Part 2 subpoena response gate

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.61 states that a person holding Part 2 records may not use or disclose them in response to a subpoena unless a court of competent jurisdiction enters an authorizing order under Part 2. A subpoena supplies a demand, not the missing Part 2 authority. The authorizing order also does not compel disclosure without valid process.

A subpoena alone leaves the authority gate closed

42 CFR 2.61 gives the direct example: a holder receiving a subpoena may not use or disclose records unless a competent court enters the required authorizing order. Intake staff should avoid confirming patient status while gathering the demand and service details.

An authorizing order alone may leave production optional

When an order authorizes disclosure but the subpoena is absent, expired, or quashed, the holder may refuse. A valid subpoena or other compulsory process may require disclosure unless a separate legal defense applies. Counsel determines the response and forum procedure.

Preserve before producing

Open a restricted matter, suspend scheduled deletion for potentially responsive evidence, record deadlines, verify issuing authority and service, and keep clinical and operations teams from editing or exporting records for the request. Preserve original content and correction history.

Stop ordinary records fulfillment

Flag the request as potentially involving Part 2 records and prevent routine subpoena, ROI, payer, support, discovery, or chart-export workflows from releasing them. Preserve the original process and service without forwarding patient-identifying information broadly. Send it to the designated privacy and legal team.

Do not confirm patient status, program participation, diagnosis, referral, or record existence to an unverified requester while the gate is unresolved.

Verify the subpoena

Record issuing authority, court or agency, jurisdiction, case, parties, recipient, service method, service date, deadline, patient identifiers, requested categories, date range, testimony, attachments, and any confidentiality language. Confirm authenticity and whether the process is valid, current, stayed, expired, narrowed, or quashed.

Identify defenses and response options with counsel. A short deadline does not create Part 2 authority.

Find the correct authorizing order

Determine which Part 2 order provision fits the purpose: noncriminal use, investigation or prosecution of a patient, investigation or prosecution of a program or holder, or another defined route. Verify the court, findings, notice or hearing, scope, recipients, uses, protections, and relationship to the subpoena. Do not reuse an order from another patient, matter, purpose, or holder.

The 2024 final rule revised the order framework. Review current text and the entered order rather than an old form.

Match and produce narrowly

Compare subpoena and authorizing order line by line. Produce only records or testimony supported by both, with required redaction, pseudonym, sealing, recipient, use, and security controls. Inspect structured fields, narrative, attachments, audit data, metadata, and other patients' information. Preserve the exact production and delivery.

Seek clarification or protective relief when the request exceeds the order, the order exceeds valid process, or identity protections cannot be implemented.

Reconcile outcomes

Track objection, extension, amendment, withdrawal, order, production, acknowledgment, correction, return, destruction, appeal, and closure. Keep legal holds and preservation separate from disclosure authority. A duty to preserve data internally does not itself permit external production.

Audit subpoenas, informal follow-ups, phone confirmations, vendor productions, testimony, overbroad exports, deadline handling, and closed matters. Test that automated legal and records systems respect the Part 2 hold.

Example with subpoena intake

Fifteen subpoenas are logged. Nine have a matched, valid Part 2 order; four have no order and two cite orders for different patients or matters. Authorization readiness is 9 of 15 subpoenas.

Owner controls

The 2024 final rule provides current context. Use a no-disclosure intake script, counsel routing, patient-identity protection, matched-instrument controls, legal holds, deadline alerts, production review, and secure return.

Subpoena-response checklist

• stop routine release and avoid confirming patient or record status;
• authenticate and preserve the subpoena, service, scope, and deadline;
• identify the correct Part 2 order pathway and current entered order;
• match subpoena and order for patient, records, testimony, purpose, and recipient;
• apply redaction, sealing, security, delivery, and disclosure-log controls; and
• track objections, amendments, production, corrections, preservation, and closure.

A subpoena starts a governed legal response. It does not, by itself, open a Part 2 record.

Route later calls, replacement subpoenas, and informal narrowing proposals through the same review so a requester cannot bypass the documented gate.