Does HIPAA Apply to the Deceased? Records and the 50-Year Rule

Yes, HIPAA does apply to deceased patients. The Privacy Rule protects a person’s health information for 50 years after the date of death, and during that window access is controlled much the way it would be for a living patient. A personal representative can exercise nearly all the rights the patient held, and providers can still share limited information with family members who were involved in the person’s care.

How Long Protection Lasts After Death

Every covered entity must comply with HIPAA’s protections for a deceased person’s health information for 50 years following the date of death.¹ Throughout that period, the information receives essentially the same level of protection it would if the patient were alive. Once the 50 years pass, the information is no longer protected health information under federal law, and a provider still holding those records could release them without HIPAA restrictions.

Records May Be Gone Long Before 50 Years

HIPAA does not require providers to keep records for 50 years. The 50-year rule only governs how records must be treated if they still exist. Actual retention is set by other laws. HIPAA’s administrative requirements call for retaining certain documentation for six years, and Medicare managed care providers must keep patient records for ten years.² State laws vary widely, running from as few as three years to permanent preservation depending on the state, the type of provider, and whether the patient was a minor. A typical requirement is around seven years from the last encounter. The practical consequence: the records you need may have been legally destroyed long before the 50-year window expires. If you think you’ll need a deceased person’s records, request them sooner rather than later.

Who Counts as a Personal Representative

A personal representative is the person who inherits the patient’s rights over their health information. A covered entity must treat anyone with legal authority under applicable law to act on behalf of the deceased person or their estate as the personal representative for HIPAA purposes.¹ That authority is broader than it sounds and does not always require formal probate.

The clearest example is an executor named in the deceased person’s will or an administrator appointed by a court when there is no will. These individuals typically hold letters testamentary or letters of administration. HHS guidance also makes clear that a “next of kin or other family member” qualifies as a personal representative if state law grants that family member authority to act on behalf of the deceased.³ Many states allow surviving spouses or adult children to use a small estate affidavit or similar simplified procedure to gain legal authority over a modest estate without going through probate at all. Where state law recognizes that authority, the holder qualifies as a HIPAA personal representative.

Being a close family member does not automatically make you a personal representative, but it does not automatically exclude you either. The answer depends on what your state’s law says about who has authority over a decedent’s affairs. A provider who refuses access to a spouse or adult child should be asked what specific documentation they need to confirm authority under your state’s law, because the answer may be simpler than full probate.

What a Personal Representative Can Do

During the 50-year period, the personal representative can exercise the same rights the patient would have had while alive.⁴ That includes requesting and receiving copies of medical records, authorizing disclosures to third parties like insurers or attorneys, and requesting corrections to inaccurate information. The provider must treat the personal representative as though they are the patient for purposes of the Privacy Rule.

There is one important limitation. A provider may deny a request if a licensed health care professional determines, in professional judgment, that giving the personal representative access is reasonably likely to cause substantial harm to the deceased individual or another person.⁵ This is a reviewable denial: the personal representative can request a second opinion from another licensed professional at the same organization, and the covered entity must comply with that reviewer’s decision.

When Providers Can Share Without a Personal Representative

Not every disclosure requires personal representative involvement. HIPAA carves out several situations where providers can share information on their own authority.

Family Members Involved in Care

A provider may disclose health information to a family member, relative, or close friend who was involved in the deceased person’s care or payment for care before death, as long as the information shared is relevant to that person’s involvement.⁶ A spouse who managed the patient’s medications or an adult child who attended appointments and handled billing could receive information related to that involvement without needing formal legal authority over the estate.

This exception carries a safeguard: the provider cannot share information if doing so would be inconsistent with a preference the patient expressed while alive, as long as the provider knows about that preference.⁶ If the patient told the doctor not to discuss their condition with a particular relative, that instruction survives death.

Coroners, Funeral Directors, and Organ Procurement

Providers can disclose health information to coroners and medical examiners for purposes like identifying a body or determining cause of death, to funeral directors as needed to carry out their duties, and to organ procurement organizations to facilitate tissue or organ donation.⁷ These disclosures do not require authorization from a personal representative or family member.

Research

Researchers can access a deceased person’s health information without authorization from a personal representative, provided they give the covered entity certain representations: that the use is solely for research on decedent information, that they can document the death of the individuals whose records they need, and that the information is necessary for the research.⁷

How to Request a Deceased Person’s Medical Records

HIPAA itself does not prescribe a specific set of documents you must submit. What it requires is that the provider verify you have legal authority under applicable law to act on behalf of the deceased person or their estate.³ In practice, most providers will ask for some combination of the following:

Proof of authority, such as letters testamentary, letters of administration, or a small estate affidavit — whatever document your state recognizes as granting authority over the decedent’s affairs.
A certified copy of the death certificate.
Government-issued photo identification confirming you are the person named in the authority documents.
The provider’s own release or authorization form, if it has one. HIPAA does not require a specific form.

Each provider’s process differs, so call ahead and ask what they need before assembling paperwork. If you hold authority under state law but intake staff is unfamiliar with your type of documentation, escalating to the provider’s privacy officer usually resolves the issue.

Response Deadlines

Once a provider receives a valid request, it must produce the records within 30 calendar days.⁸ HHS treats that 30-day window as an outer limit, not a target. If the provider cannot meet the deadline because records are stored offsite or otherwise difficult to access, it may take a single 30-day extension, but only if it notifies you in writing within the initial 30 days explaining the reason for the delay and the date you will receive the records.

Fees for Copies

Providers may charge a reasonable, cost-based fee for copies. That fee can include only the labor of actually copying the records once they’ve been located and compiled, the cost of supplies like paper or a USB drive, and postage if you ask for the records by mail.⁵ The provider cannot charge you for time spent searching for the records, reviewing your request, or verifying your identity.⁹ If a bill includes search-and-retrieval charges, those charges exceed what HIPAA permits. State laws may also cap per-page copy fees, and those caps vary considerably.

Records That Can Still Be Withheld

One category of records sits outside the normal right of access: psychotherapy notes. These are a therapist’s personal notes from counseling sessions, kept separately from the main medical chart. Neither the patient nor a personal representative has a right to access psychotherapy notes under HIPAA.¹⁰ A therapist may choose to release them, but cannot be compelled to do so under the Privacy Rule alone. Regular mental health treatment records in the medical chart are accessible like any other record; the exception applies only to the therapist’s separate session notes.

Other information a provider can withhold includes records compiled in anticipation of litigation and, in rare cases, information obtained from a source other than a health care provider under a promise of confidentiality, if releasing it would reveal the source.⁸

If a Provider Denies Your Request

If a provider refuses to release a deceased person’s records and you believe you have the legal authority to receive them, ask for the denial in writing with an explanation of the legal basis. Many initial refusals come from front-desk staff unfamiliar with HIPAA’s personal representative rules, and a written request directed to the privacy officer often produces a different result.

If the denial stands, you can file a complaint with the Office for Civil Rights at HHS. The complaint must be filed in writing within 180 days of when you learned of the denial, though OCR can extend that deadline for good cause.¹¹ You can file online through the OCR Complaint Portal, by email to OCRComplaint@hhs.gov, or by mailing a completed complaint form to HHS at 200 Independence Avenue, S.W., Room 509F HHH Building, Washington, D.C. 20201. The complaint should name the provider, describe what happened, and explain why you believe the denial violated the Privacy Rule. If you are filing on behalf of the deceased person as their personal representative, include the deceased person’s name as well.

For denials based on a professional judgment that releasing the records could cause substantial harm, you have the right to request a review by a different licensed health care professional at the same covered entity, and the covered entity must comply with that reviewer’s decision.⁵

1
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules
2
CMS. Medical Record Retention and Media Format for Medical
3
HHS.gov. Guidance: Personal Representatives
4
HHS.gov. Health Information of Deceased Individuals
5
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
6
eCFR. 45 CFR 164.510 – Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object
7
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
8
HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
9
HHS.gov. May a Covered Entity Charge Individuals a Fee for Providing the Individuals With a Copy of Their PHI?
10
HHS.gov. HIPAA Privacy Rule and Sharing Information Related to Mental Health
11
U.S. Department of Health & Human Services (HHS). How to File a Health Information Privacy or Security Complaint