Blog: HIPAA FAQ Series: Does HIPAA Protect the PHI of Deceased Individuals?

Cooley LLP

In order to protect the privacy and security of patients’ information, the Health Insurance Portability and Accountability Act (HIPAA) imposes substantial obligations on covered entities (certain providers, plans, and health care clearinghouses), as well as their business associates.  These obligations can be intrusive and costly, and can require substantial investments in electronic systems and personnel.  Thus, many covered entities ask – when do these obligations terminate?  Specifically, are covered entities still required to safeguard the Protected Health Information (PHI) of deceased individuals?

Covered entities’ HIPAA obligations remain in full effect for a period of 50 years following the death of an individual.  This requirement is relatively new; it was put into place by the Final HIPAA Omnibus Rule passed in 2013, before which HIPAA obligations survived indefinitely.  In other words, for the 50 years after a patient dies, covered entities must continue to safeguard his or her PHI.  Such PHI may not be used or disclosed in a way prohibited by HIPAA, and in the event that an authorization is needed, such authorization must be signed by the individual’s personal representative.  If under applicable state law, an executor, administrator, or other individual has authority to act on behalf of a deceased individual or his or her estate, then that individual must be treated as a personal representative for purposes of information relevant to such personal representation.  Once 50 years have passed following a person’s death, his or her information is no longer subject to HIPAA and may be used by a covered entity for any purpose or disposed of, as the covered entity sees fit.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Cooley LLP | Attorney Advertising

Written by:

Cooley LLP

Cooley LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.