An affidavit of custodian of records is a sworn written statement in which the person who keeps an organization’s files certifies that the attached documents were created and stored in the ordinary course of business. That certification satisfies the business-records hearsay exception under Federal Rule of Evidence 803(6) and lets the records come into evidence without the custodian appearing in court to testify.1Legal Information Institute. Federal Rules of Evidence Rule 803 Get it wrong and a judge can exclude the records as unreliable hearsay. Get it right the first time and no one has to visit the witness stand.
Who Can Sign as the Custodian
The signer needs direct, working knowledge of how the organization creates, maintains, and stores the records at issue. In practice that is usually a records manager, office administrator, compliance officer, or department head who works with the filing systems regularly. Somebody who merely has access to the server room does not qualify. The custodian has to be able to explain how the records were generated, when entries were normally made, and what safeguards keep the files accurate.
If the most knowledgeable person is unavailable, the organization can designate another employee to certify records for the specific matter. Document that designation internally with a short memo or resolution authorizing the individual to act as custodian. Courts have thrown records out when the signer lacked actual authority or could not answer basic questions about the recordkeeping process.
What the Affidavit Must Include
The heart of the affidavit is a certification that the attached records meet the foundation for self-authentication under Federal Rule of Evidence 902(11).2Legal Information Institute. Federal Rules of Evidence Rule 902 – Evidence That Is Self-Authenticating To satisfy that rule, the certification must confirm three things drawn from Rule 803(6):
- The records were made at or near the time of the events they describe.
- They were kept in the course of a regularly conducted business activity.
- Making those records was a regular practice of that business.
Beyond that foundational language, the affidavit should identify the custodian by full legal name, job title, and organization, and state that the signer is authorized to certify the records. It should name the case, the court, and the parties, and reference the subpoena or court order by number. It should describe the records specifically — patient charts, billing invoices, employment files, email logs, whatever was requested. Vague descriptions invite challenges.
Include the exact date range the records cover, matching the scope of the subpoena, and the total page count so the court and opposing counsel can confirm they received the complete set. Finally, add a completeness statement declaring that the produced records are all responsive documents in your possession, or explaining any gaps (records destroyed under a retention policy, for example).
Many courts and agencies publish model forms. Check the issuing court’s website or clerk’s office for a template tailored to that jurisdiction. A court-approved form reduces the chance of a technical objection.
One boundary worth knowing: records that originated outside the United States follow a parallel path under Rule 902(12), which requires the maker to sign in a manner that would expose them to criminal penalties in the country where the certification is executed.2Legal Information Institute. Federal Rules of Evidence Rule 902 – Evidence That Is Self-Authenticating If foreign records are in play, ask counsel which certification applies.
Redact Sensitive Information Before You Attach the Records
Before the records go anywhere, review them for personal identifiers. Federal Rule of Civil Procedure 5.2 requires anyone filing with a federal court to redact sensitive data down to partial identifiers:3Legal Information Institute. Rule 5.2 – Privacy Protection For Filings Made with the Court
- Social Security and taxpayer ID numbers: last four digits only.
- Birth dates: year only.
- Minors’ names: initials only.
- Financial account numbers: last four digits only.
The person filing does the redaction; the clerk does not.3Legal Information Institute. Rule 5.2 – Privacy Protection For Filings Made with the Court A Social Security number buried on page 47 of a medical chart is the kind of oversight that exposes real people. If unredacted originals need to reach the court, file them under seal and submit a separate reference list linking redacted identifiers to originals.
Medical Records and HIPAA
Medical records carry an extra layer. Under 45 CFR 164.512(e), a healthcare provider may disclose protected health information in response to a subpoena without the patient’s written authorization only if the requesting party gives satisfactory assurance that either the patient was notified and given time to object, or a qualified protective order has been sought to limit further disclosure.4eCFR. 45 CFR 164.512 Without one of those, do not release the records.
The HIPAA minimum-necessary standard also applies: produce only the specific records the subpoena identifies, not the patient’s whole file. Psychotherapy notes and substance use disorder treatment records under 42 CFR Part 2 have stricter rules and generally require a court order rather than a subpoena. When in doubt, loop in the organization’s privacy officer or counsel before producing.
Signing: Notarized Jurat or Unsworn Declaration
Most affidavit forms require the custodian to sign in front of a commissioned notary public. The notary checks a government-issued photo ID, confirms identity, and applies an official seal or stamp. Which notarial act the form calls for matters.
A jurat requires the custodian to take an oath or affirmation out loud — not a silent nod — swearing that the contents of the affidavit are true, and to sign in the notary’s presence.5National Notary Association. Notary Essentials – The Difference Between Acknowledgments and Jurats An acknowledgment only confirms that the signer executed the document voluntarily; no oath is administered, and the signer may have signed beforehand. Because affidavits are sworn statements by definition, a jurat is the usual requirement. Check the notarial block on the form — the wrong notarial act can invalidate the document.
The Unsworn Declaration Option
In many federal proceedings you can skip the notary entirely. Under 28 U.S.C. § 1746, an unsworn written declaration made under penalty of perjury carries the same legal weight as a sworn affidavit, provided it includes the required language: “I declare under penalty of perjury that the foregoing is true and correct. Executed on [date].” followed by your signature.6Office of the Law Revision Counsel. 28 USC 1746 – Unsworn Declarations Under Penalty of Perjury This is useful when reaching a notary quickly is not practical, but confirm with the requesting attorney or the court’s local rules that an unsworn declaration will be accepted. Some state courts and certain proceedings still insist on a notarized original.
Remote Online Notarization
If an in-person visit is inconvenient, most states now offer remote online notarization (RON), which handles the session over a live audio-video call. As of early 2026, more than 44 states and the District of Columbia have permanent RON laws. Common requirements include multi-factor identity verification using a government-issued ID and knowledge-based authentication, an electronic journal, and secure storage of the session recording. Some states require the notary to use an approved technology vendor, so check the state notary commission’s rules before booking a session.
Submitting the Affidavit and the Records
Once the affidavit is signed and notarized (or executed under penalty of perjury), assemble the full package: the notarized affidavit, the records themselves, and a cover letter referencing the subpoena or court order by case number. Confirm that the page count and record descriptions in the affidavit match what you are actually sending. Any mismatch between the certification and the physical documents can raise accusations of bad faith or tampering.
Certified mail with return receipt requested is the standard delivery method — it produces a paper trail proving when the package arrived and who signed for it. Some jurisdictions accept electronic filing through the court’s e-filing portal, in which case scan the documents as high-resolution PDFs. If you are producing directly to an attorney, ask their preferred method first.
Keep a complete copy of everything you sent: the signed affidavit, every page of records, and the delivery confirmation. That internal file is what proves timely compliance if a dispute comes up later.
Meeting the Deadline
Federal Rule of Civil Procedure 45 does not set a single fixed compliance deadline. The date is specified in the subpoena itself.7Legal Information Institute. Rule 45 – Subpoena State rules vary; some states give 15 to 20 days from service depending on the type of subpoena. Whatever the date, treat it as firm. Missing it without filing an objection or requesting an extension can lead to contempt or monetary sanctions.
Non-party production costs can be recovered. Under FRCP 45(d)(2)(B)(ii), a court must protect a non-party from significant expense resulting from compliance.7Legal Information Institute. Rule 45 – Subpoena Negotiate cost-sharing with the requesting attorney in writing before you start pulling records.
When to Object Instead of Produce
You do not have to produce silently if the subpoena is overbroad, unduly burdensome, or seeks privileged material. Under FRCP 45, a person commanded to produce documents may serve a written objection on the requesting party before the earlier of the compliance date or 14 days after service.7Legal Information Institute. Rule 45 – Subpoena Once the objection is served, you do not have to produce the disputed records unless a court orders you to. The requesting party’s next step is a motion to compel, which puts a judge in the loop.
Common grounds include requests that sweep too broadly, demands for privileged or confidential information (attorney-client communications, trade secrets, HIPAA-protected records without proper assurances), and production burdens disproportionate to the case. Serve the objection early rather than at the deadline, and talk to the requesting attorney. Many disputes get resolved through negotiation before anyone files a motion.
Penalties for a False Certification
A custodian who knowingly certifies false information in a sworn affidavit faces federal perjury charges under 18 U.S.C. § 1621, which carries a fine and up to five years in prison.8Office of the Law Revision Counsel. 18 U.S. Code 1621 – Perjury Generally The same exposure applies to unsworn declarations executed under penalty of perjury per 28 U.S.C. § 1746; skipping the notary does not reduce liability.6Office of the Law Revision Counsel. 28 USC 1746 – Unsworn Declarations Under Penalty of Perjury A false certification can also get the records struck, trigger sanctions, and expose the organization to civil liability. Verify the records are genuine and complete before you sign.