When Do Hipaa Laws Apply After Death?

The HIPAA Privacy Rule protects the identifiable health information of a decedent for 50 years following their death. This period was chosen to balance the privacy interests of surviving relatives and other individuals with a relationship to the decedent, with the need for archivists, biographers, and historians to access old or ancient records on deceased individuals for historical purposes. During this time, the personal representative of the decedent has the ability to exercise the rights under the Privacy Rule with regard to the decedent’s health information. After the 50-year period, the information is no longer considered protected health information and can be disclosed without regard to the Privacy Rule.

Who can access a deceased person's PHI?

The HIPAA Privacy Rule protects the individually identifiable health information of a deceased individual for 50 years following their death. During this 50-year period, the personal representative of the deceased (i.e., the person with authority to act on behalf of the deceased or their estate) can exercise certain rights under the Privacy Rule, such as authorizing the use and disclosure of the deceased's health information.

With respect to family members or other individuals involved in the deceased's healthcare or payment for care prior to their death, the HIPAA Privacy Rule permits a covered entity to disclose relevant protected health information (PHI) to these individuals, unless doing so contradicts a known prior expressed preference of the deceased individual. "Relevant PHI" refers to information that was or is pertinent to the person's involvement in the deceased's care or payment for care.

The HIPAA Privacy Rule also includes special disclosure provisions relevant to deceased individuals, which permit a covered entity to disclose a decedent's health information:

• To alert law enforcement to the death of the individual, when there is a suspicion that death resulted from criminal conduct.
• To coroners, medical examiners, and funeral directors.
• For research that is solely on the protected health information of decedents.
• To organ procurement organizations or entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for organ, eye, or tissue donation and transplantation.

Additionally, for uses or disclosures of a decedent's health information not otherwise permitted by the HIPAA Privacy Rule, a covered entity must obtain written authorization from the personal representative of the deceased, who can authorize the disclosure.

Once the 50-year period has passed, the PHI is no longer considered protected health information under the HIPAA Privacy Rule, and covered entities may use or disclose the information without regard to the Rule.

How long is a deceased person's PHI protected?

The HIPAA Privacy Rule protects a deceased individual's health information for 50 years following their death. This means that covered entities must protect the privacy of a decedent's protected health information in the same way they would for a living person. After this 50-year period, the information is no longer considered protected health information, and can be disclosed without regard to the Privacy Rule.

During the 50-year period, the personal representative of the deceased (i.e. the executor, administrator, or person with authority to act on behalf of the decedent or their estate) can exercise certain rights under the Privacy Rule, such as authorising the use or disclosure of the information. The personal representative's access rights are similar to those of the deceased while they were alive.

Family members or other persons involved in the individual's healthcare or payment for care before their death may also be granted access to the relevant protected health information of the deceased by a covered entity, unless this is contrary to the deceased individual's prior expressed preference.

There are also special disclosure provisions that permit a covered entity to disclose a decedent's health information during the 50-year period, including:

• Alerting law enforcement to the death if there is a suspicion that it resulted from criminal conduct.
• Disclosure to coroners, medical examiners, and funeral directors.
• Research that is solely on the protected health information of decedents.
• Organ procurement organisations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue.

For uses or disclosures of a decedent's health information not permitted by the HIPAA Privacy Rule, a covered entity must obtain written authorisation from a personal representative of the deceased.

What is a 'personal representative'?

The HIPAA Privacy Rule protects the individually identifiable health information of a decedent for 50 years following the date of death. During this time, the personal representative of the decedent has the ability to exercise certain rights under the Privacy Rule with regard to the decedent's health information.

A personal representative (or legal personal representative) is the individual chosen to administer the estate of a deceased person. They are designated as such by the decedent or by a court. Personal representatives are fiduciaries and have a duty to act in good faith, with honesty, and in the best interests of the estate's beneficiaries. They are often a close relative or friend of the deceased and are usually compensated for their work.

The personal representative typically performs a number of tasks, including arranging funeral services, notifying those who are entitled to part of the estate's property, and determining the value of the estate, minus any debts. They also handle payments of debts and expenses owed by the deceased and the estate, and assess income-tax and estate-tax liabilities. Lastly, a personal representative files all necessary tax returns and distributes estate property according to the will.

The personal representative may be the executor, who is named as such in the decedent's will, or it may be the successor to the executor, or an administrator appointed by the court if the decedent died without a will. The terms personal representative, executor, or administrator may be used interchangeably by the court. Under the Uniform Probate Code, a personal representative has the same power over the title to the property of the estate as an absolute owner would have. This power may be exercised without notice, hearing, or a court order. For example, the personal representative can acquire or dispose of an asset and sell, mortgage, or lease any real or personal property of the estate.

Can a deceased person's PHI be disclosed to family members?

The HIPAA Privacy Rule protects the individually identifiable health information of a deceased person for 50 years following their death. During this time, the personal representative of the deceased—the person with the authority to act on their behalf—can exercise certain rights, such as authorising the use and disclosure of the deceased's health information.

With respect to family members, the HIPAA Privacy Rule permits a covered entity to disclose the relevant protected health information of the deceased to family members or other persons involved in the individual's healthcare or payment for care prior to their death, unless doing so contradicts a known prior expressed preference of the deceased individual. This may include disclosures to spouses, parents, children, domestic partners, other relatives, or friends of the deceased, provided the information disclosed is relevant to the person's involvement in the deceased's care or payment for care.

In cases where a family member may not have the authority to be a personal representative, an individual can direct a covered entity to transmit a copy of their PHI to the family member, and the covered entity must comply with the request, except in limited circumstances. The individual's request must be in writing, signed, and clearly identify the designated person and where to send the PHI.

Additionally, a covered entity may share information with a family member or other person involved in the individual's care or payment for care as long as the individual does not object. If the individual is deceased, the covered entity may disclose the information unless doing so contradicts a prior expressed preference of the individual.

In summary, while the HIPAA Privacy Rule protects the PHI of a deceased individual for 50 years, there are provisions that allow for disclosure of relevant PHI to family members or other persons involved in the individual's care or payment for care, as long as it does not conflict with any known prior expressed preferences of the deceased.

What happens to a deceased person's PHI after 50 years?

The Health Insurance Portability and Accountability Act (HIPAA) protects the identifiable health information of a deceased individual for 50 years after their death. This is known as the HIPAA Privacy Rule, which ensures that the privacy rights of the deceased are protected. After this 50-year period, the information is no longer considered protected health information and can be disclosed without regard to the Privacy Rule.

During the 50-year period, the personal representative of the deceased (i.e., the person with legal authority to act on their behalf) can exercise certain rights under the Privacy Rule, such as authorizing the use and disclosure of the information. The Privacy Rule also permits covered entities, such as healthcare providers and health insurers, to disclose the relevant information to family members or other persons involved in the individual's healthcare or payment for care before death. However, this disclosure is not permitted if it contradicts any known prior expressed preference of the deceased.

There are several special circumstances in which disclosure of the deceased's health information is permitted during the 50-year protection period. These include:

• Alerting law enforcement about the death if there is a suspicion of criminal conduct.
• Providing information to coroners, medical examiners, or funeral directors.
• Using the information solely for research on the protected health data of decedents.
• Facilitating organ, eye, or tissue donation and transplantation.
• Disclosing information to government agencies for health oversight activities and compliance monitoring.
• Complying with court orders, subpoenas, or other legal requirements in litigation and legal proceedings.

It is important to note that written consent from an authorized representative is required for disclosures of the deceased's health information that fall outside of these exceptions.

Once the 50-year period has passed, covered entities that possess identifiable health information, such as health records, correspondence, or photographs, are no longer restricted by the HIPAA Privacy Rule and can use or disclose the information without restriction.

Frequently asked questions