Deceased Patient Medical Records: Stop Fine for Wrongful PHI Access

Your obligation to protect patient privacy doesn’t end when your patient dies — It just gets more complicated.

The tricky part is knowing who’s authorized to receive deceased patient medical records because mishandling them will create a financial nightmare for your practice.

HIPAA Rule for Deceased Patient Medical Records

The HIPAA Privacy Rule states that you must protect a deceased patient’s medical record for fifty years. Even though state rules differ on record destruction guidelines, that’s still a long time for you to have to monitor who’s authorized to receive patient medical records! Unfortunately, if you ever hand them over to the wrong person you could face massive fines.

So how do you respond to multiple phone calls from a deceased patient’s relatives calling for their PHI? Tread carefully and comply with HIPAA Privacy Rule. You are allowed to share a deceased patient’s PHI with a family member who:

was involved in the patient’s healthcare or payment for care, unless the patient specified otherwise before they died
is a legally authorized executor or administrator of their estate or a personal representative in regards to PHI

Under the HIPAA Privacy Rule the following individuals who are not family members can authorize the release of a deceased person’s PHI:

Another provider who is treating your deceased patient’s relatives
Executor or administrator to the estate
Someone with legal authority to act on behalf of the decedent or the estate, but not restricted to persons with authority to make health care decisions

Educate Patients to Designate a Personal Representative

There is a way you can help your practice maintain HIPAA compliance when it comes to protecting deceased patient medical records: Educate your patients on how to plan ahead for selecting individuals who can access their records if they die.

A personal representative is someone who can make medical decisions on a patient’s behalf and allowed access to patient records. If a patient dies but did not sign a HIPAA release or designate an executor to their estate, it’s up to the state to designate their personal representative.

You can help your patients prepare for an unfortunate situation with these suggestions:

HIPAA Authorization. Encourage patients to add a trusted family member or friend to their HIPAA authorization form. Remind them that this does not allow the individual the right to make medical decisions for them, but it gives your practice authorization to discuss their PMI with that individual.
HIPAA Power of Attorney. Encourage patients to designate a HIPAA power of attorney or health care proxy. This will allow the named person to be the patient’s personal representative, and aside from being given the authority to make healthcare decisions on patient’s behalf, they can also access patient medical records.
Emergency Contacts Have No Rights. Remind your patients that an emergency contact or a person responsible for payment will not be indicated as someone who is allowed to access their medical records.

Unfortunately, due to COVID-19, patients may find themselves separated from family members who are their designated advocates, at a critical time. That’s why now more than ever before it’s important for your patients to designate a personal health representative.

Get Expert Advice on Deceased Patient Medical Records

HIPAA privacy rule cites a personal representative as someone who’s authorized to act on behalf of the individual in making healthcare related decisions. But they aren’t the only ones granted authority in accessing a deceased person’s medical records.

Know your state laws: Different state laws govern the release of general and behavioral health medical records and how they define a personal representative.

There are so many factors to consider when disclosing deceased patient PHI. You can get help from medical records expert and healthcare attorney, Gina L. Campanella, Esq. During her 60-minute online training, she’ll provide strategies to help ensure you comply with related complex state and federal requirements and the HIPAA Privacy Rule. Protect your practice from financial and legal penalties related to the mismanagement of deceased patient medical records and sign up for Gina L. Campanella, Esq’s online webinar today!