Yes. Although HIPAA protects the medical information of a deceased patient for 50 years following death, the HIPAA Privacy Rule allows covered entities to disclose a deceased person’s PHI to family members and others involved in the person’s care or payment for care prior to his or her death, unless doing so is inconsistent with any prior expressed preference of the deceased person that the clinic is aware of.
Information released to these individuals should be limited to the minimum necessary for the purpose at hand, such as determining plan of care. If a complete copy of the patient’s record is requested, obtain written Authorization from the executor of the deceased patient’s estate. If there is no executor, the spouse may sign; if there is no spouse, the responsible family member who was involved in the care and treatment of the deceased may sign. (See HIPAA Policy 02, Personal Representatives, Paragraph C.)