Decedents

The HIPAA Privacy Rule recognizes that a deceased individual’s protected health information may be relevant to a family member’s health care.

Do the HIPAA Privacy Rule protections apply to the health information of deceased individuals?

Since the HIPAA Privacy Rule protects a decedent’s health information for 50 years following the individual’s death, am I required to keep the decedent’s information for that period of time?

Since the HIPAA Privacy Rule protects a decedent’s health information only for 50 years following the individual’s death, does my family health history recorded in my medical record lose protection when it involves family members who have been deceased for more than 50 years?

Does the HIPAA Privacy Rule permit a covered entity to disclose protected health information about a decedent to family members or other persons involved in the care of the decedent?

If an individual instructs a covered health care provider that he does not want the provider to discuss his medical conditions or treatment with his family members, can the covered entity share such information with family members after the individual has died?

How can a covered entity determine whether a person is a family member, or person involved in an individual’s care prior to death, for purposes of sharing protected health information about the decedent after death?

Does the HIPAA Privacy Rule require that a health care provider document a patient’s expressed preference not to have the provider discuss the details of her health care with her family?

Health care providers cannot invite or allow media personnel, including film crews, into treatment or other areas of their facilities where patients’ PHI will be accessible in written, electronic, oral, or other visual or audio form, or otherwise make PHI accessible to the media, without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media.