Imagine you work for a practice and you receive a request for medical records from the parents of an adult patient who died. The patient (their son) did not have a power of attorney assigned. Under HIPAA are you permitted to release the records to his parents?
HIPAA Laws After Death
Under the HIPAA Privacy Rule, the individually identifiable health information about a decedent is protected for 50 years following the date of death of the individual. During the 50-year period of protection, the personal representative of the decedent (i.e., the person under applicable law with authority to act on behalf of the decedent or the decedent's estate) has the ability to exercise the rights under the Privacy Rule with regard to the decedent's health information, such as authorizing certain uses and disclosures of, and gaining access to, the information. With respect to family members or other persons involved in the individual's health care or payment for care prior to the individual's death, but who are not personal representatives, the Privacy Rule permits a covered entity to disclose the relevant protected health information of the decedent to such persons, unless doing so is inconsistent with any prior expressed preference of the deceased individual that is known to the covered entity (45 CFR 160.103).
Personal Representation and the Law
Further, if the patient dies without naming a personal representative, state law determines who by default possesses the right. Generally, States grant the rights to an adult member of the immediate family member. Some state laws require people to submit legal proof of executorship to healthcare organizations in order to access records and a copy of the patient's death certificate, while other states follow a hierarchy of who becomes, by default, the personal representative of a deceased patient if the patient dies without naming a personal representative.
How you'll respond to requests for release:
- Personal Representative: The personal representative of the decedent (i.e., the person under applicable law with authority to act on behalf of the decedent or the decedent's estate) has the ability to exercise the rights under the Privacy Rule with regard to the decedent's health information, such as authorizing certain uses and disclosures of, and gaining access to, the information.
- Family Members: Family members involved in the health care or payment of care prior to the individual's death and who are not named as personal representatives, may be disclosed the decedent's medical records.
- No personal representative named? Check your state laws to determine who has those rights. *For example, in certain states, if there is not a spouse, an adult son, or a daughter who is requesting the records, the records should be disclosed to the parents.
If you have any additional questions contact Healthcare Compliance Pros via email at suppport@hcp.md.
Author
Director of Compliance & Rick Management