Government Requests for Records: What Small Businesses Should Do First

The Most Common Types of Requests for Information (and Why they Matter) 

• Informal calls, emails, or knocks at the door: These can feel urgent, but they may not be legally binding. They still deserve attention, but you usually have time to verify details first. 

• Subpoenas: A subpoena for business records is more serious and usually comes with deadlines. You may be required to produce certain documents, but that doesn't mean you should send everything - only produce what the scope of the subpoena requires. 

• Warrants: A warrant generally allows officials to obtain specific information or property under legal authority. This is not something you should try to "handle casually" at the front desk. 

How to Respond Correctly to a Request for Records 

1. Verifying the request in writing 

2. Confirming the scope 

3. Taking time to consult an attorney immediately 

4. Providing only the records specially covered 

Sharing more than necessary - or responding without verification and legal review - can create problems, including: 

• Disclosure of private or confidential customer data that exceeds what the law requires. 

• Violation of contractual obligations you have with customers or vendors. 

• Breach of your own privacy policy or terms of service. 

• Damage to customer trust and brand reputation. 

• In certain industries, regulatory exposure. 

In healthcare settings, for example, HIPAA protects patient health information. Releasing protected health data without clear legal authorization can lead to additional legal risks and licensing penalties beyond the original request. 

What Not to do With your Customer or Employee Records in a Rush 

• Don't hand over records immediately 

• Don't send all files 

• Don't edit or delete records 

• Don't guess about whether the request is valid - verification matters 

• Don't assume you know what the requests cover 

An important best practice: Consult an attorney immediately when a serious request arrives. 

Training your Employees for When a Government Request for Information Comes in 

Employees who respond without training can accidentally create risk by: 

• Giving out passwords or access 

• Trying to interpret agency names and authority 

• Agreeing to send files without verification 

• Deleting files that "look questionable" 

Training helps employees know to never share information or agree to a request on the spot and refer all requests to a designated compliance lead. It might be a good idea to create a simple internal policy that says: all legal or government requests must be forwarded to management and reviewed with counsel before any response. 

Questions SMBs Should Ask Before Handing Out Customer Information 

Where is my business most exposed today? Which parts of my operations rely heavily on contracts, workers, or regulated practices? 

Are my current agreements still enforceable under today's rule? When were my employee, contractor, or vendor contracts last reviewed? 

If a dispute started tomorrow, would I be prepared? Do I have documentation that reflects how the business actually operates? 

Have I done a recent legal checkup? Have policies, contracts, and practices been reviewed since recent law changes took effect? 

Before you make any decisions, ask yourself a few key questions to reduce risk and stay in control: 

• Is this request legally valid and who is it from? 

• What exactly are they asking for and what's the deadline? 

• What are we required to share, and what should we avoid sharing? 

• Do we need to notify the customer or preserve records immediately?

What to Do Next to Prepare for When the Government Demands Information 

To respond responsibly and protect your business, take these practical steps: 

1. Arrange for legal representation before you need it. 

2. Understand the types of records and information and your legal obligations to protect each. 

3. Train your staff and update your policies. 

---

This document is designed for general information only. The information presented in this document should not be construed to be formal legal or tax advice nor the formation of a lawyer/client.

For further information please contact me at www.kmckernanlaw.com kevin@kmckernan.com or 718-317-5007.