Administrative subpoenas have long been a powerful tool in the federal government’s investigative arsenal. Issued without prior judicial approval and requiring only minimal procedural safeguards, these demands for documents and testimony are typically enforced with little resistance from the courts. Yet in late 2025, three federal judges independently took the extraordinary step of quashing or significantly limiting Department of Justice (DOJ) administrative subpoenas issued under 18 U.S.C. § 3486, a statute that authorizes broad investigative powers in healthcare fraud investigations.
While these cases arose from DOJ investigations into gender-affirming care providers, the legal principles established by the courts have far-reaching implications for any entity—hospitals, pharmaceutical companies, medical device manufacturers, telemedicine platforms, or healthcare billing operations—facing similar federal scrutiny. These decisions illuminate a critical but often overlooked reality: administrative subpoena power, while expansive, is not unlimited, and recipients have viable grounds to challenge overreach.
Understanding Section 3486: The “HIPAA Subpoena”
Section 3486, enacted in 1996, grants the DOJ authority to issue administrative subpoenas in investigations of “federal health care offenses.” These subpoenas, commonly referred to as “HIPAA subpoenas,” enable investigators to compel production of documents and testimony without obtaining judicial authorization beforehand. Unlike grand jury subpoenas, which require convening a grand jury, or search warrants, which demand probable cause and a judicial finding, administrative subpoenas can be issued unilaterally by agency attorneys.
The statute’s breadth has made it a preferred investigative tool. Some U.S. Attorney’s Offices have increasingly favored Section 3486 subpoenas over traditional grand jury process in healthcare investigations due to their efficiency and flexibility. Recipients typically receive sweeping demands for billing records, patient files, communications with pharmaceutical representatives, and internal compliance documents—often with return dates measured in weeks rather than months.
The Three Cases: Different Providers, Unified Concerns
In summer 2025, the DOJ launched a coordinated subpoena campaign, serving more than 20 healthcare providers with substantially identical demands. Three recipients challenged their subpoenas in federal court: Boston Children’s Hospital (BCH) in Massachusetts, The Children’s Hospital of Philadelphia (CHOP) in Pennsylvania, and QueerDoc, a telehealth provider in Washington. Each received requests spanning 13 to 15 categories of materials, including:
- Complete billing and insurance records for specific medical services
- Personnel files for thousands of employees
- Communications with pharmaceutical manufacturers and sales representatives
- Patient-identifying information, including names, Social Security numbers, addresses, and parents’ information
- Complete medical charts, diagnostic assessments, and informed consent documents
The hospitals and telehealth provider argued that these demands exceeded statutory authority, violated privacy rights, and were issued for an improper purpose.
The Powell Standard: A Framework for Challenge
All three courts applied the framework established by the Supreme Court in United States v. Powell (1964), which requires the government to demonstrate that:
- The subpoena is issued for a congressionally authorized purpose
- The information sought is relevant to that purpose
- The information is not already in the government’s possession
- Required administrative procedures have been followed
This standard, while generally deferential to government investigations, contains an important exception: courts may refuse enforcement if the subpoena is issued in bad faith or for an improper purpose.
Improper Purpose: When Policy Displaces Investigation
The Massachusetts and Washington courts (BCH and QueerDoc cases) went furthest, quashing the subpoenas entirely. Both judges found that the DOJ failed to demonstrate a proper investigative purpose, instead identifying a pattern suggesting the subpoenas were tools of policy enforcement rather than legitimate investigations.
Judge Myong Joun in Massachusetts found it “abundantly clear that the true purpose of issuing the subpoena is to interfere with the Commonwealth of Massachusetts’ right to protect [gender affirming care] within its borders, to harass and intimidate BCH to stop providing such care, and to dissuade patients from seeking such care.” Judge Jamal Whitehead in Washington emphasized a critical “mismatch” between the stated investigation and the recipient’s operations: QueerDoc neither manufactures drugs nor bills federal insurance programs—meaning it could not, by definition, commit the violations the DOJ claimed to be investigating.
Both courts rejected the government’s argument that merely citing statutory authority and general investigative goals satisfied the Powell standard. Such logic, the courts reasoned, “would preclude any form of judicial review as the Government’s self-proclaimed say-so would always be sufficient to defeat a motion to quash.”
Statutory Authority: Defining the Limits
In the CHOP case, Judge Mark Kearney struck a middle ground, enforcing most of the subpoena but quashing three requests seeking patient identities and clinical treatment records. The court held that these demands exceeded the DOJ’s statutory authority under Section 3486 because they bore no meaningful relevance to violations of the Food, Drug, and Cosmetic Act (FDCA) or False Claims Act (FCA).
The FDCA regulates drug manufacturers’ labeling and distribution practices, not physicians’ clinical decisions. Judge Kearney emphasized that healthcare providers are not part of the pharmaceutical “chain of distribution” in a way that makes their treatment decisions subject to federal drug labeling laws. “Accepting this interpretation would transform every act of treatment into a potential federal offense,” the court warned, noting that expanding Section 3486 authority so broadly “would subvert Congress’s design, erase the long-recognized boundary between drug regulation and the practice of medicine, and intrude upon [state] sovereign authority to oversee the medical profession.”
This reasoning has significant implications for any healthcare investigation. It establishes that the government cannot use Section 3486 to conduct exploratory investigations into state-regulated medical practice merely by invoking concerns about drug labeling or billing fraud.
Privacy Rights: The Westinghouse Balancing Test
Even where statutory authority exists, courts retain the power to limit subpoenas that infringe on constitutional privacy rights. Judge Kearney applied the Third Circuit’s seven-factor balancing test from United States v. Westinghouse Electric Corp. (1980), weighing:
- The type of record requested
- The information it contains
- The potential for harm from nonconsensual disclosure
- The injury to the relationship (physician-patient)
- The adequacy of safeguards
- The degree of need for access
- Express statutory mandates or public policy
The court found that medical records of minors “fall at the highest end of intimate and personal spectrum.” The risk of stigma, harassment, and social injury to patients and families, coupled with the government’s failure to demonstrate why such sensitive information was necessary to investigate billing codes or manufacturer labeling, tipped the scale decisively in favor of privacy.
Critically, the court noted that patients had received no notice of the government’s demands and had no opportunity to assert their own privacy interests. The hospital’s standing to challenge the subpoena on behalf of its patients reflected the “concrete adverseness” necessary to protect rights that could not be asserted directly by those most affected.
Practical Implications Beyond Gender-Affirming Care
While the context of these cases involved politically charged issues, the legal principles transcend their specific factual settings. Healthcare entities facing Section 3486 subpoenas in other contexts—pharmaceutical fraud investigations, medical device safety inquiries, telemedicine compliance reviews, or billing audits—can draw important lessons:
- Purpose Matters More Than Authority. The government’s statutory power to issue subpoenas does not immunize demands from scrutiny. When external evidence suggests an investigation is pretextual—serving policy goals, harassing disfavored actors, or pressuring settlement of unrelated disputes—courts may intervene even at the investigative stage. Entities should document and preserve evidence suggesting improper motives, including public statements by government officials, timing coinciding with policy announcements, or demands untethered to the recipient’s actual business operations.
- Relevance Is Not Self-Proving. The government cannot satisfy Powell merely by asserting that records “might” be relevant to a potential violation. Courts will examine whether the stated investigative theory fits the recipient’s role in the healthcare system. A telemedicine platform that provides consultations but does not bill insurance may not meaningfully be investigated for False Claims Act violations. A hospital that prescribes drugs but does not manufacture them is not part of the FDCA’s regulatory target. Recipients should carefully analyze whether their operations could plausibly involve the alleged offense and press the government to articulate a specific theory of violation.
- Scope Can Be Independently Challenged. Even where the government has legitimate investigative authority, overbroad demands can be struck down. Requests for “all communications” regarding a subject, personnel files unconnected to alleged wrongdoing, or patient records unnecessary to investigate billing or labeling issues may exceed statutory authority or violate privacy rights. Recipients should evaluate each category of requested documents against the articulated investigative purpose and object to fishing expeditions.
- Privacy Rights Provide an Additional Shield. Where subpoenas demand sensitive personal information—patient medical records, mental health treatment history, genetic information, or data about vulnerable populations—constitutional privacy concerns come into play. The Westinghouse balancing test provides a framework for challenging such requests, particularly where the government cannot demonstrate a compelling need for the most intimate details and where patients lack notice or an opportunity to object.
- State Sovereignty Considerations Can Limit Federal Reach. Federal investigative powers do not override state authority to regulate medical practice and public health. Courts will resist interpretations of federal statutes that would federalize healthcare delivery or convert routine medical decisions into potential federal offenses. Where state law explicitly protects or regulates a medical practice, and federal investigators seek to second-guess clinical decisions rather than investigate commercial misconduct, Tenth Amendment concerns may support limiting the subpoena.
Procedural Considerations for Recipients
Healthcare providers facing Section 3486 subpoenas should act promptly. The statute requires that motions to quash be filed “before the return date specified in the summons,” meaning recipients typically have only weeks to assess compliance obligations and potential defenses.
Critical steps include:
- Assemble a cross-functional team involving legal counsel, compliance officers, privacy officers, and clinical leadership to assess the scope and implications of demands
- Document the operational mismatch if the government’s investigative theory does not align with the entity’s role in the healthcare system
- Preserve evidence of improper purpose, including public statements, policy announcements, or other context suggesting the investigation serves non-investigative goals
- Conduct detailed relevance analysis for each category of requested documents, identifying demands that exceed the scope of permissible inquiry
- Assess privacy implications, particularly where patient-identifying information or clinical records are demanded, and consider whether the Westinghouse factors weigh against disclosure
- Consider negotiation before litigation, but preserve all objections in writing and file a motion to quash if negotiations fail to narrow unreasonable demands
Looking Ahead: Appeals and Continued Uncertainty
The DOJ has appealed the BCH and QueerDoc decisions and continues to defend its subpoena authority vigorously in public statements and court filings. Appellate courts will likely weigh in on key questions: How much deference is owed to government assertions of proper purpose? What quantum of evidence is sufficient to demonstrate bad faith or improper motive? Can Section 3486 authority extend to clinical treatment decisions, or is it limited to commercial aspects of drug distribution and billing?
Until these questions are definitively resolved, the district court decisions provide both a roadmap and a cautionary tale. They demonstrate that administrative subpoena power, while substantial, is subject to meaningful judicial review when the government overreaches. For healthcare entities facing similar demands, these cases offer both legal grounds for challenge and practical strategies for resistance.
Key Takeaways
- Administrative subpoenas are not self-executing. Despite their broad statutory authority, Section 3486 subpoenas remain subject to judicial review under the Powell framework. Recipients can successfully challenge subpoenas issued for improper purposes, lacking genuine relevance, or exceeding statutory authority. The threshold for judicial intervention is higher than for ordinary civil discovery, but these cases demonstrate that it is not insurmountable when the record supports findings of bad faith, pretextual investigation, or demands untethered to legitimate federal healthcare offenses.
- Overbreadth and privacy concerns provide independent grounds for limitation. Even where the government establishes general investigative authority, courts will strike down or narrow requests that sweep too broadly or invade constitutional privacy rights without sufficient justification. Healthcare entities should carefully scrutinize each category of demanded documents, object to fishing expeditions, and invoke privacy protections—particularly the Westinghouse balancing test—where sensitive patient information is at stake. The mere availability of protective orders or confidentiality agreements does not cure fundamental overreach.
- Document the record and preserve objections. Success in challenging administrative subpoenas often depends on evidence extrinsic to the subpoena itself—public statements by government officials, timing coinciding with policy shifts, mismatches between investigative theories and operational realities, or patterns suggesting harassment rather than investigation. Recipients should systematically document such evidence, preserve all objections in writing, and act swiftly within statutory deadlines. The window for challenge is narrow, but these cases demonstrate that well-supported motions to quash can prevail even in the face of government assertions of broad investigative discretion.