HIPAA Privacy Rules: protecting patient information requested through discovery, subpoenas and court orders

Health plans routinely receive requests for patient health care information in lawsuits and administrative proceedings, whether through court order, subpoena, discovery requests or otherwise. The HIPAA Privacy Rules describe what protections a health plan must obtain before disclosing patient health information without prior authorization. This article focuses on the regulatory framework governing health plans, a review of recent case law applying these HIPAA regulations and a practical guide for how a health plan may proceed upon receiving requests for disclosure.