Does HIPAA Apply after Death?
With regards to the question does HIPAA apply after death, the Privacy Rule states: “A covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.” (§164.502(f)).
This standard means that HIPAA applies after death for fifty years following the death of an individual, during which time the Protected Health Information (PHI) of the individual is subject to the same restrictions on uses and disclosures as if the individual were alive. However, there are some circumstances in which different standards apply to the PHI of a deceased individual.
The first of these is a unique circumstance in which “a covered entity may disclose protected health information about an individual who has died to a law enforcement official for the purpose of alerting law enforcement of the death of the individual if the covered entity has a suspicion that such death may have resulted from criminal conduct.” (§164.512(f)(4)).
The second circumstance relates to obtaining an authorization to use or disclose PHI for a purpose not permitted by the Privacy Rule within 50 years of the individual’s death. In this case, an authorization must be obtained from the individual’s personal representative. This is not always the next of kin and could be an executor or another person indicated by the individual.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A further circumstance in which different standards apply to the PHI of an individual is when a covered entity or business associate experiences a notifiable data breach. In this case, it is impossible to notify the affected individual, and breach notifications must be sent to the individual’s personal representative as well as HHS’ Office for Civil Rights.
How Does HIPAA Apply after Death to PHI?
HIPAA applies to PHI after death for fifty years the same way as HIPAA applies to PHI when an individual is alive. This means that the individual’s health, treatment, and payment information – along with any information that could identify the individual – must be protected against unauthorized access and impermissible disclosures for as long as it is retained.
This does not mean PHI has to be retained for 50 years after death. Each state has medical record laws stipulating how long PHI must be retained. In most cases, PHI must be retained for between three years and ten years following an individual’s death, unless the individual is a minor at the time of their death or a special circumstance exists.
However, when disposing of PHI, it is important for covered entities and business associates to follow the guidance published by HHS’ Office for Civil Rights. The guidance relates to both paper and electronic PHI and advocates that members of the workforce receive HIPAA training on the disposal of PHI to prevent unauthorized access and impermissible disclosures.
If PHI is not disposed of within 50 years, the answer to how does HIPAA apply after death to PHI is different. This is because the definition of PHI in §160.103 excludes individually identifiable health information “regarding a person who has been dead for more than 50 years”. This means individually identifiable health information is no longer protected after 50 years and so HIPAA does not apply.
Why it is Important to Know When HIPAA Applies
It is important to know when HIPAA applies to PHI to prevent inadvertent disclosures of PHI and to prevent non-health information that does not have protected status from being unnecessarily secured. While it may not matter if non-health information is unnecessarily secured once an individual has died, unnecessary security precautions can affect healthcare operations and create potential security issues while individuals are alive.
Covered entities and business associates who are unsure about when HIPAA applies to PHI are advised to seek compliance advice.
