CT: A subpoena for defendant’s medical records did not violate HIPAA or the Fourth Amendment

A subpoena for defendant’s medical records did not violate HIPAA or the Fourth Amendment. An overbroad subpoena can be quashed, but this one wasn’t. State v. Williams, 146 Conn. App. 114, 75 A.3d 668 (2013):

As to the defendant’s claim that his rights under HIPAA were violated by the state when it issued a subpoena to the department, the defendant has not pointed to any finding by the court that the state failed to abide by the HIPAA regulations. The defendant does not argue that the state violated § 52-143, only that that statute is not applicable in this situation. He argues that a search warrant was required to obtain his records. Nothing in the HIPAA regulations that the defendant has brought to our attention requires a search warrant to obtain medical records in a criminal prosecution.36 To the contrary, an entity covered by HIPAA regulations may disclose medical records pursuant to a subpoena if certain conditions are met. See footnote 36 of this opinion. The court made no finding as to whether the conditions had been met, but noted that even if the conditions had not been met, the defendant’s relief had to be obtained in a different forum. Because the court made no findings with regard to the circumstances under which the department was permitted to respond to the state’s subpoena, the record is inadequate for review.

36 Section 164.512 (e) of title 45 of the Code of Federal Regulations “authorizes a covered entity … to disclose private health information in judicial or administrative proceedings in response to an order of a court. § 164.512 (e) (1) (i). The regulation also allows the disclosure of such information in those proceedings in response to a subpoena, discovery request, or other lawful process, § 164.512 (e) (1) (ii), if the party seeking the information either notifies the patient (or at least makes a good faith effort to do so) ….” (Internal quotation marks omitted.) Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923, 925 (7th Cir. 2004).

Turning to the defendant’s claim that the state violated his right to privacy under the fourth and fourteenth amendments, this court considered a similar issue in State v. Legrand, 129 Conn. App. 239, 244, 20 A.3d 52, cert. denied, 302 Conn. 912, 27 A.3d 371 (2011), in which the defendant, David Paul Legrand, claimed that the state’s use of a subpoena, rather than a search warrant, to obtain his medical records violated his federal and state constitutional rights. This court concluded, under those facts, that the state’s use of a subpoena met the reasonableness requirement under the fourth amendment. Id., 257. Because the facts of this case are similar to those in Legrand, that case controls our decision, although the claim in Legrand constituted a claim of law, not an abuse of discretion, as the defendant here claims.