How Can I Get My Deceased Mother’s Medical Records?

To get your deceased mother’s medical records, you request them from each provider who treated her, acting as the personal representative of her estate. That means sending the provider a certified death certificate, proof of your legal authority over the estate, your own ID, and a written request describing the records you want. HIPAA protects those records for 50 years after death, so there is no way around the documentation.¹ Once the paperwork is in order, the process itself is straightforward.

Who Is Allowed to Request the Records

HIPAA gives full access to one person: the “personal representative” of the deceased. Providers must treat that person the way they would have treated your mother while she was alive, meaning access to everything she could have seen herself.² Usually this is the executor named in her will or the administrator appointed by a probate court when there was no will.

The personal representative does not have to be a relative. A friend, attorney, or professional fiduciary can hold the role if the will or court order says so. What the provider cares about is the paperwork, not the family tree.

Family members who are not the personal representative have a much narrower path. A provider is allowed to share limited information with relatives who were involved in your mother’s care or helped pay for it, but only information tied to that involvement.³ A daughter who coordinated her mother’s chemotherapy could reasonably ask for oncology records, but not unrelated specialist notes. And even that limited access disappears if your mother told her provider during her lifetime that she did not want that particular family member to see her records.¹

HIPAA does not specifically demand court-issued Letters Testamentary or Letters of Administration. The regulation defers to whatever “applicable law” gives you authority over the estate.² HHS guidance recognizes that a next of kin or other family member can qualify as personal representative “if relevant law provides authority.”⁴ Many states let a surviving family member use a small estate affidavit for modest estates, and a provider should accept that document. In practice, hospitals and clinics vary in what their intake staff will accept, and some insist on court-issued letters regardless. If a small estate affidavit hits resistance, ask to speak with the facility’s privacy officer or health information management director.

Documents to Gather Before You Contact Anyone

Before any provider will release records, you need to prove two things: that your mother has died, and that you have legal authority to act for her estate. Assemble this stack first:

A certified copy of the death certificate. Not a photocopy. Providers will not process the request without it.
Proof of your legal authority: Letters Testamentary if you were named executor in the will, Letters of Administration if the court appointed you without a will, or a document your state recognizes such as a small estate affidavit.⁵
Your own government-issued photo ID, so the provider can confirm you are the person named in the legal documents.
A written request. Most facilities have their own authorization form on their website, or you can call the Health Information Management department and ask for one.

Your written request should include your mother’s full legal name, date of birth, date of death, your name and relationship to her, and a clear statement that you are the personal representative of her estate. Be specific about what you want. Asking for “all records” slows things down. If you need lab work from a particular year or notes from one specialist, say that.

Where to Send the Request and How Long It Takes

Send the complete package to the provider’s Health Information Management or Medical Records department. Every hospital and most physician practices have one, and the contact information is usually on the facility’s website under Patient Resources or Medical Records. Calling the main number and asking for that department works too.

Most facilities take requests by mail, fax, or in-person drop-off, and larger health systems increasingly offer secure online portals. Whatever method you use, keep proof of receipt. Certified mail with a return receipt is the most reliable option for paper.

Federal rules give the provider 30 days to either supply the records or send you a written denial. If the records are stored off-site or otherwise hard to retrieve, the provider can take one additional 30-day extension but must tell you in writing before the first deadline passes.⁶ If 60 days come and go with no response at all, escalate.

You can also request a specific format. If the provider stores records electronically, you can ask for an electronic copy in something like PDF, and the provider must supply it if they can readily produce it that way.⁷ Electronic copies usually arrive faster and cost less.

What the Provider Can Charge You

Providers can charge a reasonable fee for copying and mailing, but federal rules limit “reasonable” to labor for copying, supplies like paper or a USB drive, and postage if you want records mailed. It cannot include a search fee or general overhead.⁶

For electronic copies of records the provider already stores electronically, there is a simpler option: a flat fee of no more than $6.50 per request, covering everything including labor, supplies, and postage.⁸ Per-page charges are not allowed for electronic copies of electronically maintained records.⁷ Per-page fees apply only when the originals are on paper and you want a paper copy. If a provider tries to charge you per page for electronic records, push back and cite the $6.50 federal cap.

State laws set their own maximums for paper copies, and these vary widely. For a large paper request, ask for the fee schedule before authorizing the copying.

Finding Every Provider Who Treated Her

Medical records are not stored in one central place. Each hospital, specialist, lab, and imaging center keeps its own set, and you need a separate request to each.

Start with what you know: her primary care doctor, any regular specialists, and the hospital where she got major care. Then work through her paperwork. Explanation of Benefits statements from her insurance list every provider who billed. Medicare Summary Notices do the same job for Medicare beneficiaries. Prescription bottle labels identify her pharmacy and prescribing doctors. Old appointment cards, clinic magnets on the refrigerator, and entries in her phone’s contacts and calendar can fill in gaps you did not know existed.

How Long Records Stay Available

Providers do not keep records forever. If your mother died years ago, some records may already be gone. Medicare-participating providers must retain records for at least seven years from the date of service.⁹ State retention laws vary, with most falling between five and ten years, and some setting longer periods for records involving minors.

If she passed recently, retention is unlikely to be an issue. If she died a decade or more ago, contact providers as soon as you can. Even where the original chart has been destroyed, some facilities keep summary records or can point you to archived data. Waiting only makes this harder.

Records With Extra Protections

Two categories of records sit outside the standard access process.

Psychotherapy notes, meaning a therapist’s personal observations written during or after a counseling session, are carved out from the ordinary right of access. They are kept separate from the regular chart, and getting them requires a specific, standalone authorization. A general release-of-information form does not cover them, and even the personal representative cannot pull them through a blanket records request.¹⁰ If you need them, ask the therapist’s office about their authorization process for psychotherapy notes specifically.

Substance use disorder treatment records from federally assisted programs carry a second layer of federal protection under 42 CFR Part 2. These are not released under HIPAA alone. For a deceased patient, most disclosures still require written consent from the personal representative.¹¹ A rule change effective February 16, 2026 aligned many Part 2 requirements more closely with HIPAA and allows a single consent to cover future disclosures for treatment, payment, and operations.¹² If your mother received treatment covered by Part 2, contact the treatment facility directly and expect the process to take longer than a standard request.

When a Provider Can Legitimately Say No

A provider cannot refuse on a whim. Federal rules list specific grounds for denial, and the provider must give you a written explanation of which one applies.⁶

The most common reason is incomplete paperwork. Missing death certificate, uncertified legal documents, no proof you are the personal representative. That is not really a denial of rights so much as an invitation to come back with better documentation.

Substantive denials show up in a few situations. If your mother told her provider during her lifetime that she did not want you to have access, the provider must honor that after her death, which comes up mainly with family members requesting under the “involved in care” provision.¹ A licensed healthcare professional can also deny access if they determine, based on professional judgment, that release is reasonably likely to endanger the life or physical safety of a person. That is a narrow exception requiring a specific clinical determination.⁶ And a provider with a reasonable belief that your mother was subjected to domestic violence, abuse, or neglect by the person claiming to be her personal representative can refuse to recognize that authority.²

If a denial rests on the safety ground, you can require an internal review by a different licensed healthcare professional at the same facility who was not involved in the original decision.⁶

You can also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, which enforces HIPAA. Complaints must be filed within 180 days of when you learned about the denial, though OCR can extend that for good cause.¹³ You can file online through the OCR Complaint Portal, by email at OCRComplaint@hhs.gov, or by regular mail. Filing is free, no lawyer required. For most people stuck at a records department, mentioning that they intend to file an OCR complaint is enough to get someone higher up on the phone.

Getting Medicare Records Directly From CMS

If you need records held by CMS itself rather than by a specific hospital or doctor, the process uses a separate federal form. CMS Form 10106 authorizes disclosure of personal health information for a Medicare beneficiary. When the beneficiary is deceased, you complete the form, check the box indicating you are signing as a personal representative, and attach your legal documentation such as Letters Testamentary or Letters of Administration with a court stamp and judge’s signature.⁵

Mail the completed form to CMS’s Written Authorization Department at PO Box 1270, Lawrence, KS 66044. You can also submit through a secure Medicare.gov account if your mother had one and your legal authority lets you access it.