HIPAA Training for Autopsy and Decedent Affairs Staff

When you handle autopsy records, decedent PHI, or requests about a deceased person, HIPAA’s special disclosure rules matter. These rules allow certain disclosures without an authorization, but the recipient and purpose must fit the applicable rule. Follow your organization’s policies and applicable state law, which may provide additional protections.

How long does HIPAA protect a decedent’s health information?

The HIPAA Privacy Rule protects identifiable health information about a deceased person for 50 years after the date of death. During that period, the information generally remains protected PHI, subject to specific permissions for disclosures about decedents. After 50 years, it is no longer PHI under this rule. See 45 CFR § 164.502(f) and HHS guidance on health information of deceased individuals.

The HIPAA Privacy Rule does not require you to retain records for 50 years. Record retention is governed by other applicable federal, state, and organizational requirements. HHS explains that the Privacy Rule does not set medical-record retention periods.

When may staff disclose information to coroners and medical examiners?

A covered entity may disclose PHI to a coroner or medical examiner to identify a deceased person, determine the cause of death, or carry out other duties authorized by law. A HIPAA authorization is not required for a disclosure that fits this provision. 45 CFR § 164.512(g)(1).

Before releasing records, confirm the requester’s identity and role, the stated purpose, and any applicable legal authority. Route uncertain, unusually broad, or disputed requests to your privacy officer or legal team. A request from someone who says they are a coroner or medical examiner does not, by itself, establish that every requested disclosure is permitted.

What information may be shared with funeral directors?

A covered entity may disclose PHI to a funeral director, consistent with applicable law, as necessary for the director to carry out duties concerning the decedent. If needed for those duties, the disclosure may occur before death when death is reasonably anticipated. See 45 CFR § 164.512(g)(2).

Confirm the funeral director’s identity and the purpose of the request. Share only information that is appropriate for the permitted duties, and consult your organization’s policy or privacy officer if the request appears broader than necessary or raises questions under state law.

How can a personal representative exercise a decedent’s HIPAA rights?

Under the personal representative rule in 45 CFR § 164.502(g)(4), an executor, administrator, or other person authorized under applicable law to act for a deceased person or the person’s estate must be treated as the personal representative for PHI relevant to that representation. The representative may exercise applicable HIPAA rights, such as requesting access or authorizing a disclosure within the scope of their authority.

Verify the person’s authority using your organization’s procedures and applicable state law. A family relationship alone does not necessarily establish personal-representative status. HHS guidance on personal representatives explains that authority depends on the law that applies and the role the person is authorized to perform.

When may staff share information with family or others involved in care?

HIPAA permits a covered entity to share relevant PHI with a family member or another person who was involved in the decedent’s care or payment for care before death. This permission applies unless the disclosure would conflict with a prior expressed preference of the deceased person that is known to the covered entity. See 45 CFR § 164.510(b)(5).

This permission is limited to information relevant to that person’s involvement. It does not give every relative an automatic right to the entire medical record. If the requester seeks broader access, determine whether they are a verified personal representative or whether another basis for disclosure applies. HHS explains the rule for disclosures to people involved in a decedent’s care or payment.

What other disclosures are permitted for law enforcement, research, and donation?

HIPAA permits a covered entity to alert law enforcement to a person’s death when it suspects the death may have resulted from criminal conduct. Other law-enforcement disclosures must meet the specific conditions for the applicable purpose; HIPAA does not create blanket access to a decedent’s records for investigators. See 45 CFR § 164.512(f).

For research solely on decedents’ PHI, a covered entity may rely on representations from the researcher that the requested use or disclosure is solely for research on decedents’ PHI and that the PHI sought is necessary for the research. The covered entity may request documentation of the individuals’ deaths. HHS guidance on HIPAA and research describes these requirements under 45 CFR § 164.512(i)(1)(iii).

A covered entity may also use or disclose PHI to an organ procurement organization or another entity involved in procuring, banking, or transplanting cadaveric organs, eyes, or tissue when the purpose is to facilitate donation and transplantation. See 45 CFR § 164.512(h).

How should staff verify authorization and document disclosures?

For each request, identify the requester, confirm their role and authority, and determine the specific HIPAA permission or authorization that supports the disclosure. If a personal representative is acting for the decedent, verify the authority under applicable law and your organization’s procedures. If the disclosure requires an authorization, confirm it is valid and was signed by someone with authority to act for the decedent.

Document the request and the basis for the disclosure according to organizational policy and applicable requirements. Record relevant details, such as the requester, purpose, authority or authorization reviewed, information disclosed, date, and staff member handling the request. Apply the minimum-necessary standard where it applies, and escalate unclear requests rather than relying on assumptions about family status or official role.

In practice, protect decedent PHI for the HIPAA Privacy Rule’s 50-year period, verify each requester and disclosure basis, and limit releases to what the applicable permission allows. When a request is uncertain, pause and consult your privacy officer or legal team.

FAQs

How long does HIPAA protect a deceased person’s health information?

HIPAA protects identifiable health information for 50 years after the person’s death. The Privacy Rule does not require records to be retained for that entire period; other applicable requirements determine retention.

Can staff disclose a decedent’s PHI to a medical examiner?

Yes. A covered entity may disclose PHI to a medical examiner to identify the deceased person, determine the cause of death, or perform other duties authorized by law. Verify the requester and purpose, and follow organizational procedures.

Who may exercise a decedent’s HIPAA rights?

An executor, administrator, or other person authorized under applicable law to act for the deceased person or the person’s estate may be treated as the personal representative for PHI relevant to that representation. Verify the person’s authority; being a relative does not automatically establish this role.

Can relevant information be shared with family members after a death?

Yes. A covered entity may share information relevant to a family member’s or another person’s involvement in the decedent’s care or payment for care before death, unless doing so conflicts with a prior expressed preference of the deceased person that is known to the covered entity.