A subpoena for medical documentation is received and authorization is confirmed. What action should the billing and coding specialist take?

A subpoena for medical documentation is received and authorization is confirmed. What action should the billing and coding specialist take?

• A. Send the medical information pertaining to the dates of service requested
• B. Postpone release pending court order
• C. Redact sensitive information and send
• D. Return the request to the requester

Answer: (A)

When a subpoena is received for medical records, the key factor is whether there is a valid authorization to disclose PHI. If the authorization is confirmed, you may release the information to the requester, limited to what was specifically requested. In this scenario, that means sending the medical documentation for the dates of service requested. This aligns with HIPAA: disclosures are permitted when there's patient authorization, and you should provide only the information necessary to satisfy the request (the minimum necessary). There’s no need to delay for a court order since the authorization already authorizes release. Redacting information isn’t required unless the authorization or the scope of the request dictates masking additional data. Returning the request would unnecessarily delay the process.

When a subpoena is received for medical records, the key factor is whether there is a valid authorization to disclose PHI. If the authorization is confirmed, you may release the information to the requester, limited to what was specifically requested. In this scenario, that means sending the medical documentation for the dates of service requested. This aligns with HIPAA: disclosures are permitted when there's patient authorization, and you should provide only the information necessary to satisfy the request (the minimum necessary).

There’s no need to delay for a court order since the authorization already authorizes release. Redacting information isn’t required unless the authorization or the scope of the request dictates masking additional data. Returning the request would unnecessarily delay the process.