Medical Records After Death: HIPAA Rights, Requests, and Deadlines

Medical records after death remain protected by HIPAA for 50 years, but the right people can request them right away. The estate’s personal representative — usually the executor named in a will or an administrator appointed by a probate court — has the same access rights the patient had while alive. Family members who were involved in the patient’s care can receive information relevant to that involvement, but not the whole file. If you need the records, the sooner you ask the better, because retention laws let providers destroy files long before the 50-year privacy window closes.

Who Can Request a Deceased Person’s Records

The Personal Representative

The person with the broadest access is the deceased’s “personal representative” under HIPAA. That’s whoever has legal authority to act on behalf of the deceased or the estate, most commonly an executor named in a will or an administrator appointed by a probate court.¹ Unlike personal representatives for living patients, the authority here is not limited to healthcare decisions. An executor handling only financial matters still qualifies.

A personal representative steps into the shoes of the deceased for HIPAA purposes. They can request the full medical record, authorize disclosures to third parties like life insurance companies or attorneys, and file complaints if a provider refuses access.² This is the pathway that matters most for settling estates, pursuing wrongful death claims, or processing life insurance benefits.

A provider can deny a personal representative’s request on narrow grounds. If a licensed healthcare professional determines that giving the representative access is reasonably likely to cause substantial harm to another person, the provider may refuse. That denial is reviewable.³

Family Members Involved in the Patient’s Care

HIPAA also allows providers to share a deceased patient’s information with family members or others who were involved in the patient’s healthcare or payment for care before death. This can include a surviving spouse, adult children, parents, domestic partners, or close friends who helped manage the patient’s care.⁴ The information must be limited to what’s relevant to that person’s involvement.

This is a narrower right than what a personal representative gets. A family member under this provision can receive information tied to the care they helped with, but they can’t authorize disclosures to outside parties or demand the complete record. For full access, someone typically needs to be appointed as the estate’s personal representative through probate.

When the Deceased’s Prior Objection Blocks Disclosure

One exception catches people off guard. If the deceased told their healthcare provider before dying that they did not want certain information shared with a particular family member, the provider must honor that preference.⁴ The preference does not need to be in a formal legal document. A verbal instruction to a nurse, if documented or known to the provider, is enough. This restriction applies to family-member disclosures. It does not override the rights of a court-appointed personal representative acting for the estate.

How to Request the Records

Start with the medical records department of the hospital, clinic, or provider that treated the deceased. Most facilities have their own request forms. You will generally need to provide:

A certified copy of the death certificate, proving the patient has died and establishing the date of death.
Proof of your legal authority. For an executor or administrator, that means letters testamentary or letters of administration from the probate court.¹
An affidavit of heirship, if no formal estate has been opened. Some providers accept a sworn affidavit establishing your relationship to the deceased and your right to access the records. Acceptance varies by provider and state.

Identify the patient by full legal name, date of birth, and the approximate dates of treatment. Being specific about which records you need speeds things up.

Electronic Copies and Fees

You have the right to request records electronically. If a provider maintains records electronically, HIPAA requires them to provide an electronic copy in the format you request, as long as they can readily produce it that way. If not, you and the provider can agree on an alternative readable electronic format.⁵

For electronic copies, providers have three options for calculating fees: actual costs per request, a schedule based on average costs, or a flat fee of no more than $6.50 per request covering all labor, supplies, and postage.⁶ If a provider fulfills the request through the view-and-download feature of their certified electronic health record system, they cannot charge you at all.⁵ Providers cannot add charges for searching, retrieving records, verifying your identity, or maintaining their systems.

Paper copy fees are governed by state law and range widely. Some states cap charges under $0.50 per page, others allow more than $1.00, often with separate administrative or search fees on top. If a bill seems high, ask for an itemized breakdown and compare it to your state’s fee schedule.

How Long the Provider Has to Respond

A provider must respond within 30 calendar days. If the records are stored offsite or the request is otherwise difficult to fulfill, the provider can take one 30-day extension, but must notify you in writing during the first 30 days with the reason and a firm date.⁵ The absolute maximum is 60 calendar days from your request.

If a provider denies your request or ignores it, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). The complaint must be filed within 180 days of when you learned about the violation, though OCR can extend that deadline for good cause. You can file by mail, fax, email, or through the OCR online complaint portal.⁷ The provider cannot retaliate against you for filing. Anonymous complaints are not investigated, so include your contact information.

Don’t Wait: Records Can Be Destroyed Before Privacy Rights Expire

HIPAA protects a deceased person’s health information for 50 years after the date of death.⁴ That rule governs how information must be treated if it still exists. It does not require anyone to store records for 50 years, and actual retention rules are much shorter.

Hospitals participating in Medicare must retain medical records for at least five years.⁸ State laws typically set their own minimums, ranging from about five to eleven years measured from the date of the patient’s last treatment, discharge, or death. Most states land around seven or ten years. Records involving minors often must be kept longer.

Once the retention period expires, providers can legally destroy the records. If you wait too long after a death, the file may no longer exist even though HIPAA’s privacy protections technically still apply. Request copies as soon as you have legal authority, especially if you may need the records later for insurance claims, litigation, or family health history.

Substance Use Disorder Records Have Stricter Rules

Federal regulations under 42 CFR Part 2 impose tighter restrictions on records from substance use disorder treatment programs, and those restrictions survive the patient’s death. Any disclosure identifying a deceased person as having had a substance use disorder remains subject to Part 2’s consent requirements, with one exception: information related to the cause of death can be shared without consent when required by vital statistics laws or permitted for cause-of-death inquiries.⁹

For any other use of Part 2-protected records, the personal representative of the deceased must provide written consent.⁹ If you’re trying to access a deceased relative’s substance use treatment records, expect the provider to require proof of your authority as personal representative before releasing anything beyond cause-of-death information.

When the Provider’s Practice Has Closed

Tracking down records from a doctor who retired, a clinic that shut down, or a hospital that merged is one of the harder parts of this process. Closing practices are supposed to notify patients in advance and appoint a custodian to hold the records, but that doesn’t always happen cleanly.

Start with the state medical board where the provider was licensed. Board offices often know where a closed practice transferred its records. From there, try the provider’s former office location to see if a new practice occupies the space and inherited the files. Your insurance company may have claims data that helps reconstruct treatment history. Labs and imaging centers that ran tests for the deceased keep their own copies of results and can provide those directly. If you believe a covered entity is improperly withholding or failing to maintain records, you can file a complaint with OCR.⁷

Disclosures That Don’t Require Family Permission

Not every disclosure of a deceased patient’s records goes through the estate. HIPAA permits providers to release information on their own to coroners, medical examiners, and funeral directors carrying out their duties, and to law enforcement when the provider suspects the death resulted from criminal conduct.⁴ Providers may also comply with court orders and qualified subpoenas in judicial proceedings such as wrongful death or medical malpractice cases. For anything outside these permitted categories, the provider needs written authorization from the personal representative, which is why life insurance companies routinely ask the estate to sign a release before processing a claim.

1
HHS.gov. Personal Representatives
2
HHS.gov. Personal Representatives
3
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
4
U.S. Department of Health & Human Services (HHS). Health Information of Deceased Individuals
5
U.S. Department of Health & Human Services (HHS). Individuals’ Right Under HIPAA to Access Their Health Information
6
HHS.gov. Is $6.50 the Maximum Amount That Can Be Charged
7
U.S. Department of Health & Human Services (HHS). How to File a Health Information Privacy or Security Complaint
8
eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services
9
eCFR. 42 CFR 2.15 – Patients Who Lack Capacity and Deceased Patients