Redacting Medical Records in Personal Injury Cases

You can redact a medical record into full compliance with Federal Rule of Civil Procedure 5.2 and still publish your client's psychiatric history on a public docket.

That is not a loophole. It is how the rule is written. Rule 5.2 protects five categories of identifiers. Diagnoses, treatment history, and medical conditions are not among them. An attorney who works the rule as a checklist, masks the Social Security number and the birth date, and files a 400-page exhibit has done exactly what the rule asks and still exposed the client.

Personal injury practice runs on medical records. They arrive in volume, they go out in volume, and they contain more sensitive information per page than almost anything else a firm handles. This post covers what the rules actually require, where the rules stop, and how to build a workflow that does not depend on a paralegal catching every page at 11pm.

Quick answer: What must be redacted in discovery documents? The short version, in about 400 words.

What FRCP 5.2 actually requires

Federal Rule of Civil Procedure 5.2(a) requires that five categories of identifiers appear only in redacted form in filings made with the court:

• Social Security numbers. Last four digits only.
• Taxpayer identification numbers. Last four digits only.
• Dates of birth. Year only.
• Names of individuals known to be minors. Initials only.
• Financial account numbers. Last four digits only.

Three features of the rule matter more in personal injury work than in most practice areas.

It reaches exhibits and attachments, not just the brief. The obligation applies to every document in the case file. A motion for summary judgment with 300 pages of attached records is 300 pages of redaction obligation.

The responsibility is yours, not the clerk's. The filing party carries the duty. Nobody at the courthouse reviews your exhibits for compliance before they hit the public docket.

Rule 5.2(d) gives you a sealed-plus-public mechanism. You can file a complete unredacted version under seal and a redacted version for the public record. In cases where the full identifier is genuinely material, this is the correct path rather than choosing between compliance and completeness.

We cover the federal and state rule landscape in more depth in our guide to court filing redaction rules.

The gap: the rule protects identifiers, not conditions

Read that list of five again. Every item is an identifier. None of them is a medical fact.

A records set redacted strictly to Rule 5.2 can still disclose, on a publicly accessible docket:

• Psychiatric diagnoses and therapy notes
• HIV status and other communicable disease testing
• Substance use disorder treatment
• Reproductive and sexual health care
• Prior injuries and unrelated conditions that have nothing to do with the claim
• Prescription histories

Your client sued over a herniated disc. The certified records the hospital sent cover fourteen years of treatment, because that is what the subpoena asked for and that is what the records custodian produced. Somewhere in page 212 is a two-line note about a depression screening in 2019. Rule 5.2 has no opinion about that note. The public docket will.

This is the practical difference between filing something that satisfies a rule and filing something that protects your client. The rule is a floor. In personal injury work, the floor is well below where you need to be.

The protective instinct here is not just ethical. Opposing counsel reads everything you file. A prior injury or unrelated condition that lands on the docket because nobody scoped the records becomes cross-examination material and a damages argument.

Filing and producing are different obligations

This is where personal injury attorneys most often get advice that is confidently wrong in one direction or the other.

Filing with the court triggers Rule 5.2 and the public docket problem. Redact to the rule, then go further on medical content that is not material to the claim, and use the seal mechanism when the full record has to reach the judge.

Producing to opposing counsel in discovery is a different analysis. Discovery production is generally governed by relevance and any protective order in place, not by Rule 5.2. Aggressively redacting records you produce to the other side, on privacy grounds, invites a motion to compel and can draw an adverse ruling.

The defensible position in production is usually scope rather than redaction: negotiate the time period and the treatment categories the authorization covers, rather than producing fourteen years and then blacking out eleven of them. Courts are receptive to relevance limits on medical discovery. They are much less receptive to unilateral redaction of records that were ordered produced.

If a court orders production of material you previously withheld or masked, produce it promptly and document the order in the file. Good-faith redaction followed by compliance with a court order is a defensible record. Quiet non-compliance is not.

For the pre-production review process itself, our QA checklist for reviewing redactions before court production covers the verification steps.

Three categories that carry their own rules

Some material in a personal injury medical file is governed by something other than Rule 5.2, and treating it as ordinary records is how firms get into trouble.

Substance use disorder treatment records. Records from a federally assisted substance use disorder program are protected by 42 CFR Part 2, a separate and stricter federal regime. A subpoena alone does not authorize their disclosure. Part 2 requires a specific court order entered under the regulation, and that order authorizes disclosure rather than compelling it, so a subpoena or similar mandate is still needed to compel. If your client has a treatment history, assume the standard medical authorization you sent does not reach those records.

Third-party information inside your client's file. Hospital records routinely contain other people's information: a roommate named in an incident note, an emergency contact's phone number, a family member's medical history captured during intake. Your client can waive their own privacy. They cannot waive anyone else's. Rule 5.2(h) permits a person to waive protection as to their own information, and that waiver does not extend to other individuals in the file.

Minor plaintiffs and minor family members. Rule 5.2 requires initials only for individuals known to be minors, and this applies in captions, in the body, and in every exhibit. Pediatric records are dense with the full names of minor siblings and the birth dates of minor patients, and they are among the easiest places to miss an obligation.

A workflow that does not depend on memory

The failure mode in personal injury redaction is almost never ignorance of the rule. It is volume plus deadline. Four steps make the outcome less dependent on who is doing the reviewing and how late it is.

1. Scope the records before you request them. The cheapest redaction is the record you never obtained. Narrow the authorization by date range and treatment category to what the claimed injuries actually put at issue. This reduces both the review burden and the volume of unrelated conditions in your file.
2. Separate the filing set from the production set early. They have different obligations, and conflating them produces either an under-redacted filing or an over-redacted production. Decide which pile a document is in before anyone starts marking.
3. Run identifier detection across every page, including attachments. Rule 5.2 obligations attach to page 300 of an exhibit exactly as they attach to page 1. Any process that relies on a human reading every page of a large records set at speed will miss some.
4. Verify the redactions are permanent before filing. A black box drawn in a PDF editor leaves the text in the file. Anyone can select and copy it off the docket. Test by attempting to copy from a redacted region, or run the file through the free PDF Redaction Checker, which tests for recoverable text and lingering metadata in seconds. Our guide on how to redact documents safely covers the full verification set.

RedactifyAI handles step three. It detects and permanently removes more than 40 entity types across PDF, Word, and scanned image files, including the Social Security numbers, birth dates, account numbers, and names the rule enumerates, and it applies partial-redaction formats rather than removing identifiers wholesale where the rule asks for last-four or year-only. Scanned records go through OCR first, which matters because certified records from a hospital arrive as images more often than as text. Every processed document is logged with a timestamp and user reference, which is the record you want if a filing is ever challenged.

What it does not do is decide which unrelated conditions should come out of a filing. That is a judgment call about materiality, and it belongs to the attorney on the matter.

Frequently asked questions

What has to be redacted from medical records filed in a personal injury case?

Federal Rule of Civil Procedure 5.2 requires redacting Social Security numbers and taxpayer IDs to the last four digits, dates of birth to the year, names of minors to initials, and financial account numbers to the last four digits. The rule does not require redacting diagnoses or treatment history, so attorneys typically also remove medical content not material to the claimed injuries before filing publicly.

Do I have to redact medical records I produce to opposing counsel?

Usually not in the same way. Discovery production is governed by relevance and any protective order, not by Rule 5.2, which applies to filings made with the court. Unilaterally redacting produced records on privacy grounds can draw a motion to compel. The stronger approach is negotiating the scope of the authorization up front rather than producing broadly and redacting afterward.

Does HIPAA apply to a personal injury firm handling medical records?

A plaintiff's firm receiving records under a signed patient authorization is generally not a HIPAA covered entity or business associate, so HIPAA's covered-entity obligations typically do not attach to the firm directly. State medical privacy statutes, professional responsibility rules, and protective orders still govern how the firm handles those records, and defense-side arrangements with insurers can create different relationships.

What about substance use disorder treatment records?

Those records carry a separate federal regime under 42 CFR Part 2, which is stricter than HIPAA. A subpoena alone does not authorize disclosure. Part 2 requires a specific court order entered under the regulation, and that order authorizes rather than compels disclosure. If your client has a treatment history, do not assume a standard medical authorization reaches those records.

Can I file unredacted medical records under seal instead?

Yes. Rule 5.2(d) allows filing a complete unredacted version under seal alongside a redacted version for the public record. This is the correct mechanism when the full identifier or the full record is material and the court needs it, and it avoids choosing between compliance and completeness. Local rules govern the sealing procedure, so check the specific court's requirements.

Whose job is it to catch redaction errors before filing?

The filing party's. The clerk does not review exhibits for compliance before they appear on the public docket, and the rule places the obligation on counsel and the party making the filing. Once an unredacted record is filed, it is publicly accessible, and remediation means a motion, a refiling, and a record of the error.

If you want to see what comes out of a certified records set before it reaches a filing, upload a PDF to our free redaction tool and look at what gets flagged. No account required.