Sign Up
Login
Try for Free
Login
A subpoena response and records affidavit is the packet a therapy practice assembles when legal process demands client records: an intake log, a written objection or privilege assertion where grounds exist, a custodian affidavit authenticating any copies produced, and a production letter. Records custodians and clinicians use it, with counsel, whenever a subpoena arrives without a court order or client authorization. A typical packet runs 400 to 900 words.
Records custodians and practice managers with the treating clinician; the practice's attorney reviews; a custodian or another qualified person signs the affidavit
The issuing attorney or agency, the court, the client and their counsel, your own compliance log
400 to 900 words across the packet · 40 to 90 minutes by hand (clinical team estimate)
Legal response packet (compare: records request packet, release of information, court report)
When compulsory legal process seeks client records without client authorization; deadlines come from the instrument and the governing court rule
Objection deadlines, privilege procedure, and affidavit predicates are law (Rule 45, FRE 902(11), 45 CFR 164.512(e), state statutes); the intake log and cover letter are convention
A subpoena response and records affidavit is not one standardized document. It is the packet a practice assembles when compulsory legal process demands client records, and it can contain up to four legally distinct documents: a written objection or notice of objection, a privilege assertion that identifies withheld material without revealing it, a custodian affidavit or certification establishing that produced copies are authentic business records, and a production or nonproduction letter. No professional association or agency invented the format. It merges three older legal families: the subpoena duces tecum of compulsory process, the business-record evidence foundation codified when the Federal Rules of Evidence were enacted in 1975, and the confidentiality and privilege objections that decide whether otherwise relevant records may be withheld. Clinicians and lawyers also call the pieces a response to subpoena duces tecum, custodian-of-records affidavit, business-records affidavit, records certification, notice of objection, or motion to quash.
The load-bearing distinction runs through the middle of the packet: the objection and the privilege assertion govern whether records may be disclosed at all, while the affidavit governs only whether copies can be authenticated as evidence, and signing one says nothing about the other. Just as load-bearing: a subpoena signed by an attorney is not a court order. Under the HIPAA judicial-proceedings rule at 45 CFR 164.512(e), a court order permits disclosure of exactly what it authorizes, while a subpoena alone permits disclosure only after satisfactory assurance that the client was notified, or a qualified protective order. Federal common law adds a psychotherapist-patient privilege, recognized in Jaffee v. Redmond, 518 U.S. 1 (1996), and state statutes are often stricter. A client asking for their own chart is a different workflow entirely, the records request, and a third party holding a signed authorization belongs in the release of information lane.
Every practice that keeps records is eventually served: solo therapists, group practices, community clinics, and hospital records departments, most often in family, personal-injury, criminal, and administrative matters. The work divides three ways: a records custodian or practice manager runs intake and signs the affidavit, since federal evidence law accepts a custodian or another qualified person rather than the treating clinician; the clinician supplies the privilege and psychotherapy-notes analysis; and the practice's attorney reviews anything contested. Reach for this packet when process arrives without client authorization. When an attorney simply writes with a signed authorization, use the release of information workflow; when the client requests their own chart, the records request clock and fee rules apply; and when a court wants observations or opinions from treatment rather than copies, that is a court report with its own scope boundaries.
Intake and triage log. Record service the day it happens: date and method of service, who received it, the court and case caption, the issuing attorney or agency, the compliance or return date, the records and date range demanded, whether testimony is also commanded, and whether the client is a party. This entry is how you later prove which deadline applied and why you chose the response path you did. Pitfall: assuming a 30-day clock. The 30-day period belongs to a client's own records request; a subpoena's deadline is whatever the instrument and the governing rule say, and in federal civil cases written objections are due before the earlier of the compliance date or 14 days after service.
Authority screen. Classify what actually arrived before anything else happens: a judge-signed court order, an attorney-issued subpoena, or a demand accompanied by a client authorization. Under 45 CFR 164.512(e), a subpoena without an order permits disclosure only after satisfactory assurance of reasonable efforts to notify the client, or a qualified protective order; an order permits only the information it expressly authorizes. Pitfall: treating an attorney subpoena as a court order. The two sit in different legal categories, and collapsing them produces either an unlawful release or demands for conditions that do not exist.
Scope and privilege review. Map the demand against the record: which categories are in scope, whether separately kept psychotherapy notes are implicated, whether 42 CFR Part 2 substance-use-disorder material is present, and which grounds exist: privilege, statutory confidentiality, overbreadth, undue burden, defective service. Pitfall: treating everything a therapist wrote as a psychotherapy note. The HIPAA definition is narrow and turns on separate storage; misclassification leads either to overproducing separately kept analysis notes or to wrongly refusing ordinary treatment records.
Written objection. Where grounds exist, serve written objections before the deadline: identify the categories objected to, state the grounds, and request the relief sought, such as quashing, modification, in camera review, or a protective order. Pitfall: a blanket refusal, or silence. In federal practice a late objection risks waiving the ordinary grounds, and ignoring the instrument invites contempt exposure; a client's instruction not to release anything supports an objection, it does not cancel compulsory process.
Privilege assertion. Where records are withheld on privilege grounds, expressly claim the privilege and describe the nature of the withheld material without revealing the protected content, the pattern Rule 45(e)(2) and Rule 26(b)(5) require in federal cases. The federal psychotherapist-patient privilege recognized in Jaffee v. Redmond covers confidential communications in psychotherapy with licensed psychiatrists, psychologists, and licensed social workers. Pitfall: writing that all records are HIPAA privileged. HIPAA is a privacy regulation, not a privilege; privilege comes from evidence or substantive law, and the assertion must name the actual source.
Custodian affidavit. The authentication document: the signer's name, role, and basis for knowing the recordkeeping system, identification of the records by category and date range, page or file count, the copying method, and the business-record predicates: made at or near the time by or from a person with knowledge, kept in the course of a regularly conducted activity, made as a regular practice. A custodian or another qualified person may sign under Federal Rule of Evidence 902(11); the treating clinician is not required, and no universal notarization rule exists. Pitfall: certifying too much. The affidavit authenticates recordkeeping; it does not vouch that treatment was appropriate, the diagnosis correct, or the charges reasonable, and drifting into opinion converts it into a different document nobody requested.
Production letter and close-out. When authority is confirmed, transmit with a letter stating what is produced, the date and method, page or media count, withheld categories and their basis, and any agreed narrowing of scope; when no responsive records exist, say so, a statement California's custodian-affidavit statute expressly contemplates. Close the log and retain the complete packet. Pitfall: producing the lifetime file. An order-based disclosure permits only what the order expressly authorizes, and a defined-period demand answered with the whole chart exceeds the legal permission.
SUBPOENA RESPONSE AND RECORDS AFFIDAVIT PACKET
Up to four documents, not one: objection, privilege assertion,
custodian affidavit, production letter. Deadline: the instrument
plus the governing rule (federal civil: the earlier of the
compliance date or 14 days after service). Confirm authority
BEFORE any release.
INTAKE AND TRIAGE LOG
Date served: __________ Method: __________ Received by: ______
Court / case caption and number: _______________________________
Issuing attorney or agency: ____________________________________
Compliance/return date: _________ Objection deadline: _________
Records and date range demanded: _______________________________
Testimony also commanded: [ ] yes [ ] no Client a party: [ ] yes [ ] no
AUTHORITY SCREEN (complete before anything is released)
[ ] Judge-signed court order (produce ONLY what it authorizes)
[ ] Attorney subpoena + satisfactory assurance of client notice
or qualified protective order (45 CFR 164.512(e))
[ ] Signed client authorization covering this disclosure
[ ] Part 2 records demanded: court order AND subpoena both present
[ ] None of the above: object before the deadline, request an
authorization or protective order, consult counsel
Client / client's counsel contacted: ________ Practice attorney: ______
SCOPE AND PRIVILEGE REVIEW
Categories in scope: ___________________________________________
Psychotherapy notes kept separately: [ ] yes [ ] no
(not produced without specific authority)
Privilege / confidentiality grounds asserted: __________________
Other grounds (overbreadth, burden, service): __________________
CUSTODIAN AFFIDAVIT (authenticates recordkeeping, not opinions)
Signer, role, basis of knowledge: ______________________________
Records identified (categories, dates, page count): ____________
[ ] Made at or near the time by a person with knowledge
[ ] Kept in the course of a regularly conducted activity
[ ] Made as a regular practice [ ] True and complete copies
No-record or partial-record statement, if any: _________________
Execution form per the governing rule (declaration or sworn): __
PRODUCTION / NONPRODUCTION LETTER AND CLOSE-OUT
Produced on: ________ Method: ________ Pages/media: __________
Withheld categories and basis: _________________________________
Retain the full packet with the record and any legal hold.Free to use and share, no signup. The PDF includes a one-page cheat sheet with section-by-section pitfalls and a pre-sign checklist; the DOCX is the blank template, ready to adapt.
Scenario: a two-clinician private practice is served with an attorney-issued subpoena for a former client's complete record, with no court order and no client authorization. The packet shows the triage, the response letter, and the unsigned affidavit skeleton. All details are fictional.
Subpoena response packet. Fernhill Counseling Group LLC · Client: L.P. · Served: 08/03/2026 · Objections served: 08/12/2026
Intake log (opened 08/03/2026): Subpoena duces tecum served by process server at 2:10 pm on C. Whitfield, office manager. Civil action pending in federal district court, Case No. 26-cv-0412; issuing counsel R. Malone, attorney for the defendant. Demands all mental health records, notes, and communications concerning former client L.P., no date range stated. Compliance date on the instrument: 08/24/2026. No court order attached, no client authorization on file, no documentation of satisfactory assurance enclosed. Client is a party to the action. Objection deadline calculated: 08/17/2026, the earlier of 14 days after service and the compliance date. Routed to the practice's attorney the same day.
Authority screen (completed 08/04/2026): Judge-signed order: no. Satisfactory assurance of client notice or qualified protective order: none received. Client authorization covering this disclosure: none on file. Part 2 substance-use-disorder records: none held for this client. Psychotherapy notes: kept separately from the chart; excluded from any production absent specific authority. Determination: no current authority to disclose; produce nothing; do not confirm in any response whether a treatment relationship exists; contact the client's counsel through the practice attorney.
Response letter to issuing counsel (sent 08/12/2026, with written objections): The letter states that the practice received the subpoena on August 3, 2026; that federal and state law restrict disclosure of mental health information; and that the subpoena is not accompanied by a court order, a qualified protective order, or documentation of satisfactory assurance under 45 CFR 164.512(e). It states the practice can neither produce records nor confirm whether responsive records exist unless it receives a signed client authorization, a qualified protective order, or an order of the court. The enclosed written objections, served within the Rule 45(d)(2)(B) window, object to the demand as unlimited in time and scope and as seeking material protected by the psychotherapist-patient privilege, described by category only. The letter closes by committing to prompt compliance with a lawful instrument of appropriate scope.
Custodian affidavit skeleton (prepared 08/12/2026, unsigned, held pending authority): Designated signer C. Whitfield, records custodian, familiar with the practice's recordkeeping system. The draft identifies records by category and date range once scope is fixed, and recites: entries made at or near the time of each service by a person with knowledge; records kept in the course of the practice's regularly conducted activity; making such records a regular practice; copies produced are true copies; a no-record or partial-record statement to be added if any demanded category is empty. The draft certifies recordkeeping only and offers no opinion on treatment, diagnosis, causation, or charges. It will be executed in whatever form the governing rule requires, declaration or sworn affidavit, only when production is authorized.
Outcome (logged 08/12/2026): Objections served on day 9 of the 14-day window. Nothing produced; the existence of records neither confirmed nor denied to the issuing party. Awaiting authorization, qualified protective order, or court order. Packet, service documentation, and correspondence retained with the underlying record under legal hold. Logged by C. Whitfield; practice attorney copied.
This sample is fictional and for educational purposes. It does not describe a real client, practice, attorney, or case, and it is not legal advice.
Writing these after every session? BastionGPT drafts complete notes from bullets, dictation, or a transcript.
Generate a note from bulletsThe risk in this workflow runs opposite to most documentation risk: the expensive failure is disclosing too much, too early, to the wrong instrument. HIPAA permits disclosure in judicial proceedings; it does not compel it, and the source of compulsion is the subpoena, order, or statute itself. When a court order is the authority, 45 CFR 164.512(e) permits only the information the order expressly authorizes, so a lifetime chart produced against a defined-period order exceeds the legal permission on its face. Separately kept psychotherapy notes ordinarily need their own psychotherapy notes authorization even when ordinary records may flow, and substance-use-disorder records under 42 CFR Part 2 follow a dual-instrument rule: an authorizing court order does not compel production without a subpoena or other mandate, and a subpoena alone does not replace the required order. State law layers on top and is often stricter: Illinois requires specified warning language on subpoenas seeking protected mental health records, Washington requires advance notice before compulsory discovery of health care information, and California prescribes the custodian affidavit's content, including statements when no or only some responsive records exist. This page is general documentation guidance, not legal advice. Consult your attorney or licensing board; state rules vary.
No payer ever adjudicates this packet: there is no claim and no denial code for a defective subpoena response, so nothing downstream will catch an error the way a billing office catches a rejected claim. The consequences are legal and professional instead: waived objections, contempt exposure, costs, liability for unlawful disclosure, and board complaints. Retention splits the same way it does for access documentation: the HIPAA six-year rule at 45 CFR 164.530(j) covers Privacy Rule compliance documentation, not the chart, while the clinical record follows state and board rules, at least six years in New York with an extended rule for minors, and the prudent convention is to keep the complete legal-response packet, service evidence, correspondence, and an index of anything produced at least as long as the underlying record and any active legal hold. The intake log and cover letter are convention; the objection deadline, the privilege procedure, and the affidavit predicates are law. When the court wants observations or opinions from treatment rather than copies, step out of this packet and into the court report, and route a later request to correct an error in the record through the record amendment process. If you or a client needs immediate support: call or text 988 (US), 9-8-8 (Canada), or Lifeline 13 11 14 (Australia).
This document type has no payer audit trail: a targeted review of OIG mental health reports, CMS CERT materials, and remittance-code lists found no denial code and no published national error rate for custodian affidavits answering therapy-record subpoenas, because the packet never enters claim adjudication. A 2023 HHS Office of Inspector General audit did estimate $580 million in improper Medicare psychotherapy payments, but that number measures billing documentation, not subpoena handling, and importing it here would be false precision. The documented failure modes live in the rules themselves: in federal practice an objection served after the earlier of the compliance date or 14 days risks waiving the ordinary grounds, and in Australian family proceedings unexplained noncompliance can end in an arrest warrant or a costs order. The BastionGPT Clinical Advisory Board sees the same errors most often in subpoena response reviews:
BastionGPT is specifically trained, tuned, and clinically tested on subpoena response and records affidavit packets.
See how clinicians use it day to day on the AI therapy notes page.
Many BastionGPT users report saving more than 90 minutes per day on documentation.
HIPAA-compliant with a signed BAA on every plan. Your data is never used to train models. BastionGPT drafts, you review and sign.
No. A client's instruction supports a privilege or confidentiality objection, but it does not cancel compulsory process. The lawful paths are written objections, a motion to quash or modify, a protective-order request, or attendance at the return date, each inside the instrument's deadline. Ignoring a subpoena risks waived objections, contempt exposure, and costs; in Australian family proceedings, unexplained noncompliance can lead to an arrest warrant.
No, and the distinction drives the whole response. Under the HIPAA judicial-proceedings rule, a court or administrative order permits disclosure of exactly what it authorizes. An attorney-issued subpoena without an order permits disclosure only after satisfactory assurance that the client was notified with a chance to object, or a qualified protective order. State law can prohibit release even then, so the safe sequence is authority first, production second.
Only material that actually meets the definition gets the special handling. HIPAA's psychotherapy-notes category covers a clinician's separately stored session-analysis notes and excludes diagnoses, treatment plans, medication records, session times, test results, functional status, prognosis, and progress summaries. Separately kept notes ordinarily need their own psychotherapy notes authorization or equivalent legal authority; everything commingled with the chart is ordinary record, whatever it is labeled.
Usually not. Federal Rule of Evidence 902(11) accepts a certification by the custodian or another qualified person who knows the recordkeeping system, and no federal evidence rule requires notarization. Some state statutes and prescribed forms are narrower about who signs and how, California's custodian-affidavit statute being the detailed example, so check the governing rule before choosing the signer.
The one on the instrument, read with the governing rule, and it is usually shorter than people assume. In federal civil cases, written objections are due before the earlier of the stated compliance date or 14 days after service. The 30-calendar-day clock many practices know belongs to a client's own records request under access law; it has nothing to do with subpoenas.
Part 2 runs on a dual-instrument rule. Without patient consent, disclosure in a legal proceeding takes both an authorizing court order meeting Part 2's standards and a subpoena or other legally sufficient mandate. An order alone does not compel production, and a subpoena alone does not substitute for the order, so a workflow that checks for just one instrument fails in both directions.
No. A business-records certification establishes how records were made and kept: near-contemporaneous entries by people with knowledge, in the regular course of a regularly conducted activity, as a regular practice, with true copies produced. It does not certify that treatment was appropriate, a diagnosis correct, or future care needed, and the other side can still challenge trustworthiness. When a court wants clinical observations or opinions, that is a court report, a different document with different rules.
No national rule sets a retention period for the packet itself. The prudent convention is to keep the complete response file, the instrument, service evidence, objections, correspondence, and an index of anything produced, at least as long as the underlying clinical record and any active legal hold. Chart retention itself is state and board law: at least six years in New York with an extended rule for minors, ten years past age 18 or last contact for Ontario psychologists, and seven years or to age 25 in New South Wales.
Yes, as the drafting layer under your attorney's judgment. Give it the instrument's facts and it produces the triage log, the response letter seeking an authorization, qualified protective order, or court order, the written objection, and an unsigned custodian affidavit skeleton for counsel to review. BastionGPT is HIPAA-compliant with a signed BAA on every plan, and your data is never used to train models.
Educational content, not legal or billing advice. Sample notes are fictional. Follow your organization's policies and your board, payer, and jurisdiction requirements.