What should I do if I get a subpoena?

Make sure it is a valid subpoena, and be sure you document information released in your accounting of disclosures (AoD). You must attempt to ensure that the patient has been given notice of the request (and a chance to respond), or you must secure a qualified protective order, which prohibits the parties from disclosing the PHI for any other purposes than litigation, and 2) that the PHI be returned to the CE or destroyed at the end of the litigation.