Health Information Compliance Alert

Question: Our practice treated a patient who passed away two years ago, and now we are treating the decedent’s adult daughter. When the patient was alive, he was adamant that we not discuss his medical information with his family members. But recently, the daughter has asked for information about her father’s medical conditions. Now that the patient is deceased, can we share his health information with his daughter?

Answer: Under the HIPAA Privacy Rule, the rule-of-thumb for deceased patients’ protected health information (PHI) is that you must protect the PHI for a period of 50 years following the patient’s date of death. But this privacy protection can get a little more complicated when it comes to disclosing PHI to the decedent’s family members.

The HHS Office for Civil Rights (OCR) states:

“With respect to family members or other persons involved in the individual’s health care or payment for care prior to the individual’s death, but who are not personal representatives, the Privacy Rule permits a covered entity to disclose the relevant protected health information of the decedent to such persons, unless doing so is inconsistent with any prior expressed preference of the deceased individual that is known to the covered entity.”

So, OCR says that you cannot disclose the deceased patient’s PHI to his daughter, because the patient had expressed that he did not want his medical information disclosed to his family members before he passed away.

What to do: In this situation, you would need to obtain a written HIPAA authorization form signed by the decedent’s personal representative — “an executor, administrator, or other person who has authority under applicable state or other law to act on behalf of the decedent or the decedent’s estate,” OCR states.

Resources: For more instruction on the health information of deceased individuals under the HIPAA Privacy Rule, visit www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/decedents.html. Also, you can get guidance on personal representatives at www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/personalreps.html.