A physician, pharmacy, laboratory or healthcare management company may first learn of a federal investigation when an investigator hands over a subpoena or a records custodian receives one by mail. The first instinct may be to send everything requested, or to treat the document as a suggestion and file it away. Both approaches create avoidable risk. The response begins by establishing exactly what legal process was served, who is required to act, what records exist, and what laws affect production. For a provider-facing checklist, compare immediate steps after a government subpoena arrives at a medical practice.
Not every federal request is the same
A grand jury subpoena, a Rule 17 trial subpoena, an administrative subpoena or civil investigative demand, a search warrant and a voluntary agent request have different legal consequences. Read the issuing authority, case or investigation reference, the named recipient, place and time for response, document specifications and definitions. Confirm authenticity and service through appropriate channels. Do not assume that a request from an FBI agent and a court-issued subpoena impose identical duties.
Federal Rule of Criminal Procedure 17 permits subpoenas requiring testimony and production of specified materials. Rule 17(c)(2) describes a prompt motion to quash or modify where compliance would be unreasonable or oppressive. The response to a grand jury subpoena can involve other applicable rules, grand jury secrecy, privileges and prosecutorial processes. Counsel should evaluate objections, preservation and deadlines within the actual posture rather than mailing a generic form objection.
Immediate document preservation is a separate duty
Identify the systems and custodians reasonably likely to have relevant materials: electronic health records, billing claims, patient charts, specimen or delivery logs, pharmacy dispensing records, practice-management platforms, financial ledgers, contracts, emails, text messages, payroll systems and shared files. Preserve original metadata and audit trails when possible. Suspend routine deletions or overwriting of relevant material under an appropriate legal hold. Tell custodians not to modify or backdate source records.
Do not quietly have one employee delete messages or ask another to create a “cleaner” version of an old chart. The existence of a subpoena is not proof of wrongdoing, but obstruction and false records can create independent problems. Preserve even unfavorable materials and then evaluate their legal status through counsel.
HIPAA does not impose a universal prohibition on disclosure
HIPAA permits certain disclosures in response to legal process, but the specific permission and limits matter. Under HHS guidance on law enforcement requests, 45 C.F.R. § 164.512(f) addresses court orders, judicial subpoenas and grand jury subpoenas. Different protections can apply to judicial or administrative proceedings under § 164.512(e), including satisfactory assurances about notice or a qualified protective order for certain subpoenas without a court order. A provider should not incorrectly demand patient permission in every grand jury context, or release an entire database whenever an investigator uses the word “subpoena.”
Also examine specialized protections for particularly sensitive categories of records, relevant state privacy law and any limits in the actual subpoena. The right answer may require segregating information, seeking clarification or using secure production procedures.
Establish the legal entity and representation
The subpoena may be addressed to the corporation, a custodian, a particular professional or a former employee. Their interests and obligations are not always identical. Determine whether corporate counsel represents the business alone, whether an individual may need independent counsel and which employees are authorized to speak on behalf of the organization. Do not imply that the employer’s attorney automatically represents every witness.
Investigative interviews may present separate personal and organizational questions. Employees should provide truthful information and preserve evidence. Managers should not threaten or coach witnesses into a preferred story or falsely tell employees they may never speak to government authorities.
Create a privilege and responsiveness review
Collect into a secured workspace, create an inventory and map each request item to records located or not located. Review potentially responsive information for attorney-client privilege, work product or other applicable protections. Privilege is specific; copying a lawyer on an ordinary operational email does not necessarily make it privileged. Coordinate any privilege claim or production limitations with counsel.
Separate what exists, what is missing, and what is outside the stated request. Negotiating reasonable scope, custodians, search terms and production format may reduce business disruption without obstructing lawful demands. Confirm any requested extension in writing. A large production may require staged batches and agreed conventions for metadata or protected health information.
What should the production record show?
Maintain a chain-of-custody and production log identifying original systems, acquisition date, custodians, processing steps, privilege exclusions, production date, transmission channel and acknowledgment. Use defensible filename or Bates labeling and preserve a copy of exactly what was produced. Verify electronic transfer completion rather than assuming that an upload screen confirms acceptance.
A claims spreadsheet should reconcile to source systems and should not be silently edited to remove discrepancies. If analysis is produced, distinguish a business record generated contemporaneously from a later attorney-directed summary. Those documents can have different evidentiary implications.
Manage operations while responding
A subpoena can arrive during a payer audit, active appeal, sale process or employee dispute. Assign separate responsibility for ongoing claim submission, patient safety, system availability and regulator communications. Avoid announcing unsupported conclusions to vendors, patients or staff. Review applicable contractual and regulatory reporting obligations with counsel; receiving a subpoena does not automatically trigger every conceivable report.
The most useful initial meeting usually identifies the specific legal process, deadline, likely record custodians, preservation steps, representation issues, privacy rules and who will coordinate responses. That is the foundation for a truthful, orderly production.
BOLO Health Law assists with government investigations and white-collar defense, healthcare payer and government audits, and investigation response planning.
Primary legal sources
Federal Rule of Criminal Procedure 17; HHS: HIPAA Law Enforcement Disclosures; HHS: Judicial and Administrative Proceeding Guidance; DOJ Justice Manual: Grand Jury.
Attorney advertising. General educational information reviewed October 18, 2026, not legal advice. Rules and deadlines depend on the specific facts and jurisdiction. Reading this article does not establish an attorney-client relationship; any engagement is subject to conflicts, attorney admission and written terms.