According to the NIH article Legal, Social, and Ethical Issues, “Autopsy reports, while containing valuable medical information, are not typically included in the same category as medical records that come from ongoing care or treatment. However, they are sometimes treated as PHI if they contain identifiable information about the deceased.”
While autopsy reports undoubtedly contain sensitive medical information, they are not generally considered PHI unless they are also accompanied by identifiable information that links the decedent to the report. The HIPAA privacy rule protects the protected health information (PHI) of the living. However, it also extends these protections to the health information of the deceased for 50 years from their date of death.
Confidentiality laws regarding autopsy reports may vary, and autopsy reports may still be bound by privacy laws in some states.
Read also: How to handle family requests for deceased patient records
Protected Health Information includes any individually identifiable health information that relates to:
This information becomes PHI when it is created or received by a "covered entity" – healthcare providers, health plans, or healthcare clearinghouses – and identifies the individual or provides a reasonable basis for identification.
Related: Examples of protected health information (PHI) in healthcare
Autopsy reports present a challenge to HIPAA's framework. On one hand, they contain medical information regarding a deceased individual, including medical history, physical findings, and laboratory results – information that would be PHI if the person were alive. On the other hand, medical examiners (MEs) and coroners who perform autopsies and generate these reports are not typically considered "covered entities" under HIPAA.
Autopsy reports are not necessarily PHI because they deal with deceased individuals. Medical examiners or coroners are, nevertheless, bound by laws that regulate how they manage and release autopsy reports. Sometimes privacy can be trumped by public health issues, and reports can be released to public health authorities if the cause of death is attributable to a communicable disease.
The NIH article explains, “In the United States, health care institutions and employees must protect a patient's right to privacy and confidentiality—even after death—unless exceptions by law apply, such as in the case of communicable diseases.”
Related: What is a covered entity under HIPAA?
Under HIPAA, privacy protections don't immediately cease upon death. The law extends privacy protections for 50 years after an individual's death. However, this protection only applies to PHI held by covered entities. Since MEs and coroners typically aren't covered entities, this protection may not extend to autopsy reports they generate.
Related: HIPAA rules for deceased patients
“Autopsy authorization laws vary significantly by jurisdiction. In the United States, autopsy laws originate from Old English common law, with local jurisdictions establishing policies that may require the pathologist to know the relevant statutes in their region,” explains the NIH article.
For instance:
From a medical standpoint, many pathologists and medical examiners consider autopsy reports to be medical records, regardless of their legal classification. According to David R. Fowler in Public Figures, Professional Ethics, and the Media, “The National Association of Medical Examiners has stated that ‘the performance of forensic autopsy is the practice of medicine,’” suggesting that autopsy reports should be treated as medical records with appropriate privacy protections.
However, these public interests must be balanced against privacy concerns and the potential for harm to survivors:
For families of the deceased, the release of detailed autopsy information can cause emotional distress. Intimate details about a loved one's medical conditions, physical state at death, or circumstances of death can be traumatizing when made public.
Elizabeth McCartha Jones, the mother of Sarah Jones, a camera assistant who tragically lost her life on the set of the film "Midnight Rider," voiced her distress over the publication of her daughter's autopsy details. In an open letter, she wrote: "I am totally stunned, I am totally appalled, and I am ashamed of the callous reporter who leaked the autopsy report of our daughter for the world to see."
The digital age has increased autopsy report privacy issues. What might have been available to individuals willing to make a trip to a county clerk's office can now, potentially, be sent around the globe in an instant. Once digitized, these records can be irretrievably stored and made searchable, forming a permanent digital record of sensitive medical details.
The permanent nature of digital records raises serious questions about whether laws passed in an era of paper records are adequate to protect privacy in the internet age.
Some jurisdictions are developing more balanced approaches to autopsy report privacy:
While changes in the law are gradual, medical examiners and coroners can adopt best practices reconciling privacy with public needs:
In most states, families cannot request changes to the report itself, but they may challenge its release in court under privacy or emotional distress grounds.
No, photos and videos are often subject to stricter privacy protections and may require a court order to access.
In public record states, journalists can often access autopsy reports without restriction, though access to graphic content may be limited.
HIPAA does not apply to unidentified individuals unless or until identity and related health information are established and held by a covered entity.
Some jurisdictions offer greater privacy protections for minors, especially when the cause of death involves abuse or sensitive circumstances.