Standing At The Crossroads: Fourth Circuit To Decide Who Can Challenge HIPAA Administrative Subpoenas

With Congress actively considering proposed federal privacy legislation¹ that could establish a national standard and federal agencies simultaneously pursuing broader access to sensitive health records, the stakes for healthcare institutions, providers, patients, and their families have never been higher.

These parallel federal actions carry significant implications for the privacy landscape, underscoring the urgency of closely monitoring how courts address government access to protected health information. For example, the U.S. Court of Appeals for the Fourth Circuit is currently considering a dispute over a government-issued subpoena seeking access to patient records that could have far-reaching implications on the ability of patients and their families to challenge government access to sensitive healthcare information.²

The appeal follows in the wake of a surge by the U.S. Department of Justice (the “DOJ”) in issuing administrative subpoenas to numerous healthcare providers targeting information related to transgender care. This surge follows the White House’s Executive Order 14187 (which directed the DOJ to conduct investigations related to transgender healthcare) and enforcement guidance related to gender-affirming care for minors.³

Here, the U.S. District Court for the District of Maryland (the “District Court”) quashed a subpoena served on a Maryland hospital seeking records related to transgender minor patients, which the DOJ contended were relevant to investigations concerning alleged federal healthcare offenses. In doing so, the District Court held that the families of the transgender minor patients had standing to challenge the subpoena, and ultimately, quashed the subpoena after concluding it lacked a proper investigative purpose and was not reasonably tethered to the stated basis for the inquiry.

The DOJ promptly filed an appeal to the Fourth Circuit, citing procedural grounds as justification for reversal of the District Court’s ruling, including arguments that: (1) the families who sued to block the subpoena lacked standing because the administrative subpoena statute, 18 U.S.C. § 3486(a)(5), provides that only “the person or entity summoned” may petition to modify or set aside the subpoena; (2) Congress did not authorize non-recipients to challenge such subpoenas; and (3) the challenge was untimely because 18 U.S.C. § 3486(a)(5) requires that petitions be filed before the return date specified in the subpoena, which the DOJ asserts is inconsistent with challenges by non-recipients who may not learn of a subpoena before the compliance date, among others.

Ultimately, the Fourth Circuit’s resolution of the appeal could have far-reaching implications as to who has the ability to challenge government-issued subpoenas implicating healthcare or other sensitive information. If the DOJ is successful in its challenges, patients and their families may lack standing to challenge government-initiated efforts to access patient information and would be compelled to rely on the providers themselves to challenge such demands.

Beyond the procedural standing issues, the outcome of this case could carry broader implications for the privacy of sensitive health information, particularly for vulnerable populations whose medical records may be subject to government inquiry. The DOJ’s recent litigation strategy in other jurisdictions has also prompted concerns that it may attempt to sidestep unfavorable rulings by shifting subpoena-enforcement efforts to other potentially more favorable jurisdictions, raising concerns about forum shopping in disputes over access to patient-identifying information.

These concerns were further highlighted earlier this month when the First Circuit denied a motion for an injunction pending appeal seeking to block a Texas federal court’s order directing a Rhode Island hospital to turn over anonymized records related to gender-affirming care for minors to the court for in camera safekeeping—notwithstanding that a Rhode Island federal court had separately quashed the same DOJ subpoena.⁴ In declining to issue the injunction, the First Circuit held that the petitioner, the Child Advocate for the State of Rhode Island, failed to demonstrate irreparable harm, reasoning that because the records were anonymized and the Texas court assured the parties that they would be held in camera and not provided to the DOJ unless the appeals were resolved in its favor, there was sufficient interim protection against dissemination. Notably, however, anonymized data is increasingly susceptible to reidentification through the use of large public datasets and AI.

The First Circuit’s order and the Fourth Circuit’s appeal underscore the increasingly complex, multi-jurisdictional nature of the ongoing disputes over government access to sensitive patient records and the procedural challenges facing parties seeking to protect such information.

Footnotes

1 Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (SECURE Data Act), H.R. 8413, 119th Cong. (2026).

2 In re: 2025 Subpoena to Children’s National Hospital, No. 26-1104 (4th Cir. filed Feb. 2, 2026) (reviewing D. Md. No. 1:25-cv-03780).

3 U.S. Off. Of The Att’y Gen., Memorandum for Select Component Heads: Preventing the Mutilation of American Children (Apr. 22, 2025).

4 In re: Motion to Quash Administrative Subpoena to Rhode Island Hospital, No. 26-1568 (1st Cir. May 19, 2026) (denying motion for injunction pending appeal).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.