The journal article The spectrum of data sharing policies in neuroimaging data repositories explains, “Under the HIPAA, protected health information (PHI) is defined as individually identifiable health information that a covered entity holds or transmits.”

When a patient dies, understanding who is entitled to their information, especially their PHIand how it should be transmitted becomes paramount. Whether the request comes through email or is presented at the medical records desk, the process should not differ. Instructions on the process and, subsequently, records should be shared with the next of kin and other authorized parties in a consistent and secure manner.

 

HIPAA protection continues for 50 years

The law of open medical data: past application and future challenges states, “The HIPAA Privacy Rule protects a person’s PHI throughout their lifetime and ‘for a period of 50 years following the death of the individual’.” The Department of Health and Human Services (HHS) states that this period begins from the date of death. Once the individual has been dead for more than 50 years, their individually identifiable health information falls outside HIPAA’s definition of PHI.

The 50 years period does not mean that organizations have to keep every record for that entire time. The HHS provides guidance on how long a facility is permitted to keep records. Once the retention period is up, the state's laws within which an organization operates could permit it to get rid of the information. Staff should follow the organization’s retention policy rather than deleting records or emails simply because the patient’s status changed to deceased.

 

Confirm who has legal authority

The study Discordance in selected designee for return of genomic findings in the event of participant death and estate executor explains, “If a personal representative or estate executor is not explicitly designated, access to a person’s health records after death is based on state law.”

Anyone legally appointed to represent a decedent or their estate can serve as a personal representative. The HHS says that a personal representative may be able to use HIPAA rights on behalf of that. It would include having access to and authorizing disclosures. For any disclosures that would not be allowed under HIPAA, the HHS says they need to receive authorization from a personal representative that can authorize those disclosures.

An organization must have protocols in place to verify who the person is and their status with the patient. Informing them of what documentation is needed from them to send the records over and giving them instructions on how to provide it are a necessary step when it comes to sharing a deceased persons information with their personal representative.

When organizations have received authorization to release the information, staff should double-check where they will be sending the records and what records they are sending. Providing them with information in writing can help them understand the process, instead of calling each department to get information.

 

Family members may receive information relevant to their involvement

The study Patients’ Choices for Return of Exome Sequencing Results to Relatives in the Event of their Death notes, “covered entities are permitted, but not required, to disclose results to the family members.” HIPAA allows those who were involved in patients' care or bills prior to death. Any information they were involved in would fall under this. Staff would also have to honor any wishes the patient may have disclosed to them. This does not mean all family members can have access to a patient's whole chart.

For example, a daughter who helped manage her father’s care may request an explanation of that care. A friend who helped with payments may need information about the relevant charges. Staff should assess those requests separately. An email response can state what information staff can be released and give them someone to contact if they have more questions.

 

Some disclosures support duties following a death

The paper HIPAA and Access to Medical Information by Medical Examiner and Coroner Offices explains, “Moreover, HIPAA specifically allows disclosure to law enforcement, public health, and medical examiner and coroners.” These permissions allow release of information for certain situations.

Examples from the HHS Summary of the HIPAA Privacy Rule:

  • Coroners and medical examiners may receive information to identify a person, determine the cause of death, or perform other duties authorized by law.
  • Funeral directors may receive information needed to carry out their duties concerning the deceased.
  • Organ procurement and transplant organizations may receive information to facilitate organ, eye, or tissue donation and transplantation.
  • Law enforcement may be alerted to a death when criminal conduct is suspected.

HIPAA allows for this release of information without needing an additional release from family members. It is best to know what the information will be used for and when it can be released.

 

Research has a specific route for deceased patients’ records

The study Piloting a Deceased Subject Integrated Data Repository and Protecting Privacy of Relatives states, “Use of deceased subject records does not require full IRB review or patient consent.” There are some conditions that HHS states that organizations must meet when using HIPAA for research. The researcher will need to attest that they are only going to be using this information for the research purposes of descendants and that what is being asked for is what they need. Providing proof of death if needed.

It does not mean that researchers can share information that may contain descendants. There should be precautions to ensure living persons in the files are deidentified/removed or consent for disclosure is provided. Make sure the privacy dept is informed and does research. Once the assurance has been received, staff can share the information through our safe way of distribution.

 

Keep email safeguards in place

eHealth Cloud Security Challenges: A Survey explains, “Encryption is a technique that is used to scramble cleartext data into ciphertext with a key.” The core idea is that plain, readable data is converted into a coded state, only accessible again with the right key.

In the top 3 healthcare email attacks in 2025 and how to defend against them report by Paubox, states that recipients often willingly provided information that was confidential to what they believed was a trusted sender. It can apply if someone asks for a patient's records that have passed. It is always wise to thoroughly verify any odd requests for patient details. Staff should also verify the address and look through attachments and past emails. A recognizable sender name should not be the sole basis for releasing protected information.

With Paubox Email Suite, emails can be automatically encrypted through Google Workspace or Microsoft 365. It could allow employees to forget about encrypting emails when they are communicating with someone to whom they have decided to release information.

 

FAQs

Can a surviving relative’s doctor request information to help treat them?

Yes, HIPAA permits a provider to share a deceased patient’s relevant information with another provider treating a surviving relative without a separate authorization.

 

Does a medical power of attorney automatically give someone access after death?

No, the study on patients’ choices explains that authority held during life does not automatically establish personal representative status after death.

 

Does family history in my chart lose protection if my relative died more than 50 years ago?

No, HHS confirms that family history recorded as part of healthcare remains PHI.

 

Who receives a required breach notice if the affected patient has died?

When the provider knows the patient has died and has an address for their next of kin or personal representative, it must send that person written notice by first-class mail under HIPAA’s breach notification requirements.