OCR Proposes Change in Disclosure of Deceased Patient Records
A small provision in the recently released draft modifications to the HIPAA privacy rule could have a big impact for families and caregivers seeking the health records of deceased patients.
Section 164.510(b) of the proposed regulation would allow covered entities to disclose protected health information to family members and others who were involved in an individual’s care or payment for care, regardless of whether the patient (or the state) has named them a personal representative.
Obtaining the records of decedents has been a frustration for many people, and managing the interplay of federal and state law has been a challenge for many HIM departments. As Journal writer Chris Dimick described in a story last year, HIPAA states that people have the same privacy rights in death as they do in life, but it also requires that covered entities must release medical records to those people either appointed by the patient or who are deemed a personal representative by state law.
Complications occur when a patient dies without having named a personal representative. In those instances, HIPAA defers to state law to determine access rights.
The Office for Civil Rights, which authored the draft modifications, has been aware of the situation. It writes, “We have heard concerns that family members, relatives, and others, many of whom may have had access to the health information of the deceased individual prior to death, have had difficulty obtaining access to such information after the death of the individual, because many do not qualify as a “personal representative” under §164.502(g)(4) [of HIPAA].”
OCR is proposing to amend HIPAA to permit covered entities to disclose a decedent’s information to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.
Such disclosure would be permitted, but it would not be required. The modifications would not change the authority of a personal representative with regard to the decedent’s protected health information.
OCR requests comment on any unintended consequences that the new provision may cause. Comments are due by September 13, and instructions for commenting are found on page 40868 of the published rule.
In a related modification, OCR proposes that protected health information status be removed from the records of patients who have been deceased more than 50 years.