Who has access to a deceased person's medical records?

Access to a deceased person's medical records is granted primarily to the personal representative of the estate, such as a court-appointed executor or administrator.

Under federal rules like HIPAA in the United States, health information is protected for 50 years after death, during which time only legally authorized individuals can access or authorize the release of these records.

Who Can Access the Records?

• Executor or Administrator: A court-recognized personal representative of the estate has the legal right to access the full medical records.
• Next of Kin / Surviving Family: If there is no formal executor or administrator, state laws often allow surviving spouses, adult children, parents, or siblings to request records, though specific rules vary by state.
• People Involved in Care: Family members or friends who were directly involved in the patient's care may receive limited, relevant information tied to that care, unless it violates a prior expressed preference of the deceased.
• Individuals with a Legal Claim: Someone who has a specific legal claim arising out of the death may be granted access to relevant portions of the record.
• Healthcare Providers: Doctors treating a surviving relative can access the deceased person's records if the information is necessary for the relative's treatment.

Required Documentation

To obtain copies, healthcare providers typically require:

• A certified copy of the death certificate.
• Proof of your identity (government-issued ID).
• Legal proof of your authority, such as Letters Testamentary, letters of administration, or an affidavit of relationship.

Family members can access a deceased person's medical records if they are the legally designated personal representative of the estate or if they meet specific, limited involvement criteria under U.S. Department of Health and Human Services (HHS) HIPAA Guidance.

General Access Rules

• Personal Representatives: An executor, administrator, or court-recognized fiduciary of the estate has the full legal right to access and request copies of the complete medical record. Under HIPAA, these protections last for 50 years after the date of death.
• Family Involved in Care: Family members or friends who were directly involved in the patient's care or payment for care can receive limited information relevant to their specific involvement. This is not a blanket right to the entire medical chart. It is only allowed if it does not conflict with any known, expressed preference of the deceased.
• State Laws: If no executor or administrator has been appointed, state-specific laws dictate which surviving family members (such as a surviving spouse, adult child, or parent) may request the records.

Required Documentation

To request records, healthcare providers typically require:

• A government-issued photo ID
• A certified copy of the death certificate
• Proof of legal authority (such as Letters Testamentary, Letters of Administration, or documentation showing you are the personal representative)
• Proof of relationship (such as a birth or marriage certificate) if applying under specific state next-of-kin provisions

A deceased person's medical records can be accessed primarily by their legally appointed personal representative (such as an executor or administrator of the estate) or by individuals authorized under specific state laws.

Who Has Legal Access

• Personal Representatives: The executor or court-appointed administrator of the estate stands in the patient's shoes under HIPAA and holds full access rights to the medical chart.
• Family Members and Next of Kin: Family members involved in the care or payment of the deceased prior to death may receive limited information relevant to their involvement, unless it violates prior expressed wishes of the deceased. Full record access for family members usually requires official personal representative status.
• State-Specific Successors: Certain states grant next-of-kin or estate distributees (like a surviving spouse or children) direct statutory rights to request records without a formal probate appointment.
• Special Entities: Coroners, medical examiners, and funeral directors have permitted access without authorization as needed to carry out their legal duties.

Required Documentation

• A certified copy of the death certificate.
• Proof of your identity (government-issued photo ID).
• Legal proof of authority, such as Letters Testamentary, Letters of Administration, or a small estate affidavit depending on state rules.

Under U.S. federal law, a deceased person's medical information remains protected under the HIPAA Privacy Rule for 50 years after the date of death.

However, the legal requirement for how long a healthcare provider must physically keep the actual records is different from how long federal privacy protections last.

Physical Retention vs. Privacy Protection

• Federal Privacy Protection (50 Years): Under HIPAA Rules, health information is protected as confidential data for 50 years post-death to safeguard family privacy and personal dignity. After 50 years, the data loses its protected health information (PHI) status under HIPAA, though other state or institutional privacy laws might still apply.
• Actual Record Retention (7 to 10+ Years): HIPAA does not require providers to store records for 50 years. Instead, actual physical storage timeframes are set by state laws. Most states require hospitals and physicians to retain adult medical records for 7 to 10 years from the last date of treatment or service (or longer if there is an active legal dispute). Once a state's mandatory retention period expires, providers are legally permitted to securely destroy the records, even if the 50-year HIPAA protection window has not closed.

Who Can Access the Records?

During the 50-year privacy window, a verified personal representative—such as the executor or administrator of the deceased person's estate—has the legal right to access the medical records. Family members who are not personal representatives may only receive limited information directly relevant to their involvement in the patient's care or payment.

The deceased person's estate is primarily responsible for paying any outstanding hospital bills after death.

The Deceased Person's Estate

• Estate assets: The executor or administrator of the estate uses the remaining money, property, and assets of the deceased to pay valid creditor claims during the probate process.
• Insolvent estates: If the estate does not have enough money to cover all debts, the hospital bills generally go unpaid, and the debt is written off. Family members do not have to pay out of their own pockets.

Exceptions Where Family Members May Be Responsible

Surviving family members are usually not personally liable for a relative's medical debt, but exceptions apply:

• Co-signers or guarantors: Anyone who signed admission paperwork or financial agreements taking personal responsibility for the medical treatment is accountable.
• Spousal liability: Surviving spouses may be responsible if they live in a community property state (such as California, Texas, or Washington) or a state with doctrine of necessaries laws that treat essential medical care as a shared marital debt.
• Filial responsibility laws: A few states have laws holding adult children financially responsible for a parent's unpaid medical or nursing care, though these are rarely enforced.
• Medicaid estate recovery: If the deceased received Medicaid services after age 55, the state may attempt to recover costs from the remaining estate.