For years, I’ve given simple advice to lawyers and law firms on responding to a subpoena for documents or information from a client file: Don’t comply unless the client consents in writing or a court specifically orders you to respond.
The same advice applies to any other request for client information from someone other than the client.
Oh, and by the way, a subpoena may indeed technically be an “order,” but I’ve always insisted on an express order entered by a court after some kind of objection and hearing, however minimal.