, send the HIPAA authorization along with a specific written request that identifies the patient by name and date of birth, the date range of records requested, the specific categories of records requested (do not just say "all records" — list the categories), your preferred format (electronic versus paper), and your firm's contact information and mailing or electronic delivery instructions.

Send these requests by certified mail with return receipt, and keep a log of every request sent, the date sent, the date received by the custodian, and the deadline for production. HIPAA allows providers 30 days to respond, with one 30-day extension. Calendar these deadlines and follow up aggressively when they pass.

Costs and fee limits

Providers are permitted to charge a reasonable fee for medical records production. Many states have fee schedules that cap the per-page charge for medical records copies. Some states distinguish between paper copies and electronic copies, with lower fees for electronic production. Federal law (under HIPAA) limits charges to a reasonable, cost-based fee. Know your state's fee schedule and push back on providers who charge excessive fees — some custodians routinely overcharge, and many attorneys pay without questioning the invoice.

Timing considerations

Send records requests immediately upon retention, before you have completed your initial case evaluation. Do not wait until you have decided to take the case. Medical records take time to produce, and every week of delay at the front end extends the case timeline. If you ultimately decline the case, you have lost the cost of the records request (typically $50 to $300 per provider). That is a worthwhile investment to avoid a two-month delay on cases you do take.

Subpoena Procedures for Medical Records

Once litigation is commenced, the subpoena duces tecum becomes your primary tool for compelling medical records production from both parties and non-parties. The specific requirements vary by jurisdiction, but the general framework is consistent across most states.

Subpoena to a party

In most jurisdictions, you obtain medical records from a party through standard discovery requests (interrogatories, requests for production of documents) rather than subpoenas. A request for production directed to the defendant hospital or physician should demand the complete medical record for the patient, including the electronic medical record in native format, all imaging studies in DICOM format, the EMR audit trail showing all access and modifications to the record, any incident reports or quality assurance documents (subject to privilege arguments), credentialing files for the involved providers, and applicable clinical protocols and standing orders.

The advantage of party discovery requests is that they carry the weight of the court's discovery rules and can be enforced through motions to compel with sanctions. The disadvantage is that the opposing party controls the production and may produce records selectively, incompletely, or in formats that are difficult to review.

Subpoena to a non-party custodian

For medical records from non-party providers (prior treating physicians, other hospitals, pharmacies, imaging centers), you issue a subpoena duces tecum to the records custodian. The subpoena must comply with your state's procedural rules for non-party subpoenas, which typically include proper service requirements (personal service, certified mail, or as specified by rule), adequate notice to all parties (typically 10 to 30 days before the return date), a HIPAA-compliant authorization from the patient if required by the jurisdiction, a specific description of the records requested, a reasonable time for compliance, and information about the custodian's right to object or seek a protective order.

HIPAA and the qualified protective order

HIPAA permits disclosure of protected health information in response to a subpoena if the requesting party provides satisfactory assurance that reasonable efforts have been made to notify the patient, or the requesting party obtains a qualified protective order from the court. In practice, most plaintiff attorneys in medical malpractice cases have a HIPAA authorization from their client covering their own records, so the HIPAA issue arises primarily when subpoenaing records from non-party providers who treated the plaintiff or when the defense seeks records from the plaintiff's other providers. Having a qualified protective order entered at the beginning of the case eliminates HIPAA objections for the duration of the litigation.

State-specific requirements

Medical records subpoena requirements vary significantly by state. Some notable variations include states that require a court order (not just a subpoena) for certain categories of records, states that require the subpoena be accompanied by a patient authorization regardless of HIPAA, states that require notice to the patient (not just the parties) before records are produced, states that have specific forms or procedures for medical records subpoenas that differ from general subpoenas, and states that require the records be produced to the court or to a neutral custodian rather than directly to the requesting party. Research your jurisdiction's specific requirements before issuing subpoenas to avoid having them quashed on procedural grounds.

Special Categories of Protected Records

Certain categories of medical records carry additional privacy protections beyond standard HIPAA requirements. Failing to account for these protections can result in quashed subpoenas, sanctions, and ethical complaints.

Psychiatric and mental health records

Most states provide heightened protection for psychiatric and mental health records. In many jurisdictions, these records cannot be disclosed even with a general HIPAA authorization — they require a specific authorization that identifies psychiatric records by name or a court order after an in camera review. If your case involves allegations that the patient's mental health history is relevant (for example, a defense claim of pre-existing psychiatric condition), you will need to navigate these heightened protections carefully.

Substance abuse treatment records

Records from federally assisted substance abuse treatment programs are protected under 42 CFR Part 2, which imposes stricter requirements than HIPAA. These records generally cannot be disclosed without patient consent that meets the specific requirements of Part 2 (which are more detailed than HIPAA authorization requirements) or a court order that meets the specific criteria of Part 2 (which requires a finding that the public interest and need for disclosure outweigh the potential injury to the patient). General HIPAA authorizations and standard subpoenas are insufficient for Part 2 records. If substance abuse treatment records are relevant to your case, consult the specific Part 2 requirements or seek a court order.

HIV and STI records

Many states have specific statutes protecting HIV test results and treatment records. These typically require a separate, specific authorization from the patient or a court order. The penalties for improper disclosure of HIV records can be severe, including statutory damages. Handle these records with particular care.

Genetic information

The Genetic Information Nondiscrimination Act (GINA) and various state laws provide protections for genetic testing results and genetic information. If your case involves genetic testing (for example, in a failure to diagnose a genetic condition), ensure your authorization and subpoena specifically address genetic information and comply with applicable protections.

Dealing with Non-Compliant Custodians

Medical records custodians are frequently slow, incomplete, or unresponsive. Having a systematic approach to dealing with non-compliance prevents case delays.

The follow-up sequence

Implement a structured follow-up protocol for every records request and subpoena. At 7 days after the deadline, send a written reminder by email and mail noting the missed deadline and requesting immediate production. At 14 days past deadline, send a second written demand with a specific date by which production must occur and a statement that you will seek court intervention if the deadline is not met. At 21 days past deadline, file a motion to compel if the records are from a party, or a motion to enforce the subpoena if from a non-party. Do not wait longer than 21 days past the deadline to seek court intervention. Custodians who ignore the first two reminders will not respond to a third.

Common objections and responses

Custodians raise several common objections to medical records subpoenas. Understanding these objections and preparing responses in advance streamlines the process.

Overbreadth. The custodian claims the request is too broad. Response: narrow the request to specific date ranges and record categories if warranted, but push back if the original request is reasonable for the scope of the litigation.

Undue burden. The custodian claims production would be too costly or time-consuming. Response: offer to pay reasonable costs and point out that the records are maintained in the normal course of business and are accessible through the facility's EMR system.

HIPAA compliance. The custodian claims they cannot produce records under HIPAA. Response: provide the patient's authorization or the qualified protective order and cite the HIPAA provision that permits disclosure for judicial and administrative proceedings.

Privilege. The custodian withholds certain documents (peer review records, quality assurance records, incident reports) claiming they are privileged. Response: this is a jurisdiction-specific issue. Research your state's peer review and quality assurance privilege statutes, which vary significantly. In some states, these documents are absolutely privileged. In others, the privilege is qualified and can be overcome with a showing of need.

Motions to compel and sanctions

When a custodian fails to comply with a valid subpoena, file a motion to compel production accompanied by a declaration detailing your efforts to obtain voluntary compliance. Request an order compelling immediate production and, if warranted, sanctions including the costs of the motion and attorney fees. Courts take subpoena enforcement seriously, and a motion to compel usually produces records within days of being filed.

Electronic Medical Records: Specific Considerations

Electronic medical records (EMRs) present both opportunities and challenges for records acquisition that did not exist with paper charts.

Requesting records in native format

EMR systems store data in structured databases, not as page images. When you request a "copy of the medical record," most facilities produce a printed version of the EMR data — a PDF that looks like a paper chart but is actually a subset of the data in the system. This printed version typically omits metadata, audit trails, deleted or amended entries, embedded links and attachments, system-generated alerts and warnings, and the structured data fields that underlie the narrative notes.

For medical malpractice cases, request the complete EMR output including the standard printed record, the audit trail (access log) showing who accessed or modified the record and when, any deleted, amended, or addended entries with their original content and modification timestamps, all CPOE (computerized physician order entry) data including order times, physician acknowledgment times, and result notification times, nursing flow sheets in their native electronic format (not the summarized print version), and any system alerts, clinical decision support notifications, or best practice alerts that fired during the patient's care.

The audit trail

The EMR audit trail is one of the most powerful evidentiary tools in medical malpractice litigation. It shows every instance of a user accessing the patient's chart, including the user's identity, the date and time of access, the specific sections of the chart that were viewed or modified, and any entries that were created, amended, or deleted. This data can prove that a physician did not review critical lab results in a timely manner, that a nursing assessment was documented hours after it supposedly occurred, that entries were added or modified after the patient's outcome was known (suggestive of chart alteration), and that certain providers never accessed the chart at all despite claiming to have assessed the patient.

Imaging studies in DICOM format

Radiology imaging studies (X-rays, CTs, MRIs, ultrasounds) should be requested in DICOM format on CD or through secure electronic transfer, not as printed films or PDF images. DICOM files can be viewed with diagnostic-quality imaging software, allowing your radiology expert to review the actual study rather than a degraded copy. The difference in quality can affect the expert's ability to identify findings and render opinions.

Pharmacy and medication records

Electronic prescribing systems, automated dispensing cabinets (like Pyxis), and pharmacy databases contain medication data that may not appear in the standard medical record printout. Request pharmacy records separately if medication errors are at issue. These records show the exact time each medication was dispensed, who dispensed it, and any overrides of safety alerts. Automated dispensing cabinet logs are particularly valuable because they show precisely when a nurse accessed a medication and how much was withdrawn.

Building a Complete Record Set

One of the most common failures in medical malpractice case development is working with an incomplete record set. Missing records can conceal critical evidence, undermine expert opinions, and create gaps in the timeline that the defense exploits.

Identifying all treating providers

Start by creating a comprehensive list of every provider and facility that treated the patient for the condition at issue. Sources for this list include the patient's own recollection, insurance claim records and EOBs, referral letters in the existing records, hospital face sheets listing referring and consulting physicians, pharmacy records showing all prescribing providers, and imaging center records showing ordering physicians. Cross-reference every provider mentioned in any record against your request list. If a consulting physician is mentioned in a hospital note but you do not have that consultant's records, request them.

Pre-incident and post-incident records

Medical malpractice cases require records beyond the incident itself. Pre-incident records establish the patient's baseline health, document pre-existing conditions that may affect damages, and provide the medical history that the defendant should have considered. Post-incident records document the consequences of the malpractice, including subsequent treatment, ongoing symptoms, and the patient's current condition. Request at least 2 to 5 years of pre-incident records from the patient's primary care provider and any relevant specialists, and all post-incident records through the present.

Billing and insurance records

Billing records serve dual purposes. They document economic damages (all medical expenses incurred as a result of the malpractice) and they reveal treatment episodes that may not appear in the clinical records. A billing code for a procedure or office visit that does not have a corresponding clinical note is a red flag that records may be missing. Request billing records from every provider along with the clinical records and reconcile the two.

EMS and ambulance records

If the patient was transported by ambulance or EMS, those records are often overlooked but can be critical. EMS records document the patient's condition at the scene, vital signs during transport, interventions performed, and the patient's statements. In cases where the hospital records do not reflect the patient's condition upon arrival, EMS records can fill the gap. Request these from the EMS agency directly — they are not part of the hospital record.

Organizing Records for Case Development

Obtaining the records is only half the battle. Organizing them for efficient review and case development is equally important.

The traditional approach

The traditional approach to medical records organization involves manually sorting records by provider and facility, indexing each document by type and date, reading through every page to identify relevant entries, creating a chronological timeline by hand, and flagging key documents for expert review. This process takes a paralegal or LNC 20 to 80 hours per case depending on the volume of records. It is thorough when done well but extremely time-consuming and susceptible to human error in large record sets.

AI-powered records organization

AI tools designed for medical-legal records analysis can process the complete record set in minutes, extracting structured data (diagnoses, medications, procedures, vital signs, provider encounters) and organizing it into a searchable, chronological timeline. The AI output serves as a foundation for human review — your LNC or paralegal verifies the extracted data rather than extracting it from scratch. This approach reduces records organization time by 60 to 80 percent, identifies gaps and inconsistencies that manual review might miss, and produces a structured timeline that is immediately useful for case evaluation, expert review, and deposition preparation.

Quality control

Whether you use manual or AI-assisted organization, verify the completeness of your record set before declaring it final. Check that records from every identified provider have been received, that there are no unexplained gaps in the timeline, that billing records reconcile with clinical records, that imaging studies are available for review (not just the radiology reports), and that the audit trail and metadata have been obtained for the key EMR records. A complete, well-organized record set is the foundation of every successful medical malpractice case. Invest the time and resources to get it right.

Bottom Line

Medical records are the evidentiary foundation of every medical malpractice case. Getting them — completely, promptly, and in the right format — is a process that requires planning, follow-through, and attention to the specific legal and regulatory requirements that govern medical records disclosure.

Start records requests on day one. Use comprehensive HIPAA authorizations. Issue subpoenas that are specific, procedurally compliant, and accompanied by the required notices and authorizations. Follow up aggressively with non-compliant custodians. Request EMR audit trails and native-format data, not just printed chart copies. And verify the completeness of your record set before moving to case development.

The attorneys who build the best medical malpractice cases are the ones who treat records acquisition as a strategic activity, not an administrative task. Every record you obtain is a potential piece of evidence. Every record you miss is a potential gap the defense will exploit. Get the records right, and the rest of the case follows.

Questions? Contact us at [email protected] or (856) 979-6525