HIPAA's protection of personal health information extends to individuals even after they pass away. This means that healthcare providers and organizations must continue to safeguard deceased patients' protected health information.
In the United States, HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. These entities are required to protect the protected health information (PHI) of patients, including those who have passed away.
The HIPAA Privacy Rule defines PHI as individually identifiable health information, which includes demographic information, medical history, and other health-related data. This definition applies to all individuals, regardless of their status as living or deceased.
HIPAA's protection of deceased patients' PHI is essential for maintaining their dignity and respecting their right to privacy.
Understanding HIPAA Protection
HIPAA protection doesn't stop at death. In fact, the same rules that apply to living individuals also apply to deceased patients. The HIPAA Privacy Rule continues to safeguard a person's health information after they pass away.
Covered entities, like healthcare providers and insurance companies, must maintain the confidentiality of a deceased person's PHI and ensure it's not disclosed or misused. This includes limiting access to those with a legitimate reason, such as legal representatives, family members, and healthcare providers.
The length of time PHI is protected varies by state, but most states require it to be kept for at least 50 years after death. Some states, like California and Minnesota, extend protection indefinitely as long as the records exist. This can be a long time, and it's essential to understand the laws in your state.
Here are the exceptions to the HIPAA Privacy Rule for deceased patients:
- To alert law enforcement to the death of the individual, when there is a suspicion that death resulted from criminal conduct
- For research that is solely on the protected health information of decedents
- To a family member or other person who was involved in the individual's health care or payment for care prior to the individual's death, unless doing so is inconsistent with any prior expressed preference of the deceased individual that is known to the covered entity
- With written consent from an authorized representative for disclosure to be permitted
It's crucial to understand these exceptions and take necessary precautions to safeguard a deceased person's PHI. This includes deactivating online accounts, using password protection, and securely storing physical records. By doing so, you can help maintain the privacy and dignity of the deceased individual.
Access to Medical Records
If a family member is being treated, a healthcare provider can disclose a deceased relative's PHI without authorization. This information is only given to the treating provider.
You can ask the healthcare provider who treated your deceased family member for access to their PHI. They can disclose it to you.
Family members, relatives, and friends of the deceased person might not have automatic access to the individual's PHI unless they can provide legal documentation. This documentation is necessary for HIPAA-covered entities to share the information.
Legal representatives of the deceased person are allowed access to PHI strictly for administration purposes. This means they can access the records for tasks like settling the estate.
Healthcare providers may also allow access to PHI for research and other purposes.
Exceptions and Limitations
HIPAA's rules for sharing information after death are more nuanced than you might think. While the rule allows covered entities to share information with family, relatives, friends, or those identified by the deceased person, there are specific guidelines to follow.
The information shared must be limited to what's necessary and respect any pre-existing wishes known to the covered entity. This means avoiding excessive or irrelevant information.
HIPAA violations can arise when sharing information with unauthorized individuals, revealing information the deceased didn't want disclosed, or sharing excessive information about the deceased.
Here are some examples of HIPAA violations to watch out for:
- Sharing information with unauthorized individuals.
- Disclosing excessive information about the deceased.
- Revealing information the deceased did not want disclosed.
Frequently Asked Questions
Does confidentiality apply after death?
Yes, confidentiality applies after death, and physicians have a duty to protect patient information even after passing. This means that personal information remains private, just as it was during the patient's lifetime.
What is the HIPAA breach notification rule for deceased people?
For deceased individuals, HIPAA breach notifications are sent to the next of kin by first-class mail. If a preferred electronic method was specified, notifications may be sent via email instead.
Does a HIPAA authorization expire at death?
No, a HIPAA authorization does not expire at death. However, the individually identifiable health information of a decedent is protected under HIPAA for 50 years following the date of death.
Sources
- https://www.physicianspractice.com/view/hipaa-and-posthumous-rights
- https://hipaasecuritysuite.com/does-hipaa-apply-after-death-everything-you-should-know/
- https://www.hipaaexams.com/blog/how-long-is-phi-protected-after-death
- https://www.360training.com/blog/hipaa-after-death
- https://compliancy-group.com/phi-protection-for-50-years-after-death/
Featured Images: pexels.com
