Getting medical records in a Texas case is not always as simple as sending a form. The right request depends on who has the records and whether the patient will cooperate. In many cases, a HIPAA authorization to release medical records works well. In others, the legal team may need to subpoena medical records from a nonparty provider.
These procedures are not the same. Permission is granted by an authorization. According to Texas R. Civ. P. 176.8, a subpoena is a form of formal discovery that can compel a third party to produce records. If the custodian disobeys the subpoena, contempt is the backup plan.
Because the two routes operate on different clocks and rule sets, the distinction is important. An authorization proceeds at the custodian’s speed and is primarily regulated by HIPAA and the Texas records statutes. A subpoena operates at the speed of the calendar, is subject to the Texas Rules of Civil Procedure, and must also pass HIPAA.
The choice can also affect how long the request takes. Some records are easy to obtain. Others involve notice rules, privacy limits, or added protections for certain types of treatment.
A HIPAA authorization is written permission from the patient. It allows a provider to send protected health information to another person or organization.
It is voluntary by design: a provider generally cannot condition treatment, payment, enrollment, or eligibility for benefits on whether the patient signs it.
The U.S. Department of Health and Human Services requires certain details on the form, including:
The form also needs required wording about revocation, redisclosure, and limits tied to signing. In plain terms: the patient’s right to revoke in writing and how to do it, the fact that information may lose HIPAA protection once the recipient has it, and whether signing is a condition of anything. The whole form has to be written in plain language (§ 164.508(c)(3)).
According to 45 C.F.R. § 164.508(b)(2), a HIPAA authorization may be invalid for the following common reasons: the expiration date has passed or the expiration event is known to have occurred, a required element is missing, the provider knows it has been revoked, or it contains material information the provider knows is false. When a custodian bounces a form on one of those grounds, they are adhering to the rule rather than being difficult.
It is worth checking the form before it goes out. A missing signature, wrong date range, or incorrect provider name can stop the request.
A team may need to subpoena medical records when a nonparty provider has records that must be produced through discovery.
Texas Rule of Civil Procedure 176 allows an attorney authorized to practice in Texas to issue a subpoena, as an officer of the court. A court clerk and an officer authorized to take depositions in Texas may also issue one (Rule 176.4).
Rule 205 governs discovery from nonparties, including hospitals, doctors, clinics, and other custodians.
If you are looking at how to subpoena medical records, timing is one of the main issues. For document production under Rule 205.3, notice generally must be served at least 10 days before the subpoena is served. That notice goes to the nonparty and to every other party in the case, not just to the custodian.
The subpoena must also be used within the discovery period. Rule 205.3(a) is more precise than that: the notice and subpoena must be served a reasonable time before the response is due, and no later than 30 days before the end of the applicable discovery period.
One point is easy to miss. A valid subpoena does not remove HIPAA requirements or other privacy protections. It also does not remove the physician-patient privilege.
Texas Rule of Evidence 509 makes those communications and records privileged in civil cases. What usually opens them is the patient-litigant exception: the privilege does not apply when a party relies on the patient’s physical, mental, or emotional condition as part of that party’s claim or defense and the record is relevant to that condition.
A subpoena issued by an attorney is not treated the same as a court order. The signature on it belongs to a lawyer, not a judge, and HIPAA draws its line exactly there.
The U.S. Department of Health and Human Services allows a provider to release protected health information in response to a court order. The provider should only release the information covered by that order.
A subpoena without a court order has added requirements.
| Request | HIPAA consideration |
| Court order | Provider may release PHI covered by the order and only what the order expressly authorizes. No further assurance is required. |
| Subpoena without court order | Extra HIPAA conditions usually apply: the provider needs satisfactory assurance of patient notice, or of a qualified protective order. |
| Patient authorization | Records may be released within the form’s scope, provided the form is valid, complete, and unexpired. |
For a subpoena without a court order, HIPAA generally requires proof that reasonable steps were taken to notify the patient or obtain a qualified protective order.
That is why a subpoena does not always result in immediate production.
How long does it take to get medical records? It depends on the request.
Texas law and HIPAA use different deadlines.
The HIPAA 30-day rule applies to a patient asking for access to their own records. It is not the standard deadline for every subpoena or litigation request.
A subpoena may take longer because notice has to come first. Under Rule 205, there must generally be at least 10 days between the production notice and service of a Rule 205.3 subpoena.
Some substance use disorder records fall under 42 CFR Part 2, which adds another layer of protection.
Updated Part 2 rules became mandatory on February 16, 2026. HHS says covered substance use treatment records generally cannot be used against a patient in a legal proceeding without the required consent or a court order that meets Part 2 rules.
That restriction follows the records downstream: a party who lawfully receives Part 2 information still cannot turn around and use it against the patient in a civil, criminal, or administrative proceeding without the required consent or order.
This matters when a request is broad. If substance use treatment may be included, that issue should be identified before the request is sent.
Psychotherapy notes also have added protection under HIPAA. They generally need separate authorization unless an exception applies.
Most record delays come from fairly basic problems. A request may go to the wrong custodian. A form may be incomplete. A notice deadline may be missed.
A few simple checks help:
When a case involves several providers, a medical records retrieval service can help keep requests and follow-ups in one place. Central Texas Litigation Support Services can also assist with tracking, document imaging, Bates stamping, certification support, and secure delivery.
A medical records subpoena is a legal demand for records held by a custodian. Texas Rules 176 and 205 apply to many nonparty subpoenas in civil cases. Privacy and privilege rules may still limit what can be produced.
Yes. Can a lawyer subpoena medical records without having a judge sign each subpoena? Texas Rule 176 allows an attorney authorized to practice in Texas to issue one. The subpoena still has to follow discovery and privacy rules, and because it is not a court order, HIPAA still requires satisfactory assurance of notice or a qualified protective order before the provider releases anything.
Knowing how to subpoena medical records starts with identifying the right custodian. The legal team must then follow the correct discovery process and give any required notice. For Rule 205.3 production, notice comes before service of the subpoena.
Not always. HHS treats an attorney-issued subpoena differently from a court order. Without a court order, extra HIPAA steps may be required before the provider can release protected health information.
A single timeline does not exist. While hospitals follow a different 15-day rule that begins only after both the authorization and the payment are received, Texas physicians may have a 15-business-day deadline. Because notice and service must come first, subpoenas may take longer to process.
Use an authorization when the patient can give valid permission for the release. A subpoena may be needed when a nonparty has to be compelled to produce records. Sensitive records may require additional steps.
The best way to avoid delays is to use the right request from the start. Check who holds the records, what privacy rules apply, and what deadlines are involved. Need help with records from several providers? Contact Central Texas Litigation Support Services today to get a quote for medical records retrieval.
