Making HIPAA Work for You: Discussing Record Access (and More) for Consumers

The US Department of Health and Human Services (HHS) has taken many steps to try and clear up consumer confusion regarding the more consumer-centric aspects of HIPAA’s Privacy Rule and Security Rule. The most recent efforts include the Office of the National Coordinator’s Patient Engagement Playbook. But confusion still lingers about patients’ rights. The Journal of AHIMA has enlisted the help of Barry S. Herrin, CHPS, FAHIMA, FACHE, an attorney based in Atlanta, GA, who specializes in HIPAA law, privacy and security, as well as healthcare fraud and other healthcare topics, to help clear up some common questions the Journal receives from readers.

Picture of surgeon during disciplinary meeting with medical director

1. Requesting Records of Deceased Adults

My mother died while undergoing a routine procedure and my family has received conflicting reports about what happened. We’re wondering if she had an allergic reaction that contributed to her death. Do we have a right to view her medical records to see if something wrong happened?

Regardless of how the requestor and an adult patient are related— be it fianceé, spouse, parent—they remain a stranger in the eyes of the law. Adult children can’t obtain their parents’ medical records unless they have been named in an advance directive prior to their parent’s death. Requestors can petition the court and file forms that will grant them status as an appointed administrator or executor or some similar title after the patient’s death, and this may afford access to the records.

2_August Slide Show

2. Processing Fees

If a requestor has paid for copies of medical records but cancelled prior to receiving them, by law, do they receive the entire amount back? My organization has a prepay basis and the work has been done to send the records. I would like to keep a processing fee. Is that allowable?

HIPAA doesn’t let you keep a processing fee. You couldn’t charge one up front, so you couldn’t keep one on the back end.

Young woman professional speech and language therapist working with cute little girl, showing her how to better telling some words and letters.

3. ROI For Minors

My (minor) daughter is changing speech therapists here in California. The former speech therapy office will only provide a copy of her initial assessment, even after I requested (in writing) a copy of either 1) her latest evaluation or 2) recent progress notes. Under HIPAA, I believe I have a right to her medical records, correct?

The parents in this case are most likely entitled to copies of the records they’re asking for, unless (1) the doctor’s office has a reasonable suspicion that the child is being abused, or (2) California has unusually restrictive regulations.

"Naples, USA - January 1, 2012: A picture of an old man fishing on the beach."

4. ROI For Guardians

My uncle moved from Ohio to Florida and is having difficulty getting records sent to Florida doctors. His son has power of attorney. The Ohio office refused, stating the patient must be present. Not possible. Technically he should only have to fill out a record request at the Florida office and have the Florida office submit to the Ohio office and that should be the end of it. What are you to do then?

HIPAA would require the Ohio physician to provide a copy of the record at least to the son, if not to the Florida doctor for continuity of care. The Ohio physician should (probably can) require that the son provide a copy of his driver’s license that shows his signature, in order to verify his identity on the power of attorney. If the uncle is still competent, his own authorization should be sufficient. But if the uncle is incompetent, then the son needs to go down to Florida and get appointed as his guardian. Guardianship papers should be sufficient to release the records.

Medical History form and a doctor's Stethoscope end thermometar on gradient background

5. Request for Restrictions

Is there a means of restricting information that a doctor releases? For example, I am leaving my primary care for another, I would like to prevent the previous physician from giving out my records after I leave?

Yes. If the patient pays 100 percent of the provider’s billed charges, then HIPAA would allow the patient to restrict that information from an insurance company. The patient can also restrict the provider from giving patient information to otherwise authorized persons by making the request in writing; however, the provider is not necessarily bound by that request. And, if the provider thinks the patient is going to restrict disclosure for purposes of committing benefit fraud, then the provider can refuse to agree.

Young man telling gossips to his woman colleague at the office. Intrigues and wasting time concept

6. Disclosure of Sensitive Medical Information

In January 2012 I had STD [sexually transmitted disease] tests done at the local hospital. The clerk (who he now lives with) who checked me in told my husband what tests I had done. He confronted me to ask the reason for the tests. Do I have any recourse?

Unless there’s some state law that allows spouses to get information on each other, the disclosure is most likely a HIPAA violation. In most states there isn’t a spousal privilege. However, it may not be this simple. Many facilities have conditions of admission that say, “I authorize you to release information to a person who may be responsible to all or any portion of the charges that I incur.” If the spouse is a dependent on the husband’s medical benefit plan, he may be entitled to receive a copy of the information that would reveal what tests were done (if not the results).

Woman receiving bad news on smartphone. Image taken with NIKON D800 camera system and developed from camera RAW.

7. ROI in an Emergency

Is this a HIPAA violation: A person at a facility that I was being treated at was worried I was going to commit suicide, and couldn’t get a hold of me or my wife. So they called my employer and said that I was suicidal. My boss called my wife and asked if everything was okay. My doctor told me I have a good legal case. Do I?

That might or might not be a problem under federal law—you’d have to look at the specifics of that. And there’s probably state behavioral health law that would apply in this circumstance. But, it could’ve been interpreted as an emergency and the facility was simply trying to find anyone that could help. Juries are sympathetic to people who try to do the right thing most of the time.

Questions about Accessing Records of the Deceased Persist

In what is perhaps a symptom of consumer confusion about HIPAA, the Journal of AHIMA’s website frequently receives reader queries about whether they are victims of HIPAA violations.

Two archived articles in particular continue to draw comments and questions three and five years after they were initially published: “Who Has Rights to a Deceased Person’s Records,” and“Accessing Deceased Patient Records.”

To help answer some of the lingering questions readers have, the Journal spoke with Barry S. Herrin, CHPS, FAHIMA, FACHE, an attorney based in Atlanta, GA, who specializes in HIPAA law, privacy and security, as well as healthcare fraud and other healthcare topics. Herrin provided responses for the questions used in the above slideshow, as well as providing context and insight for some frequent themes in questions posed in response to Journal articles.

The Records of Deceased Adults

In the slideshow, scenario #1 is representative of dozens of similar examples in which family members are seeking to obtain the records of someone who has died. Some other examples include:

“I was wondering if I can obtain copies or gain access of treatment and psychiatric treatment records and physician records for my deceased fiancé. We have a year and a half old daughter together and he took his own life just over a month ago. He never appointed anyone to be his representative.”

“My 21 year daughter passed away in January in San Francisco. She was student at a university there. She lived and had a job there. She was not married, has no children neither does she own land or any other property. We have her clothing and other personal items. How can we as her parents get her medical records?”

“My mother died recently of pancreatic cancer. I requested her medical records from the doctor’s office, I was just notified by their office that they were advised not to release any medical records to me or the insurance company, without a court order signed by a judge, per their legal department. What do I have to do go get these records?”

Herrin says that in all of these examples, the record requestors overestimate the extent to which their relationship to the deceased affects their rights to the records.

“Dead adults are problematic. I don’t care how much you love them and how close your connection was, if they’re an adult when they die, and you don’t have a piece of paper that says you’ve got rights to get access to their stuff, the law does not care,” Herrin says.

For an individual to gain access to another adult’s medical records, as Herrin notes in the slideshow, they must file a petition with the court to become a personal representative of the estate.

This can be done in a probate court or other court of appropriate jurisdiction, and the requestor must be able to provide documentation proving their relationship to the deceased. And this isn’t necessarily a lengthy process.

If the person who’s asking for access is the sole heir, or their name is in the will, “I can get them letters of administration within a day. I just have to go to the probate court, file the forms, get them on oath, get the order and off they go. But they’ve got to do their homework. That’s the problem. People do not do their homework,” Herrin emphasizes.

The US Department of Health and Human Services has released guidance targeted to consumers covering these types of questions, which Herrin says are written for a sixth grade reading level.

“The problem is the regulations are so difficult to navigate that even if you write it at a sixth grade level it still doesn’t help because you have to look at three or four different regulations, and you’ve got the problem of state law being more restrictive,” Herrin says.

Much of this confusion could be pre-empted if families were more proactive about discussing end of life issues. State bar associations can also provide guidance in these matters.


**Editor’s Note: The materials in this article are for informational purposes only and not for the purpose of providing legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem. Use of and access to this article does not create an attorney-client relationship between any attorney and the user or browser. The opinions expressed at or through this site are the opinions of the individual author and may not reflect the opinions of any individual attorney.

Mary Butler is the associate editor at The Journal of AHIMA.


  1. I would like to get my father medical records, his death was 2/19/1986 and most of his doctors said they destroyed all records. Do you know if I can get any records

    Post a Reply
  2. Before my mother died March 2018, she shared with my sister and I that she gave birth to a son May 1968. My sister and I are now looking for our half-brother. She stayed in the Booth Memorial Home for a month before giving birth that May in a maternity hospital. I have contacted the maternity home and they said they do not keep hospital records. Do you know if there is a way to obtain those maternity records for my mom? Any advice?

    Post a Reply
  3. My partner passed 3/1/19 from cardic arrest.had ins with globe life. The police was less than 2 yrs old. Globe needs med records to complete the claim. But the hospital will not release them. He has no living relative’s
    What do I need to do

    Post a Reply
  4. Hey what if my father died due to a wrongful act by the hospital and doctor how can i get his medical records after 2 years?

    Post a Reply

Submit a Comment

Your email address will not be published. Required fields are marked *

Share This

Share This

Share this post with your friends!