To protect your patient's protected health information (PHI), your practice should have a policy on the appropriate way to release medical records on current and past patients. An often-overlooked area is the release of deceased patients' records.

Posted in Risk Management on Friday, August 10, 2018

While HIPAA sets the federal minimum requirement for privacy, state regulations can be more stringent when it comes to releasing protected health information (PHI). For this reason, it is always wise to check with your attorney and/or state association regarding the release of deceased patients’ records. 

Having an established policy can improve the handling of the situation for all those involved. It is an important point to remember that only the designated personal representative or legal executor has the legal right to access the records. 

The HIPAA OMNIBUS Final Rule in 2013 set forth:

1. Privacy rights are suspended 50 years after the patient’s death, requiring no authorization for release:
   • State regulations may be more stringent than HIPAA in prohibiting release of PHI
   • Sensitive information: HIV/AIDS, substance abuse, mental health information and psychotherapy notes are subject to state or other laws that may provide greater protection
   • Covered entities (CE) may determine their own privacy protections after 50 years; however, they cannot justify them as being a HIPAA requirement
2. The 50-year rule is not a record retention requirement
   • CEs may destroy medical records consistent with the time periods of their state regulations or other applicable law requirements
3. Access prior to 50 years
   • The patient’s designated personal representative or legal executor of the estate has a right under law to access the records
   • Legal documents to establish the right to the records include:
     • Copy of the death certificate
     • Court document establishing executorship
     • Court order
   • If no designee is named by the decedent, state law will determine who processes the right to access
   • Individuals who had access to the records prior to death: 
     • Access is continued unless inconsistent with the expressed wishes of the decedent prior to death
     • Family members, relatives or others involved in the care or payment for the care of the decedent prior to death--unless inconsistent with the expressed wishes of decedent prior to death—have continued access
   • Reasonable assurance by the CE is necessary that any individual requesting records has a relationship to the decedent or offers sufficient details about the decedent’s circumstances prior to death to demonstrate involvement in decedent’s care and the relevance of the request
   • If a CE is uncomfortable with disclosing PHI under the provision due to questions about relationship to decedent, the CE is not required to provide PHI
   • Surviving family members who need the PHI of the decedent for their own healthcare treatment should be granted access to the deceased person’s records

For more information: http://library.ahima.org/doc?oid=106332#.VypaTlom7IU.

Please let us know if we can answer your questions about risk issues associated with releasing records.