Yes, doctor-patient confidentiality continues after death, but with important limits. Under federal law, HIPAA protects a deceased person’s health information for 50 years following the date of death. During that window, medical providers cannot freely share records just because a patient has passed away. However, the rules loosen in specific ways that allow certain people, including family members and legal representatives, to access information they otherwise couldn’t during the patient’s lifetime.
How Long Protection Lasts
The 2013 HIPAA Omnibus Rule set a firm boundary: protected health information remains covered for 50 years after the date of death. Before that change, HIPAA technically applied to deceased patients’ records indefinitely, which created confusion for healthcare providers, researchers, and families. The 50-year window was designed to balance privacy with practical needs. After that period expires, the information is no longer considered protected under federal law and can be disclosed without restriction.
That said, state laws can extend protection beyond what HIPAA requires. If a state regulation is more stringent than the federal rule, it takes priority. Some states impose tighter restrictions on sensitive categories like HIV/AIDS status, substance abuse treatment, and mental health records. In practice, though, few if any states currently protect health information for anywhere close to 50 years, let alone beyond it.
Who Can Access a Deceased Person’s Records
The person with the broadest access is the “personal representative,” a legal term under HIPAA for anyone authorized to act on behalf of the deceased or their estate. This typically means the executor or administrator named in a will or appointed by a probate court. A personal representative can access the full medical record to the extent it falls within the scope of their legal authority, and they can also authorize disclosure of that information to others.
Family members and friends who were involved in the patient’s care or payment for care before death also have access, but it’s narrower. Providers can share information with spouses, parents, children, domestic partners, other relatives, or close friends, as long as the disclosure is limited to details relevant to that person’s involvement in the patient’s care. A parent who accompanied their adult child to oncology appointments, for example, could receive information related to that treatment. But a distant relative with no prior involvement in care would not automatically qualify.
There is one important override: if the deceased person expressed a preference while alive that certain people not receive their health information, and the provider knew about that preference, the provider must honor it. A patient who explicitly told their doctor not to share records with a particular family member retains that protection after death.
Exceptions for Coroners, Law Enforcement, and Organ Donation
Several categories of disclosure don’t require any authorization at all. Providers can share a deceased patient’s health information with coroners and medical examiners to identify the person, determine cause of death, or carry out other legally authorized functions. Funeral directors can also receive necessary information.
Organ and tissue donation is another exception. Hospitals can disclose health information to organ procurement organizations without authorization from the patient’s family when coordinating deceased donation. Those organizations are expected to maintain confidentiality even though HIPAA doesn’t directly govern them. They typically sign agreements with hospitals promising to keep identifiable information confidential and use it only as needed for the donation and transplant process.
Psychotherapy Notes Get Extra Protection
Psychotherapy notes, the personal notes a therapist writes during or after a session, occupy a special category under HIPAA even for living patients. After death, these notes remain more tightly restricted than general medical records. Providers can disclose them without authorization only in narrow circumstances: for their own training, to defend against a lawsuit brought by the patient, for government compliance investigations, to address a serious and imminent public safety threat, for health oversight of the therapist, for lawful activities of a coroner or medical examiner, or when required by law.
State laws often add additional layers of protection for mental health records. If you’re trying to obtain a deceased loved one’s therapy records, you may face stricter requirements than you would for their general medical chart, depending on your state.
How to Request Records as a Family Member
If you’re the executor or administrator of the estate, the process is relatively straightforward. Contact the healthcare provider’s medical records department with a copy of the death certificate and documentation of your legal authority (such as letters testamentary from probate court). The provider is required to treat you as the patient’s personal representative and grant access accordingly.
If you’re a family member without that legal role but you were involved in the patient’s care, you can still request relevant records. Be prepared to explain your involvement. Providers have some discretion in these situations, and they may limit what they share to information directly related to your role in the patient’s care or payment. If you’re seeking records for your own health purposes, such as learning about a genetic condition that runs in the family, mention that specifically, as providers can take that into account.
Keep in mind that providers may be cautious. Many healthcare organizations default to requiring proof of personal representative status before releasing full records, partly because they want to respect any preferences the patient may have expressed and partly because navigating the overlapping federal and state rules can be complex. If you’re denied access and believe you’re entitled to it, requesting a formal review or consulting an attorney who handles health privacy law can help move things forward.