How to Get a Deceased Person’s Medical Records

To get a deceased person’s medical records, you send a written request to each of their healthcare providers with a certified death certificate and documentation of your legal authority to receive the records. The person with the broadest right of access is the court-appointed personal representative of the estate, but family members and others who were involved in the deceased’s care can qualify for a narrower slice of the file. Under federal privacy law, a provider generally has 30 days to respond.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information

Who Has the Right to Request the Records

The Personal Representative of the Estate

Under HIPAA, the person with full access to a deceased individual’s protected health information is the “personal representative,” meaning someone with legal authority to act on behalf of the deceased or the estate. In most cases that is the executor named in a will or an administrator appointed by a probate court.2U.S. Department of Health & Human Services. Health Information of Deceased Individuals A personal representative can access all of the deceased’s records without being limited to particular dates or types of treatment. The authority comes from the probate court, which issues documents (usually called Letters Testamentary or Letters of Administration) that providers will want to see before they release the file.

Family Members and Caregivers

If no personal representative has been appointed, or you are not the executor, a narrower path exists. HIPAA lets providers share records with family members, domestic partners, close friends, and other people who were involved in the deceased’s healthcare or helped pay for it.3eCFR. 45 CFR 164.510 – Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object A spouse who managed appointments, an adult child who coordinated home aides, a friend who picked up prescriptions—each could qualify.

Access under this path is limited to records directly relevant to that involvement. If you helped pay for a parent’s cardiac rehab, you can ask for billing statements and cardiology notes, but a provider can reasonably decline to release unrelated psychiatric records from years earlier. Providers also must honor any preference the deceased expressed while alive. If the patient told the doctor they did not want a particular relative to see their records, that instruction survives death.3eCFR. 45 CFR 164.510 – Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object

Why a Power of Attorney Will Not Help

A common misunderstanding: a healthcare power of attorney or medical proxy does not carry authority after death. A power of attorney of any kind terminates the moment the person who granted it dies. The agent who was making medical decisions last week has no special standing now. To access records, that person needs to either become the personal representative through probate or qualify under the family-and-caregiver path like anyone else.

Documents to Gather Before You Contact Anyone

Providers will not release records over the phone. Assemble the package first.

  • A certified copy of the death certificate, available from the vital records office in the state where the death occurred.
  • Proof of your legal authority. If you are the personal representative, that is a copy of Letters Testamentary or Letters of Administration from the probate court. If you are a family member or caregiver without a court appointment, prepare a written statement describing your relationship to the deceased and how you were involved in their care or paid for it.
  • Identifying information for the patient: full legal name, date of birth, date of death, Social Security number if you have it, and approximate dates of treatment at the facility. Dates help the records staff locate the file faster.
  • The provider’s own authorization form. Most healthcare organizations require you to use their release form rather than a generic one. Call the medical records department or check the website to get a copy.

Family members and caregivers using the limited-access path should expect some providers to ask follow-up questions or request additional documentation. Providers have discretion, and some are more cautious than others.

How to Submit the Request

Send the completed form and supporting documents to the provider’s medical records department (sometimes called Health Information Management). Certified mail with return receipt is the most reliable route because it gives you proof of when the provider received the request, which starts the response clock. Larger hospital systems often accept requests through a secure online portal, and smaller practices may take hand delivery.

If the deceased saw several providers, you have to submit a separate request to each one. A hospital, a primary care office, a specialist, and a pharmacy are all independent covered entities under HIPAA. No central clearinghouse pulls all of a person’s records together.

Timeline, Fees, and Format

Once a provider receives your request, HIPAA gives them 30 days to either provide the records or issue a written denial. If the records are stored off-site or the request is unusually complex, the provider can take a single 30-day extension, but only if they notify you in writing with the reason and a new date.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information

Providers can charge a reasonable fee covering copying, supplies, and postage.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information For electronic copies of electronically maintained records, HHS has established a flat fee option of $6.50 per request as an alternative to itemized cost calculations.4HHS.gov. $6.50 Flat Rate Option Is Not a Cap on Fees Paper copies of larger files can cost significantly more, with per-page fees set by state law commonly falling between $0.25 and $1.50. Ask about fees upfront.

You can request records in paper, electronic form, or both. If the provider maintains the records electronically and you ask for an electronic copy, they must provide it in the form you request when that form is readily producible.

Records That Are Harder to Get

Psychotherapy Notes

Psychotherapy notes sit behind a higher privacy wall. These are a therapist’s personal session notes, kept separately from the rest of the medical file. Under HIPAA, even a living patient generally cannot demand their own psychotherapy notes, and a personal representative usually cannot either.5eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required The clear exception is disclosure to coroners and medical examiners investigating a cause of death. If you need psychotherapy notes for litigation, such as a wrongful death or malpractice case, the usual route is a court order, with a judge reviewing the notes privately to decide whether they are relevant enough to release. Some states add stricter protections on top of HIPAA for mental health records.

Substance Use Disorder Treatment Records

Records from federally assisted substance use disorder programs carry a separate federal protection under 42 CFR Part 2, which is stricter than HIPAA in several respects. After the patient’s death, these records can be disclosed for vital statistics purposes such as cause-of-death investigations without consent. For any other purpose, written consent is still required, and the personal representative is the person who can provide it.6eCFR. 42 CFR 2.15 – Patients Who Lack Capacity and Deceased Patients A family member using the standard HIPAA limited-access path cannot use that same path for Part 2 records.

If Your Request Is Denied

A denial is not the end of the road. When a provider refuses to release records, they must give you a written denial in plain language that explains the reason, tells you whether the decision can be reviewed, and describes how to file a complaint.7eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information For certain categories of denial, you have a right to internal review by a licensed healthcare professional at the same organization who was not involved in the original decision.

If internal review does not fix the problem, or if the provider is simply not responding, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights through the OCR online portal or in writing.8HHS.gov. Filing a Health Information Privacy Complaint You generally have 180 days from the date of the violation to file.9HHS.gov. HIPAA What to Expect Do not wait things out if a provider is stonewalling. The 180-day window closes faster than people expect.

Do Not Wait Too Long

HIPAA protects a deceased person’s health information for 50 years after death, but the records themselves may not last that long.10eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules HIPAA does not set a retention period. State law does, and the requirements vary. Most states require providers to keep adult medical records for somewhere between five and eleven years after the last date of treatment or discharge. After the retention period expires, a provider can legally destroy the file.

If you think you might need the records for any reason, whether settling the estate, investigating a cause of death, or evaluating potential litigation, request them as soon as you have the legal authority. Waiting years to ask risks finding out the records no longer exist.