Medical Records Requests and Subpoenas After Ciox Health

Complying With Federal and State Laws When Responding to Subpoenas and Requests

Recording of a 90-minute CLE webinar with Q&A

This program is included with the Strafford CLE Pass. Click for more information.
This program is included with the Strafford All-Access Pass. Click for more information.

Conducted on Tuesday, April 21, 2020

Recorded event now available

or call 1-800-926-7926
Course Materials

This CLE course will provide healthcare counsel with guidance on medical records requests and subpoenas. The panel will examine the recent decision in Ciox Health v. Azar and the HHH Office of Civil Rights (OCR) response it prompted. The panel will discuss how the decision and OCR response change the landscape and will offer best practices for complying with HIPAA and other federal and state laws and the subpoenas/requests for medical records.


Healthcare providers, other covered entities, and their business associates often receive requests and subpoenas for medical records that include protected health information (PHI). Federal and state privacy laws, including HIPAA, limit disclosure of PHI to third parties. However, this does not mean the healthcare providers can ignore subpoenas or some other requests for medical records.

In Ciox Health v. Azar (D.D.C. Jan. 23, 2020), the federal district court held (1) HHS's 2013 rule compelling delivery of PHI to third parties regardless of the records' format is arbitrary and capricious insofar as it goes beyond the statutory requirements set by Congress; (2) HHS's broadening of the Patient 3 Rate in 2016 is a legislative rule that the agency failed to subject to notice and comment in violation of the APA; and (3) HHS's 2016 explanation concerning what labor costs can be recovered under the Patient Rate is an interpretative rule that HHS was not required to subject to notice and comment.

Following the court's vacating of the 2016 Patient Rate expansion and the 2013 mandate broadening PHI delivery to third parties regardless of format, the OCR issued a notice that addressed the right of access to health records. Healthcare counsel must understand the impact of the Ciox Health decision and the OCR response.

Listen as our authoritative panel of healthcare attorneys examines the requests and demands for medical records that covered entities and business associates may receive. The panel will discuss the different types of requests/subpoenas as well as patient access and individual requests for records. The panel will review how the courts have addressed requests for medical records and offer guidance for complying with HIPAA and other federal and state laws and the subpoenas/requests for medical records.



  1. Ciox Health decision and what it means for holders of medical records
  2. OCR response to Ciox Health
  3. Responding to requests and subpoenas for records and complying with federal and state laws


The panel will review these and other noteworthy issues:

  • How does the Ciox Health decision change the landscape of medical records requests or subpoenas?
  • What is the impact of the decision on existing state medical record laws and regulations?
  • What steps should healthcare counsel take to comply with medical records subpoenas as well as HIPAA and other privacy laws?


Licata, Joe
Joe Licata

COO and General Counsel

Mr. Licata serves as COO and GC at HealthMark, a healthcare software and technology business focused on release of...  |  Read More

Peters, Iliana
Iliana L. Peters


Ms. Peters is recognized by the healthcare industry as a preeminent thinker and speaker on data privacy and security,...  |  Read More

Access Anytime, Anywhere

Strafford will process CLE credit for one person on each recording. All formats include course handouts.

To find out which recorded format will provide the best CLE option, select your state:

CLE On-Demand Video