Skip Navigation

Decedents

Do the HIPAA Privacy Rule protections apply to the health information of deceased individuals?

Since the HIPAA Privacy Rule protects a decedent’s health information for 50 years following the individual’s death, am I required to keep the decedent’s information for that period of time?

Since the HIPAA Privacy Rule protects a decedent’s health information only for 50 years following the individual’s death, does my family health history recorded in my medical record lose protection when it involves family members who have been deceased for more than 50 years?

Does the HIPAA Privacy Rule permit a covered entity to disclose protected health information about a decedent to family members or other persons involved in the care of the decedent?

If an individual instructs a covered health care provider that he does not want the provider to discuss his medical conditions or treatment with his family members, can the covered entity share such information with family members after the individual has died?

How can a covered entity determine whether a person is a family member, or person involved in an individual’s care prior to death, for purposes of sharing protected health information about the decedent after death?

Does the HIPAA Privacy Rule require that a health care provider document a patient’s expressed preference not to have the provider discuss the details of her health care with her family?

How can family members of a deceased individual obtain the deceased individual's protected health information that is relevant to their own health care?