HIPAA protects medical information for 50 years from the date of death. Releases may be made only with appropriate Authorization.
If under applicable law, there is an executor, administrator, or other person having authority to act on behalf of a deceased individual or of the individual’s estate, that individual must be treated as the personal representative of the deceased, with respect to PHI. The court document appointing the individual as an executor or administrator is known as the Letters Testamentary or Letters of Administration and should be signed by a judge.
Under Oklahoma law, the following individuals have authority to act as a personal representative if there is no executor or administrator appointed: the spouse of the deceased or, if no spouse, any responsible family member of the deceased. A responsible family member is a parent, adult child, adult sibling, or other adult relative of the deceased who was actively involved in providing or monitoring the care of the deceased, as verified by the doctor, hospital, or other medical institute that was responsible for providing care and treatment of the deceased.
Therefore, in order to respond to requests for the PHI of deceased individuals:
We must have documentation conferring personal representative status on the individual making the request for PHI. (Please see “Procedures” below from the HIPAA Policy on Representatives.)
If there is no such representative, we must have a written statement from the individual (or his representative) seeking the PHI that there is not a court appointed representative or executor appointed for the estate of the deceased.
If we have documentation that no personal representative of the deceased individual has been appointed, then any responsible family member of the deceased, as defined by Oklahoma law, (see Statue References below) can request the records.
PROCEDURES
1. University Personnel must review a copy of the document conferring personal representative status to ensure the personal representative’s authority is not limited in scope or time and to ensure it meets the requirements described above. Any questions regarding the validity of a document purporting to confer personal representative status must be directed to the Office of Legal Counsel.
2. University Personnel must verify the identity of the individual requesting Protected Health Information if the individual is not known. (See Verification of Identity Policy.)
3. A copy of the written document appointing a person as the personal representative of a patient should be placed in the patient’s medical record as verification of the individual’s authority.
