October 7, 2004

Dear Colleagues:

The HIPAA Privacy Office needs your help. Last week the Office for Civil Rights of the U.S. Department of Health and Human Services (OCR) (the regulatory authority for the HIPAA Privacy Regulations), found that our process for complying with certain subpoenas violated the HIPAA Privacy Regulations. Specifically, OCR directed that Johns Hopkins must obtain a written confirmation that no objection to the subpoena has been filed before it can produce the subpoenaed information from medical and/or billing records. This step will add significant administrative responsibilities and burdens in order for us not to be in violation of the HIPAA Privacy Regulations.

Therefore, beginning immediately, it is absolutely necessary that copies of ALL subpoenas for Protected Health Information, together with copies of any accompanying items (letters, certificates of service, etc.), received by EVERY Johns Hopkins covered entity or department or center within a covered entity be forwarded IMMEDIATELY on receipt to the Johns Hopkins HIPAA Office (part of the Legal Department) at the following fax number: 410-614-3678, and that NO Action be taken on the subpoena until directed to do so by the HIPAA Office.

Thank you for your anticipated compliance.

Edward D. Miller, M.D.