To get medical records for a deceased person, you need to prove you have legal authority to receive them, then submit a written request to each provider who treated the person. The strongest authority is being the estate’s personal representative (an executor or court-appointed administrator). Family members who were involved in the person’s care can also request records, but only the parts relevant to their involvement. Every provider is a separate request, and each has up to 30 days to respond.
Who Has the Right to Ask
Under the HIPAA Privacy Rule, the person with the broadest access is the deceased’s “personal representative” — the executor named in the will, an administrator appointed by a probate court, or anyone else authorized under state law to act on behalf of the deceased or the estate.1HHS.gov. Personal Representatives A personal representative is treated almost the same as the patient would have been: full record access, and the ability to authorize further disclosures.2HHS.gov. Health Information of Deceased Individuals
If no one has been formally appointed, HIPAA still permits providers to share information with family members or others who were involved in the person’s healthcare or in paying for that care. That group can include a spouse, parent, adult child, domestic partner, or close friend. Access, however, is limited to information relevant to that involvement. Someone who helped only with billing would not be entitled to detailed clinical notes.2HHS.gov. Health Information of Deceased Individuals
One restriction surprises many families. If the deceased told the provider while alive that certain information should not be shared with a specific person, the provider must honor that instruction. A legally appointed personal representative is the one exception; their request overrides the deceased’s prior preference.2HHS.gov. Health Information of Deceased Individuals
A Healthcare Power of Attorney Will Not Work
If you were named as your loved one’s healthcare agent or proxy, that authority ended at death. A healthcare power of attorney only covers medical decisions for a living person. After death it has no legal weight, and a provider is not obligated to release records based on that document. You need to establish personal representative status or qualify as an involved family member instead.
Documents to Gather First
Every provider will want proof of who you are and why you are entitled to the records. Assemble these before you contact anyone:
- A certified copy of the death certificate. Order several from the vital records office in the state or county where the death occurred; each provider will keep one.
- A government-issued photo ID such as a driver’s license or passport.
- Proof of your legal authority. This is the piece that varies most.
Personal representatives prove authority with the court order that appointed them. For executors named in a will, this is usually called Letters Testamentary. For administrators appointed when there is no will, it is Letters of Administration. Both come from the probate court.3Internal Revenue Service. Responsibilities of an Estate Administrator
Smaller estates can often bypass full probate through a small estate affidavit. HHS guidance tells providers to look to state law when deciding whether someone has authority to act for the deceased, so a small estate affidavit may work where state law recognizes it as conferring that authority.1HHS.gov. Personal Representatives Call the provider’s records department first to confirm they will accept it.
Family members who were involved in care but were not appointed personal representative may need documents showing the relationship (a birth or marriage certificate, for instance) along with a written explanation of how they were involved in the person’s healthcare or its payment.
How to Submit the Request
Call the facility and ask for the Health Information Management or Medical Records department. Larger hospitals have staff dedicated to release of information; smaller clinics may route you to an office manager. You want the person who actually processes record requests, not the front desk.
Nearly every provider will require an authorization form, often titled something like “Authorization for Release of Information.” It asks for the patient’s full name, date of birth, and date of death, what records you want, and where to send them. Be specific. “All medical records” is valid, but naming a date range or type of record (lab results, discharge summaries, imaging reports) tends to speed things up.
Send the completed form along with the death certificate, your photo ID, and your proof of authority. Most facilities accept mail, fax, or in-person delivery. Some health systems also allow submissions through their websites. Follow up within a week to confirm they received everything.
How Long the Provider Has to Respond
Under HIPAA, a provider must act on the request within 30 calendar days. Acting means either releasing the records or issuing a written denial explaining why.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
The provider can take one 30-day extension, but only by notifying you in writing within the original 30 days, stating a reason and a specific date you will hear back.5HHS.gov. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI The absolute maximum wait is therefore 60 days. If 30 days pass with no records and no written extension notice, the provider is out of compliance.
One practical note about older records: HIPAA controls how records are handled, not how long they are kept. Federal rules require certain providers participating in Medicare and Medicaid to retain records for at least seven years from the date of service, and many states set their own minimums. If the care you are asking about is from many years ago, call first to make sure the records still exist.
What You Can Be Charged
HIPAA lets providers charge a reasonable, cost-based fee that covers only the labor of copying, the supplies (paper or electronic media), and postage if you asked for the records to be mailed. Search, retrieval, and record maintenance costs cannot be added.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
For an electronic copy of records already kept electronically, the provider can instead choose a flat fee of no more than $6.50 per request, which covers labor, supplies, and postage together.6HHS.gov. Is $6.50 the Maximum Amount That Can Be Charged When records are made available through a patient portal download and no labor or supplies are involved, HIPAA does not allow any charge at all.7HHS.gov. May a Covered Health Care Provider Charge a Fee Under HIPAA
State fee schedules for paper copies vary widely, with per-page rates commonly running from around $0.25 to over $1.00, sometimes with separate search or retrieval fees layered on. If a fee looks excessive, ask for a written breakdown of how it was calculated.
Substance Use Treatment and Mental Health Records
If the person received care for a substance use disorder at a federally assisted program, those records carry an extra layer of protection under 42 CFR Part 2 that is stricter than HIPAA and does not expire. When both rules apply, the provider must follow whichever is more restrictive, which is almost always Part 2.8eCFR. 42 CFR 2.15 – Patients Who Lack Capacity and Deceased Patients
A personal representative can give the necessary written consent on the deceased’s behalf. If no one has been appointed, consent can come from the spouse or, absent a spouse, a responsible family member. Information related to cause of death may be released without consent under laws requiring vital statistics collection.8eCFR. 42 CFR 2.15 – Patients Who Lack Capacity and Deceased Patients
Psychotherapy notes get their own treatment under HIPAA. These are the therapist’s session notes kept separate from the main medical record, and they are excluded from HIPAA’s right of access. A provider can refuse to release them even to a personal representative.9HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information Standard mental health records (diagnoses, medications, treatment plans) are not psychotherapy notes and follow the ordinary rules.
If Your Request Is Denied
A denial is not always final, but your options depend on the reason. HIPAA sorts denial grounds into two groups.
Some denials cannot be appealed to the provider. These include requests for psychotherapy notes, information compiled for a legal proceeding, and certain records from ongoing clinical trials where the patient agreed to a temporary suspension of access.9HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
Other denials are reviewable. You can ask the provider to have a different licensed healthcare professional look at the decision again. A reviewable denial happens when a clinician judges that releasing the records is reasonably likely to cause substantial harm to another person or, in this context, to the deceased’s interests.9HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
If you believe the denial itself violates HIPAA, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights through its online Complaint Portal.10HHS.gov. Filing a Health Information Privacy Complaint You generally have 180 days from the violation to file, though OCR may waive that in some cases.11HHS.gov. HIPAA What to Expect Before that step, put your concerns in writing to the facility’s privacy officer. Many denials come from administrative confusion, and a clear letter citing HIPAA’s access provisions often resolves things faster than a federal investigation.
When There Are Multiple Providers
Most people receive care from more than one provider, so you may need to send separate requests to every hospital, clinic, specialist, pharmacy, and laboratory involved. There is no central clearinghouse for medical records in the United States. Each request is independent, with its own form, review, and 30-day clock.
Build a list before you start. Insurance statements, explanations of benefits, prescription bottles, and correspondence from providers all help identify where care was delivered. Once your list is complete, submit the requests at roughly the same time so the 30-day windows run together instead of one after another.