Can a Spouse Request Medical Records for a Deceased Spouse?

To get medical records of a deceased spouse, you generally need to be appointed as the personal representative of their estate — usually the executor or court-appointed administrator — and present that paperwork to the healthcare provider along with a certified death certificate. Being married to the patient is not, by itself, enough. Federal privacy law keeps a deceased person’s health information protected for 50 years after death, so providers need proof of legal authority before they release anything.

Why Marriage Alone Doesn’t Unlock the Records

HIPAA’s Privacy Rule doesn’t switch off when a patient dies. A deceased person’s health information stays protected for 50 years, and during that window hospitals, clinics, and insurers must follow the same confidentiality rules that applied while the person was alive.¹ After 50 years, the Privacy Rule no longer applies.²

Within that period, a provider can release records only to someone who fits one of the categories HIPAA recognizes. For a surviving spouse, there are two realistic paths.

The Two Ways You Can Qualify

Personal Representative: Full Access

The stronger path is being the deceased’s personal representative. HIPAA requires covered entities to treat a personal representative the same as the patient for purposes of accessing health information. For a decedent, the personal representative is whoever has authority under state law to act on behalf of the person or their estate. That authority does not have to be a healthcare authority. An executor or estate administrator qualifies, even though the role centers on financial and legal matters.²

As personal representative, you can inspect the records, get copies, and authorize disclosures to third parties like attorneys or insurers.³

Family Member Involved in Care: Limited Access

If you haven’t been appointed personal representative yet, HIPAA still allows providers to share information with family members who were involved in the patient’s care or payment for care before death. The provider may release information that is directly relevant to your involvement, such as treatment history you helped manage or bills you helped pay.³⁴

Two limits matter here. First, the provider decides what counts as directly relevant, and you don’t get authority to release records to anyone else. Second, if your spouse previously told the provider not to share their records with you and the provider knows about that preference, the provider should honor it.³ For most surviving spouses who need a full record set — for a wrongful death claim, a life insurance dispute, or answers about a cause of death — personal representative status is the more reliable route.

How to Become Personal Representative

The mechanics run through your state’s probate court. If your spouse left a will naming you executor, the court issues letters testamentary confirming your authority. If there was no will, you petition the court for appointment as administrator, and the court issues letters of administration. Either document is what providers actually want to see.

Filing usually involves a petition, a certified death certificate, and proof of your relationship such as a marriage certificate. Processing times vary. If you need records urgently — for example, to preserve a wrongful death claim — tell the court, because some jurisdictions offer expedited procedures.

Many states offer lighter alternatives for smaller estates. A small estate affidavit or summary administration can establish authority without a full probate proceeding. Whether a given provider accepts an affidavit varies. Some institutions insist on court-issued letters. If a provider rejects your affidavit, you can go through standard probate or escalate the request.

State intestacy rules also matter. In some states, a surviving spouse is automatically recognized as having authority over the estate, which shortens the process. Other states require a court order regardless of relationship. A quick call to your local probate court before you approach the provider can save a wasted round.

What Documents to Bring

Requirements differ by facility, but most providers ask for some combination of these:

Certified death certificate.
Marriage certificate proving your relationship.
Letters testamentary or letters of administration from the probate court.
Your government-issued photo ID.
A written request identifying the records you want.

Many facilities have their own release-of-information form. Calling the records department first, or checking their website, is worth the ten minutes. If you’re using the family-member path instead of personal representative status, bring documentation of your involvement — insurance statements, prior visit records that list you as an emergency contact, or bills you paid.

How Long It Takes and What It Costs

Once your request is in, HIPAA gives the provider 30 calendar days to respond. It can take one 30-day extension, but only if it sends you a written explanation of the delay within the first 30 days.⁵ Sixty days from receipt is the federal outer limit.

Providers can charge a reasonable, cost-based fee for copies. The fee may cover labor for copying, supplies like paper or a USB drive, and postage if you want the records mailed. It cannot include the cost of searching for or retrieving the records. For electronic copies of records already stored electronically, the provider may instead charge a flat fee of up to $6.50 covering labor, supplies, and postage.⁶

Records With Extra Protections

Some categories of records have their own rules on top of HIPAA.

Substance use disorder treatment records are governed by 42 CFR Part 2, a stricter federal confidentiality regime. A 2024 final rule aligned Part 2 more closely with HIPAA, with a compliance date of February 16, 2026.⁷ Under the updated rule, a personal representative can consent to disclosure of a deceased patient’s SUD records.⁸ The definition of personal representative in this context still requires authority under state law to make healthcare decisions, which is narrower than the general HIPAA rule for decedents. If you hold estate authority only, a provider may hesitate on SUD records, and you may need an attorney to sort it out.

Many states also add protections for HIV/AIDS records, mental health notes, and genetic testing results. Some require a court order regardless of your relationship. If you suspect the file contains any of these, ask the provider upfront so you don’t stall midway through the request.

Why Requests Get Denied

Insufficient proof of authority. A marriage certificate on its own isn’t enough at most facilities. Obtain letters testamentary, letters of administration, or the state’s small-estate equivalent.
Disputed marital status. If you were separated or had a divorce pending at the time of death, a court appointment as administrator resolves the question more cleanly than arguing about status.
The deceased expressed a preference against disclosure. If your spouse told a provider not to share their records with you, the provider can honor that instruction. It applies to the family-member path and doesn’t necessarily block a court-appointed personal representative, though some providers read it broadly.
Records no longer exist. State retention laws range from as few as three years to ten or more, and HIPAA itself sets no minimum for how long providers must keep records. If the file was destroyed in line with state rules, there’s no recourse.⁹
An advance directive named someone else. If your spouse signed a healthcare power of attorney naming a different agent, the provider may treat that person as its point of contact. Getting appointed executor or administrator through probate generally overrides that for post-death access, because the HIPAA rule for deceased individuals doesn’t require healthcare decision-making authority specifically.²

If You Believe You Were Wrongfully Denied

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) within 180 days of learning about the denial. OCR can extend that deadline for good cause.¹⁰ The complaint should identify the provider, describe what happened, and include copies of your request, the denial, and your supporting documents.

OCR can require providers to change their practices, but investigations are not fast. If you’re on a deadline — for a lawsuit, an insurance claim, or a coroner’s inquiry — a lawyer who can seek a court order for the records is often more practical than waiting on OCR.

Records Held by an Employer

Some medical records sit outside the healthcare system. If your spouse was exposed to hazardous substances or harmful agents at work, their employer may hold separate medical records governed by OSHA rather than HIPAA. Under OSHA’s access standard, a deceased employee’s legal representative can exercise the same rights to those records the employee would have had.¹¹ Because employers aren’t always HIPAA-covered entities, the process runs through human resources rather than a medical records department. Worth asking about if your spouse worked in manufacturing, construction, healthcare, or another field with chemical or biological exposures.

1
HHS.gov. Am I Required to Keep the Decedent’s Information for 50 Years
2
HHS.gov. Personal Representatives
3
HHS.gov. Health Information of Deceased Individuals
4
eCFR. 45 CFR 164.510 – Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object
5
HHS.gov. Right to Access and Research
6
HHS.gov. How Can Covered Entities Calculate the Limited Fee That Can Be Charged to Individuals to Provide Them With a Copy of Their PHI
7
Federal Register. Confidentiality of Substance Use Disorder (SUD) Patient Records
8
eCFR. Part 2 Confidentiality of Substance Use Disorder Patient Records
9
Montana State Legislature. Medical Record Retention Required of Health Care Providers – 50 State Comparison
10
HHS.gov. How to File a Health Information Privacy or Security Complaint
11
Occupational Safety and Health Administration. Access to Employee Exposure and Medical Records