New case from Court of Appeals applies privacy law to criminal subpoenas

By L. Steven Emmert, The Journal – Vol. 19 • No. 2 • 2007

If you handle civil litigation, you’ve probably seen the short provision in Rule 4:9(c-2), dealing with subpoenas duces tecum, that provides: “Patient health records protected by the privacy provisions of Code §32.1-127.1:03 shall be disclosed only in accordance with the provisions and procedures prescribed in that statute.” Upon reading this, you’ve no doubt hustled up your volume 5A of the Code, to see what those provisions and procedures are. (If you’ve been living dangerously and haven’t look it up, now would be a good time. It’s the state law equivalent of the privacy safeguards in the federal HIPAA statute.)

That statute creates a protocol of procedures that must be followed whenever a litigant wants to subpoena another person’s health records. As you’d expect, when you’re subpoenaing your opposing party’s records, you have to send a copy of the subpoena to your opposing counsel, just as Rule 4:9(c) says. The statute also provides, however, that when you subpoena health records pertaining to a nonparty, you have to send a copy to that person, and give him a formal written notice of his right to file a motion to quash. In either case, you also have to instruct the health care provider not to respond to the subpoena until it receives word that any motions to quash have been resolved. You have to allow at least 15 days between the date of the subpoena and the return date.

Meticulous civil practitioners have been following this procedure ever since its first appearance in the Code several years ago, as they’re specifically pointed to the statute by the quoted language from Rule 4:9. But what about criminal practitioners? Subpoenas duces tecum in criminal cases are provided for in Rule 3A:12(b), which mentions nothing at all about the privacy statute. It does require something not required in civil cases – an affidavit of materiality – but are criminal subpoenas subject to all that statutory bureaucracy, too?

Yes, they are, the Court of Appeals ruled in its recent decision in Hairston v. Commonwealth, 50 Va. App. 64, 646 SE2d 32 (2007). In an indecent liberties prosecution, Hairston’s lawyer had subpoenaed the victim’s counseling records. The subpoena fully complied with Rule 3A:12(b), right down to the affidavit of materiality. He even used the form that appears in the Rules for SDT’s (Part 3A, Form 9). But there was no notice to the victim that the records were being subpoenaed; nor was there any instruction to the counselor about waiting for the resolution of motions to quash. The trail court sustained the prosecution’s motion, on the basis that Hairston didn’t follow the statute in addition to the rule and the form. The Court of Appeals affirmed.

Now, where did that come from? Isn’t a criminal defense lawyer perfectly safe in meticulously following the relevant rule of court, which says nothing about complying with an otherwise obscure statute? Isn’t it safe to use the forms the Supreme Court has provided as part of those rules? Unfortunately, there’s nothing safe about it. The trouble is, the statute itself specifically provides that it applies to any “civil, criminal, or administrative action or proceeding.” And we have long ago learned that while the Supreme Court can promulgate rules, those rules can’t conflict with or supersede statutes enacted by the General Assembly. Code § 8.01-3(D). The Court of Appeals followed this line of reasoning to reach the (to me inescapable) conclusion that the failure to follow the notice provisions of the privacy statute renders a criminal subpoena vulnerable to even the simplest motion to quash.

If you’re a civil practitioner, you probably already follow this two-step process. But now criminal and administrative law advocates are on notice that they can’t merely follow Rule 3A:12(b) (for criminal cases) or Code §2.2-4022 (in administrative cases) without also meeting the requirements of the health privacy statue, too. (One could make a plausible argument that the admin law folks are not similarly constrained, since the authority for SDT’s comes from a statute, not a rule of court. But given the Court of Appeal’s analysis of the issue, I am convinced that the court would apply the same requirements to those subpoenas as well.) As a practical matter, lawyers in these contexts need to allow extra time before trial in issuing their subpoenas, to allow for the 15-day motion period, and for any additional time necessary to resolve a motion to quash.