HIPAA can permit a covered provider or health plan to disclose protected health information in court, including through testimony. But receiving a subpoena does not always authorize immediate disclosure. The legal basis, scope of the request, and any additional confidentiality or privilege rules must be reviewed.
A court order differs from an attorney subpoena
HHS explains that a covered entity may disclose information expressly authorized by a court or administrative tribunal’s order. The order does not automatically open the patient’s entire medical history. The permitted disclosure is limited to the information described. [1]
A subpoena issued by an attorney or clerk is not necessarily the same thing as a judge’s disclosure order. In civil proceedings, a covered entity receiving process without an accompanying court order generally needs the required assurances about patient notice or efforts to obtain a qualified protective order, unless another permitted basis applies. [2]
Notice and protective orders serve different purposes
Proper notice allows the patient a meaningful opportunity to object. A qualified protective order restricts use of the information to the proceeding and addresses return or destruction when it ends. HHS describes the documentation that can establish reasonable efforts to meet these requirements.
For example, a lawyer’s demand to discuss “all treatment” does not automatically authorize a nurse to give unrestricted testimony. The covered entity should identify the applicable authorization, order, or procedural assurances and determine what information can lawfully be disclosed.
Other laws may be stricter
HIPAA permission is not a final ruling on physician-patient privilege, psychotherapy information, specially protected substance-use records, or state confidentiality law. Nor does HIPAA mean a witness may simply ignore a valid court command. Resolve objections or scope disputes through the appropriate legal process before the appearance when possible.
- Send process promptly to the entity’s privacy officer or counsel.
- Check who issued it and whether an actual court order exists.
- Determine the permitted subjects and any unresolved objections.
- Limit the testimony to the applicable authorization or legal basis.
Compare federal subpoena timing for procedural preparation and HIPAA questions in divorce litigation when medical information is sought in family proceedings. Being relevant to a lawsuit and being lawfully disclosable are related but separate questions.
Primary sources
Sources checked: October 31, 2026.