The following request occasionally pops up.
“You took care of my wife. She recently passed away. Can I have a copy of her records?”
HIPAA survives death. For 50 years.
The HIPAA Privacy Rule protects the individually identifiable health information about a decedent for 50 years following the date of death of the individual. This period of protection for decedent health information balances the privacy interests of surviving relatives and other individuals with a relationship to the decedent, with the need for archivists, biographers, historians, and others to access old or ancient records on deceased individuals for historical purposes. During the 50-year period of protection, the personal representative of the decedent (i.e., the person under applicable law with authority to act on behalf of the decedent or the decedent’s estate) has the ability to exercise the rights under the Privacy Rule with regard to the decedent’s health information, such as authorizing certain uses and disclosures of, and gaining access to, the information. With respect to family members or other persons involved in the individual’s health care or payment for care prior to the individual’s death, but who are not personal representatives, the Privacy Rule permits a covered entity to disclose the relevant protected health information of the decedent to such persons, unless doing so is inconsistent with any prior expressed preference of the deceased individual that is known to the covered entity.
HIPAA allows the person under applicable law with authority to act on behalf of the decedent or the decedent’s estate.
Instead of asking the requestor to produce a death certificate—which would be an awkward discussion, you can ask if they are the executor of the estate. If so, you have killed two birds with one stone. You have information to confirm that the patient is actually dead. (You’d be surprised how divorced couples might deceive to gain some type of perceived leverage…) And that the requesting individual is the proper person to receive records.
Of course, the deceased may have authorized any or all family members to have unfettered access to the records post-mortem. That works the same way as a standard HIPAA authorization document. If there’s a signed HIPAA agreement on file, then just honor that signed agreement.
What if the requesting individual had healthcare power of attorney? If that individual can make all healthcare decisions, then records can be shared with that individual. If that individual is authorized to make healthcare decisions limited to specific questions, such as artificial life support, then only those records reflecting end-of-life support can be shared.
The deeper details are below:
In general, the scope of the personal representative’s authority to act for the individual under the Privacy Rule derives from his or her authority under applicable law to make health care decisions for the individual. Where the person has broad authority to act on the behalf of a living individual in making decisions related to health care, such as is usually the case with a parent with respect to a minor child or a legal guardian of a mentally incompetent adult, the covered entity must treat the personal representative as the individual for all purposes under the Rule, unless an exception applies. (See below with respect to abuse, neglect or endangerment situations, and the application of State law in the context of parents and minors). Where the authority to act for the individual is limited or specific to particular health care decisions, the personal representative is to be treated as the individual only with respect to protected health information that is relevant to the representation. For example, a person with an individual’s limited health care power of attorney regarding only a specific treatment, such as use of artificial life support, is that individual’s personal representative only with respect to protected health information that relates to that health care decision. The covered entity should not treat that person as the individual for other purposes, such as to sign an authorization for the disclosure of protected health information for marketing purposes. Finally, where the person has authority to act on the behalf of a deceased individual or his estate, which does not have to include the authority to make decisions related to health care, the covered entity must treat the personal representative as the individual with respect to protected health information relevant to such personal representation (e.g., an executor of an estate has the right to access all of the protected health information of the decedent relevant to these responsibilities)
So, the practical answer to the question posed at the beginning is to ask if the requesting spouse is the executor of the estate. If so, then ask them to please send documentation thereof. Once received, you can share the full record.
What do you think?
