Health Information Privacy After Death

If you've ever visited a physician's office, you are aware of the federal HIPPA (Health Insurance Portability and Accountability Act) regulations, which protect the privacy of personally identifiable health information.

The HIPPA Privacy Rule extends to protect a deceased individual's information for 50 years after death. But how can a family member can obtain the private information of a deceased individual?

First, a health care provider may - but is not required to - disclose the information to an individual (such as a surviving spouse) if 1) the individual was involved in the deceased's health care or payment for the health care and 2) the deceased did not express a preference to keep the information from the individual.  Information shared must be related to the individual's involvement in care or payment.  If the entity knows that the deceased did not want information shared with the requester, it should not do so.

Second, the provider is required to release personal health information if requested by the decedent's personal representative (such as an executor named in a will or an adminstrator appointed by a probate court).    In this case, the legal representative steps into the shoes of the decedent.  Even if the decedent expressed a preference to keep that information from the representative, the entity must release the information.

More background information on the Privacy Rule's application to the health information of decedents is available from the U.S. Department of Health and Human Services.