A woman calls the office. Her husband, your patient for fifteen years, died last month, and she needs his records for the life insurance claim. The front desk puts her on hold, because nobody remembers the rule, and the two guesses in circulation, "records are sealed when someone dies" and "family can have whatever they want now," are both wrong.
HIPAA has specific, workable answers here. They fit on one page, and they are worth writing down before this call, because it always arrives on a hard day for the person calling.
The HIPAA Deceased Patients Rules, In Order
Protection Continues for 50 Years
Death does not end HIPAA. 45 CFR 164.502(f) requires a covered entity to protect a decedent's P.H.I. (Protected Health Information) "for a period of 50 years following the death of the individual." The chart of a patient who died in 2026 carries Privacy Rule protection until 2076. Whether you still have the chart that long is a separate question, governed by your retention schedule, but for as long as it exists inside 50 years, the rules apply.
The Personal Representative Steps Into the Patient's Shoes
Under 164.502(g)(4), if state law gives someone authority to act for the deceased or the estate, an executor named in the will, a court-appointed administrator, or the equivalent, the practice "must treat such person as a personal representative." Must, not may. That person now holds the patient's own rights, including the full right of access: same 30-day clock, same fee limits, same short list of denial grounds.
What the front desk asks for is proof of that authority: letters testamentary or letters of administration from the probate court, or your state's small-estate equivalent. Copy the document into the file, then process the request exactly as if the patient had made it. What does not count: being the next of kin, being the spouse, or having handled the funeral. Grief is not authority; the court paper is.
Family Without Papers Can Still Be Told Some Things
Here is the provision that keeps the widow's call humane. Under 45 CFR 164.510(b)(5), a practice may disclose to a family member or other person who was involved in the patient's care or payment before death the information relevant to that involvement, unless doing so conflicts with a preference the patient expressed while alive.
The spouse who sat in every appointment and managed the medications can be spoken with about that care without executor papers. The scope is bounded by relevance to their involvement: it is a conversation, not a chart release. For the full record, or for anyone who was not involved in the care, the answer is the personal representative route above. And if the patient said while alive "do not discuss my care with my brother," that preference still binds you after the funeral.
Coroners, Medical Examiners, and Funeral Directors
45 CFR 164.512(g) permits disclosures to coroners and medical examiners for identifying a decedent and determining cause of death, and to funeral directors as necessary to carry out their duties. These need no authorization and no court papers. They are among the cleanest permitted disclosures in the rule.
The Half-Page Policy
Write four lines and train them once a year. One: records of deceased patients stay protected for 50 years and follow all normal rules. Two: a person with probate papers is treated exactly as the patient; verify, copy, and run the standard access workflow. Three: family involved in the care before death may be told information relevant to that involvement, honoring any preference the patient expressed. Four: coroner, medical examiner, and funeral director requests are permitted; everything else goes to the privacy officer. The definitions underneath all of this live in the PHI guide and the Privacy Rule overview.
---
FAQ
Does HIPAA still apply after a patient dies?
Yes. 45 CFR 164.502(f) protects a decedent's PHI for 50 years following death. Normal Privacy Rule requirements apply to the records for that entire period.
Who can request a deceased patient's medical records?
The personal representative: an executor, court-appointed administrator, or person with equivalent authority under state law. HIPAA requires treating them as the patient, with the full right of access.
What if there is no executor or estate?
State law decides who, if anyone, holds authority; many states have small-estate or next-of-kin procedures. Without any authorized person, the practice can still use 164.510(b)(5) to share care-relevant information with family who were involved in the care.
Can we talk to a spouse about a deceased patient without court papers?
If the spouse was involved in the patient's care or payment before death, yes, limited to information relevant to that involvement, and only if it does not conflict with a preference the patient expressed while alive.
Can we release information to a funeral home?
Yes. Disclosures to funeral directors as necessary for their duties, and to coroners and medical examiners for identification and cause of death, are permitted under 164.512(g).
Conclusion
Requests about deceased patients arrive rarely enough that no one remembers the rule, and sensitively enough that guessing feels terrible. A half-page policy fixes that permanently. It is one of the documents One Guy Consulting's Full-Scope plan builds with you, alongside the training to use it. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.502(f) and (g) (deceased individuals; personal representatives)
- 45 CFR 164.510(b) (involvement in care)
- HHS guidance: health information of deceased individuals
Related Reading