HIPAA protects a patient's health information for 50 years after death. During that time, the executor or court-appointed administrator steps into the patient's shoes for the records their legal role covers. Family who helped with care before death can be told what relates to that help, unless the patient said otherwise while alive and you know about it.
A woman calls the office. Her husband, your patient for fifteen years, died last month, and she needs his records for the life insurance claim. The front desk puts her on hold, because nobody remembers the rule, and the two guesses in circulation, "records are sealed when someone dies" and "family can have whatever they want now," are both wrong.
HIPAA has specific, workable answers here. They fit on one page, and they are worth writing down before this call, because it always arrives on a hard day for the person calling.
The HIPAA Deceased Patients Rules, In Order
Protection Continues for 50 Years
Death does not end HIPAA. 45 CFR 164.502(f) requires your practice (a covered entity, in HIPAA terms) to protect a deceased patient's PHI (protected health information) "for a period of 50 years following the death of the individual." The chart of a patient who died in 2026 carries Privacy Rule protection until 2076. Whether you still have the chart that long is a separate question, governed by your retention schedule, but for as long as it exists inside 50 years, the rules apply.
The Personal Representative Steps Into the Patient's Shoes
Under 164.502(g)(4), if state law gives someone authority to act for the deceased or the estate, an executor named in the will, a court-appointed administrator, or the equivalent, the practice "must treat such person as a personal representative." Must, not may. That person now steps into the patient's shoes, but only for the records their legal role covers. That includes the right of access: same 30-day clock, same fee limits, same short list of denial grounds.
What the front desk asks for is proof of that authority: letters testamentary or letters of administration from the probate court, or your state's small-estate equivalent. Copy the document into the file, then process the request exactly as if the patient had made it. What does not count: being the next of kin, being the spouse, or having handled the funeral. Grief is not authority; the court paper is.
Family Without Papers Can Still Be Told Some Things
Here is the provision that keeps the widow's call humane. Under 45 CFR 164.510(b)(5), a practice may disclose to a family member or other person who was involved in the patient's care or payment before death the information relevant to that involvement, unless that goes against a wish the patient shared while alive and your practice knows about.
The spouse who sat in every appointment and managed the medications can be spoken with about that care without executor papers. The scope is bounded by relevance to their involvement: it is a conversation, not a chart release. For the full record, or for anyone who was not involved in the care, the answer is the personal representative route above. And if the patient said while alive "do not discuss my care with my brother," that preference still binds you after the funeral.
Coroners, Medical Examiners, and Funeral Directors
45 CFR 164.512(g) permits disclosures to coroners and medical examiners for identifying a decedent and determining cause of death, and to funeral directors as necessary to carry out their duties. These need no authorization and no court papers. They are among the cleanest permitted disclosures in the rule.
The Half-Page Policy
Write four lines and train them once a year.
- Records of deceased patients stay protected for 50 years and follow all normal rules.
- A person with probate papers is treated as the patient, but only for the records their legal role covers. Verify the papers, make a copy, and run your standard access workflow.
- Family involved in the patient's care before death may be told information related to that involvement. Honor any wish the patient shared that the practice knows about.
- Requests from a coroner, medical examiner, or funeral director are allowed. Send everything else to the privacy officer.
The definitions underneath all of this live in the PHI guide and the Privacy Rule overview.
FAQ
Does HIPAA still apply after a patient dies?
Yes. 45 CFR 164.502(f) protects a decedent's PHI for 50 years following death. Normal Privacy Rule requirements apply to the records for that entire period.
Who can request a deceased patient's medical records?
The personal representative: an executor, court-appointed administrator, or person with equivalent authority under state law. HIPAA requires treating them as the patient for the records their legal role covers. That includes the right of access.
What if there is no executor or estate?
State law decides who, if anyone, holds authority; many states have small-estate or next-of-kin procedures. Without any authorized person, the practice can still use 164.510(b)(5) to share care-relevant information with family who were involved in the care.
Can we talk to a spouse about a deceased patient without court papers?
If the spouse was involved in the patient's care or payment before death, yes, limited to information relevant to that involvement, and only if it does not go against a wish the patient shared while alive and the practice knows about.
Can we release information to a funeral home?
Yes. Disclosures to funeral directors as necessary for their duties, and to coroners and medical examiners for identification and cause of death, are permitted under 164.512(g).
Requests about deceased patients arrive rarely enough that no one remembers the rule, and sensitively enough that guessing feels terrible. A half-page policy fixes that permanently. It is one of the documents One Guy Consulting's Full-Scope plan builds with you, alongside the training to use it. Start with a free 30-minute intro call. No obligation, no pressure.
Sources
- 45 CFR 164.502(f) and (g) (deceased individuals; personal representatives)
- 45 CFR 164.510(b) (involvement in care)
- HHS guidance: health information of deceased individuals
Related Reading