Hipaa Laws: What Happens After Death?

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects the privacy of consumers' health information in the United States. It applies to all healthcare providers, including doctors, hospitals, treatment centres, and mental health providers. But what happens to your health information after you die? Does HIPAA still apply?

The answer is yes. HIPAA laws continue to protect identifiable health information about a decedent for 50 years following their death. This protection balances the privacy interests of surviving relatives and those with a relationship to the deceased, with the need for historians, biographers, and researchers to access old records.

The HIPAA Privacy Rule protects a decedent's identifiable health information for 50 years after death

The HIPAA Privacy Rule protects identifiable health information about a decedent for 50 years following their death. This means that a deceased individual's PHI (protected health information) is safeguarded for half a century after their passing. This rule applies to covered entities and business associates, who must develop protections for PHI. The rule also sets conditions and restrictions on the use and disclosure of PHI without patient authorization.

During the 50-year period, the privacy rule protects a decedent's health information to a similar degree as that of a living person. However, there are special disclosure provisions relevant to the deceased. These include permitting covered entities to disclose a decedent's health information:

• To alert law enforcement in cases of suspected criminal conduct resulting in death.
• To coroners, medical examiners, and funeral directors.
• For research purposes, specifically on the protected health information of decedents.
• To organ procurement organizations or entities involved in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue to facilitate donation and transplantation.

Additionally, covered entities can disclose a decedent's PHI to family members or other persons involved in their healthcare or payment for care before death, unless it contradicts the deceased individual's previously expressed preferences.

Once the 50-year period elapses, the PHI is no longer considered protected health information under the HIPAA Privacy Rule. Consequently, covered entities can use or disclose the information without regard to the rule. This includes health or medical records, correspondence files, physician diaries, and photograph collections containing identifiable health information of individuals deceased for over 50 years.

After 50 years, identifiable health information is no longer protected

The HIPAA Privacy Rule protects identifiable health information for 50 years after an individual's death. This period was implemented to balance the privacy interests of the deceased's relatives with the need for historians and researchers to access old records. After 50 years, identifiable health information is no longer protected by the Privacy Rule, and covered entities can use or disclose the information without regard to the rule.

During the 50-year period, the personal representative of the deceased individual, such as an executor or administrator of their estate, can exercise rights under the Privacy Rule. They have the right to authorize certain uses and disclosures of the deceased's identifiable health information, as well as the right to access it. This representative can be a person with authority to act on behalf of the deceased or their estate under applicable law.

For individuals who are not personal representatives, such as family members or those involved in the deceased's healthcare or payment for care, there are still ways to access identifiable health information. Covered entities can disclose relevant information to these individuals unless doing so goes against the expressed wishes of the deceased.

There are also special circumstances that permit the disclosure of identifiable health information during the 50-year period. Covered entities can disclose this information to alert law enforcement if death resulted from criminal conduct, to coroners, medical examiners, and funeral directors, for research on protected health information of decedents, and to organ procurement organizations or entities involved in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue.

Once the 50-year period has passed, identifiable health information is no longer protected, and covered entities can use or disclose it without restriction under the HIPAA Privacy Rule.

During the 50-year period, a decedent's personal representative can exercise rights under the Privacy Rule

The HIPAA Privacy Rule protects the identifiable health information of a decedent for 50 years following their death. This period of protection serves to balance the privacy interests of surviving relatives and other individuals with a relationship to the decedent, with the need for archivists, biographers, historians, and others to access old or ancient records on deceased individuals for historical purposes.

During this 50-year period, the decedent's personal representative, i.e., the person with the authority to act on behalf of the decedent or their estate, can exercise rights under the Privacy Rule. This includes the right to authorize certain uses and disclosures of the decedent's health information, as well as the right to access this information.

The personal representative can be an executor, administrator, or any other person with the authority to act on behalf of the decedent or their estate under applicable state or other laws. They stand in the shoes of the decedent and can act and make decisions on their behalf.

It is important to note that the personal representative's authority to act for the decedent is derived from their authority under applicable law to make healthcare decisions for the decedent. If their authority is limited to specific healthcare decisions, they will only be treated as the personal representative for health information relevant to that specific context.

In the case of a deceased individual, the personal representative has the right to access all protected health information relevant to their responsibilities. This may include information related to the individual's healthcare or payment for care prior to their death.

Special disclosure provisions allow covered entities to disclose a decedent's health information in certain circumstances

The HIPAA Privacy Rule applies to the individually identifiable health information of a decedent for 50 years following the date of death. During this period, the privacy rule generally protects a decedent's health information to the same extent as it does for living individuals. However, there are special disclosure provisions that allow covered entities to disclose a decedent's health information in certain circumstances. These include:

• Alerting law enforcement of the death of the individual if there is a suspicion that death resulted from criminal conduct.
• Disclosing information to coroners, medical examiners, and funeral directors to identify a deceased person, determine the cause of death, or carry out their other authorized duties.
• Sharing information for research that is solely focused on the protected health information of decedents.
• Facilitating organ, eye, or tissue donation and transplantation by disclosing information to organ procurement organizations or other relevant entities.

In addition, covered entities are permitted to disclose a decedent's relevant protected health information to family members or other persons involved in the individual's healthcare or payment for care prior to death, unless doing so is inconsistent with any prior expressed preference of the deceased individual known to the covered entity.

Written authorization from a personal representative is required for uses or disclosures not permitted by the Privacy Rule

The HIPAA Privacy Rule protects the individually identifiable health information of a decedent for 50 years following the date of death. During this period, the personal representative of the decedent (i.e., the person under applicable law with authority to act on behalf of the decedent or the decedent's estate) has the ability to exercise the rights under the Privacy Rule with regard to the decedent's health information. This includes the right to authorize certain uses and disclosures of the decedent's health information.

For uses or disclosures of a decedent's health information not otherwise permitted by the Privacy Rule, a covered entity must obtain a written HIPAA authorization from a personal representative of the decedent who can authorize the disclosure. A decedent's personal representative is an executor, administrator, or other person who has authority under applicable State or other law to act on behalf of the decedent or the decedent's estate.

Frequently asked questions