The health information management department of an acute care hospital

You supervise the release of information (ROI) section in the health information management department of an acute care hospital, which is also a Level II regional trauma center. Today the hospital received a subpoena duces tecum from an attorney, demanding either the originals or copies of all health records on Paul Johnson, who was allegedly a patient of the hospital. The ROI clerk came to you, unsure what to do. The subpoena lacks sufficient information for you to determine whether Mr. Johnson is (or was) a patient in the facility. Also, the subpoena was not accompanied by a valid authorization to release information for Mr. Johnson, as required in your state.

3. What regulations apply to this request (be specific)