How can family members of a deceased individual obtain the deceased individual's protected health information that is relevant to their own health care?

Answer:

The HIPAA Privacy Rule recognizes that a deceased individual’s protected health information may be relevant to a family member’s health care.  The Rule provides three ways for a surviving family member to obtain the protected health information of a deceased relative.  

First, disclosures of protected health information for treatment purposes—even the treatment of another individual—do not require an authorization; thus, a covered entity may disclose a decedent’s protected health information, without authorization, to the health care provider who is treating the surviving relative.  

Second, the Privacy Rule allows covered entities to disclose certain protected health information about a decedent to family members of the decedent, unless doing so is inconsistent with any prior expressed preference of the deceased individual that is known to the covered entity.  The information that may be disclosed is that which is relevant to the person’s involvement in the decedent’s care or payment for care.  

Third, a covered entity must treat a deceased individual’s legally authorized executor or administrator, or a person who is otherwise legally authorized to act on the behalf of the deceased individual or his estate, as a personal representative with respect to protected health information relevant to such representation.  Therefore, if it is within the scope of such personal representative’s authority under other law, the Rule permits the personal representative to obtain the information or provide the appropriate authorization for its disclosure.