• E-mail
• Print
• RSS

Does HIPAA cover deceased individuals?

HIPAA Weekly Advisor, August 2, 2002

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: Question of the Week: Do all of HIPAA's privacy protections and requirements extend to deceased individuals?

A: Yes. You must comply with the regulations for protected health information (PHI) of a deceased person the same way you would for living persons. The rules are in effect for as long as you maintain the information.

If you need an authorization, you must obtain it from the personal representative of the dead patient, which may be an executor, administrator, or other person with authority to act on behalf of a deceased individual or the individual's estate. The personal representative is entitled to request access in the same way the individual would, and you must grant access to the personal representative if you would grant it to the individual.

The regulations allow disclosure of PHI to health care providers for purposes of treatment, including treatment of persons other than the individual. If PHI of a deceased person is relevant to the treatment of a family member, the family member's physician may obtain that information.

You may also disclose PHI to funeral directors, consistent with applicable law, as necessary to carry out their duties. If necessary for funeral directors to carry out their duties, you may disclose the PHI prior to, and in reasonable anticipation of, the individual's death. Hospitals can disclose to funeral directors the fact that an individual has donated an organ or tissue, because this information has implications for embalming.

You may disclose PHI to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or complying with other duties as authorized by law. No prior consents or authorizations are required. Note that psychotherapy notes may be released without authorization to a coroner or medical examiner.

If you suspect that a death resulted from criminal conduct, you can disclose PHI about the deceased individual to a law enforcement official to alert the authorities to the death.

A deceased person's PHI can be released for research purposes without consent or authorization of the personal representative when the covered entity obtains the following from the researcher:

• Representation that the use or disclosure sought is solely for research on the protected health information of decedent (can be oral or written)
• Documentation of the death of such individual
• Representation that the PHI sought is necessary for the research purposes

In the absence of such representation, release of information about decedents is subject to the general rules for research.

Editor's note: Brought to you by attorneys Marty Baxter and Gretchen McBeath at Bricker and Eckler, LLP (http://www.bricker.com) and The Quality Management Consulting Group, Ltd. (http://www.qmcg.com). E-mail: mbaxter@bricker.com or gmcbeath@bricker.com.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive