Can a Child Request Medical Records of a Deceased Parent?

An adult child can get a deceased parent’s medical records, but federal privacy law decides who gets access and how much of the file they see. Requesting medical records of a deceased parent generally works one of two ways: you serve as the estate’s personal representative, which gives you the same access your parent would have had, or you request a narrower set of records based on care or payment you were personally involved in before the death. HIPAA continues to protect your parent’s health information for 50 years after death, so the provider will treat this as a privacy-regulated request no matter which path you use.¹

The Two Access Paths

Personal Representative

The strongest right belongs to the “personal representative.” Under HIPAA, that means whoever has legal authority to act for the deceased or the estate, usually the executor named in a will or an administrator appointed by a probate court when there is no will.² Providers must treat a personal representative the same way they would treat the deceased person, so the representative can access the full medical record to the extent relevant to managing the estate.³

If you hold that role, you don’t have to justify which records you want or prove you were involved in your parent’s healthcare.

Family Involvement in Care or Payment

If you aren’t the personal representative, you can still ask for records tied to care or payment you were involved in before your parent died. A provider may disclose information directly relevant to that involvement — for example, records connected to a cancer treatment you helped coordinate or insurance claims you managed.¹

Two limits apply. The provider decides what counts as “relevant,” so you’ll receive a slice of the file rather than the whole record. And if your parent expressed a preference to their provider that you not receive their information, the provider must honor it. That preference restriction applies only to family members using this path, not to personal representatives.

Records Needed for Your Own Medical Care

If you need your parent’s history for your own treatment — a hereditary condition workup, for instance, or cardiac history relevant to your own diagnosis — HIPAA allows your doctor to request those records directly from your parent’s provider for treatment purposes.⁴ You don’t have to be the personal representative or show involvement in your parent’s care; the disclosure moves provider to provider.

How to Get Appointed as Personal Representative

Full access almost always requires appointment. If your parent had a will naming you executor, you submit the will to the probate court in the county where your parent lived, and once the court accepts the will it issues Letters Testamentary. If there was no will, you petition the same court to be appointed administrator, and the court issues Letters of Administration. Either document proves your legal authority to healthcare providers.

Not every estate needs full probate. Many states offer a simplified process for smaller estates, often through a small estate affidavit. Because HIPAA recognizes anyone with authority “under applicable law” as a personal representative, a small estate affidavit that gives you legal authority under your state’s rules should qualify.³ Some providers are unfamiliar with these affidavits and may insist on traditional letters. If that happens, point them to the HIPAA regulation and ask them to check with their privacy officer.

Documents to Gather Before You Ask

Whichever path you’re using, put these together first:

A government-issued photo ID (driver’s license, passport, or state ID).
A certified death certificate. Not a photocopy. Order it from the vital records office in the state where your parent died.
Proof of legal authority if you’re the personal representative: Letters Testamentary, Letters of Administration, or a small estate affidavit. If you’re requesting based on involvement in care, prepare a written statement describing what care you helped manage, what conditions were involved, and over what period.
The provider’s own authorization form. Nearly every hospital and practice uses its own Authorization for Release of Information form. Call the medical records department or check the provider’s website to get the correct one, then fill in your parent’s name, date of birth, dates of service, and the specific records you want.

Being too vague is a common mistake. “All records” works if you’re the personal representative. If you’re requesting based on involvement in care, name the conditions and date ranges — it strengthens the request and speeds up processing.

Submitting the Request, Timing, and Fees

Most facilities accept requests by mail, through a secure patient portal, or in person at the medical records department. If you mail it, use certified mail with a return receipt so you have proof of the delivery date. That date starts the response clock.

Under HIPAA, the provider must act on your request within 30 calendar days of receiving it.⁵ They can take one 30-day extension, but only if they send a written explanation and a new deadline before the first 30 days expire.⁶ If the deadline passes with no answer and no extension notice, call the medical records department and reference your certified mail receipt.

Providers can charge you, but the fee must be “reasonable and cost-based.” HIPAA limits the bill to labor for copying, supplies like paper or a USB drive if you requested a physical electronic copy, and postage if you asked for mail delivery.⁶ Overhead like searching for or retrieving the records is not billable. For electronic copies of records maintained electronically, HHS has said providers may charge a flat fee of no more than $6.50 in place of calculating actual costs.⁷ If a quote comes back much higher, ask for an itemized breakdown. Paper copies of a long chart cost more than electronic delivery, so request electronic when you can.

Limits That Can Narrow What You Receive

A Preference Your Parent Voiced Before Death

If your parent told their provider they did not want you to see their records, the provider must respect that. HHS applies this restriction to “family members or other persons involved in the individual’s health care or payment for care prior to the individual’s death, but who are not personal representatives.”¹ Court-appointed executors and administrators are not bound by it.

Psychotherapy Notes

Psychotherapy notes — the personal notes a therapist keeps separate from the regular chart — carry extra HIPAA protection. Releasing them generally requires a specific, standalone authorization that cannot be folded into a general records request.⁸ Even a personal representative may need to submit a separate form. Some providers read these protections strictly and resist release; state your estate-related reason plainly if you have one.

Substance Use Disorder Treatment Records

Records from federally assisted substance use disorder treatment programs are governed by 42 CFR Part 2, which is more restrictive than HIPAA and, unlike HIPAA, does not expire after 50 years. Written consent must come from the executor, administrator, or personal representative. If no one has been appointed, consent can come from the patient’s spouse, or if there is no spouse, from a responsible family member.⁹ Records related to the cause of death can be disclosed under vital statistics laws without consent. If a program is covered by both HIPAA and Part 2, it must follow whichever rule is more protective, which almost always means Part 2. Expect a more demanding process and be ready for the program to require formal appointment even for a small estate.

If the Provider Denies or Ignores Your Request

Denials sometimes have legitimate grounds, like missing documents or a special protection covering the record. Others come from staff misunderstanding HIPAA, not recognizing a small estate affidavit, or losing track of the request. HHS has taken enforcement action against providers that failed to honor valid access requests.¹⁰

Ask for the denial in writing with a specific reason. That alone often prompts the privacy officer to reconsider. If it doesn’t, you can file a complaint with the HHS Office for Civil Rights through its online portal at ocrportal.hhs.gov. You have 180 days from when you learned about the denial, though OCR can extend that deadline for good cause.¹¹ OCR investigates and can order the provider to release the records and change its practices.

A Note on the 50-Year Rule

HIPAA protection on a deceased person’s health information runs for 50 years from the date of death, after which the information no longer counts as protected health information under HIPAA.¹ For a recently deceased parent, that window is nowhere near closing, so the process above applies to your request.

1
Department of Health and Human Services. Health Information of Deceased Individuals
2
U.S. Department of Health and Human Services. Guidance: Personal Representatives
3
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information
4
HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
5
U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Requests for Access to PHI
6
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
7
U.S. Department of Health and Human Services. Clarification of Permissible Fees for HIPAA Right of Access
8
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
9
GovInfo. 42 CFR 2.15 – Incompetent and Deceased Patients
10
U.S. Department of Health and Human Services. Five Enforcement Actions Hold Healthcare Providers Accountable for HIPAA Right of Access
11
U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint