According to the Department of Health and Human Services (HHS), “The HIPAA Privacy Rule provides two ways for a surviving family member to obtain the protected health information (PHI) of a deceased relative. First, disclosures of PHI for treatment purposes—even the treatment of another individual—do not require an authorization; thus, a covered entity may disclose a decedent’s PHI, without authorization, to the health care provider who is treating the surviving relative. Second, a covered entity must treat a deceased individual’s legally authorized executor or administrator, or a person who is otherwise legally authorized to act on the behalf of the deceased individual or his estate, as a personal representative with respect to PHI relevant to such representation. Therefore, if it is within the scope of such personal representative’s authority under other law, the Rule permits the personal representative to obtain the information or provide the appropriate authorization for its disclosure.”
Legal requirements for access
According to the article How to Get a Deceased Parent's Medical Record by Ahima Foundation, only the following individuals can request medical records of a deceased patient:
- The estate's executor or administrator
- A personal representative with legal authority
- Power of attorney that survived death
- The next of kin (in some circumstances)
However, it is important to note that some of these laws may differ from state to state, as each jurisdiction has its own regulations regarding access to a deceased person's medical records. While federal laws, such as the Health Insurance Portability and Accountability Act (HIPAA), provide general guidelines, individual states may have specific requirements or exceptions that can affect how medical records are accessed after a person’s death.
Read also: HIPAA rules for deceased patients
Documentation required from requestors
Required documentation as outlined by the American Medical Association (AMA) includes:
- Death certificate
- Proof of identity (government-issued ID)
- Documentation of legal authority
- Any relevant court orders or letters of administration
Recommended process for handling requests
- Establish clear procedures in your medical records department
- Create standardized forms for record release requests
- Verify all required documentation
- Check if records are still available within required retention period
- Process formal requests by:
- Reviewing completed release forms
- Verifying copies of all required documentation
- Confirming which specific records are needed
- Validating the requestor's relationship to the deceased
Understanding HIPAA considerations
Under HIPAA, PHI maintains its protected status for 50 years after death. However, 45 CFR 164.510(b)(5) states that, “If the individual is deceased, a covered entity may disclose to a family member, or other persons identified in paragraph (b)(1) of this section who were involved in the individual's care or payment for health care prior to the individual's death, protected health information of the individual that is relevant to such person's involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.”
Common challenges
- Missing or incomplete documentation from requestors
- Locating old records
- Coordinating with multiple departments
- Navigating varying state laws
- Managing processing timelines
- Setting appropriate fees
Special circumstances
Some situations may require additional steps:
- Mental health records often have stricter privacy protections
- Records from closed facilities may be archived elsewhere
- Very old records might be in storage or microfilm
- Digital records may be easier to access than paper records
Costs and timeframes
An article by the U.S Government Accountability Office states that, “Available information suggests that the fees charged for accessing medical records can vary depending on the type of request and the state in which the request is made. Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, providers are authorized to charge a reasonable, cost-based fee when patients request copies of their medical records or request that their records be forwarded to another provider or entity. In the case of third-party requests, when a patient gives permission for another entity—for example, an attorney—to request copies of the patient's medical records, the fees are not subject to the reasonable cost-based standard and are generally governed by state law.”
Processing time typically takes several weeks due to verification requirements, record location, and documentation review. Establish clear timeframe expectations based on your facility's resources and state regulations.
Grounds for denying access
You may need to deny access if:
- The deceased specifically prohibited disclosure
- State law restricts access
- Records no longer exist
- Requestor lacks proper legal authority
FAQs
What should I do if I can't locate the deceased's medical records?
If records are missing or difficult to find, it may be necessary to check with other departments or archives.
Can family members request medical records without legal documentation?
No, family members must provide proper legal documentation, such as a death certificate and proof of legal authority, to request deceased patient records.
Can digital medical records be accessed more easily than paper records?
Yes, digital records are typically easier and faster to access compared to paper records, which may be stored in archives or require more time to retrieve.
