February 13, 2013
DISCLOSURE OF DECEASED PERSON'S MEDICAL RECORDS
By: James Orlando, Associate Analyst
You asked (1) whether patient confidentiality rights continue after death and (2) if so, could the legislature change this?
Under federal law, the confidentiality of patient health information generally continues after the patient's death. The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) “privacy rule” generally prohibits health care providers and other covered entities from disclosing a decedent's protected health information to anyone other than the decedent's personal representative. The personal representative could then choose to keep the information confidential.
There are certain exceptions to the privacy rule—situations where covered entities are allowed to disclose information without the person's authorization. Some of these exceptions tie in to requirements in state law. Thus, while the General Assembly cannot alter the HIPAA requirements, there could be situations where a change in state law would affect the permissibility under HIPAA of the disclosure of a deceased person's health information.
Recent amendments to the privacy rule (1) limit the period for which covered entities must protect health information to 50 years after the person's death and (2) expand the circumstances under which someone
who was involved in a person's care or payment for care (but who is not the personal representative) can access the person's medical information after the person's death.
HIPAA and its regulations are complex, and whether a particular disclosure is authorized under HIPAA depends upon several factors. The U.S. Department of Health and Human Services (HHS) website has a detailed summary of the privacy rule: http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html.
There are also state laws that affect the confidentiality of a patient's health information after death. Subject to certain exceptions and conditions, a patient's communications with physicians, psychologists, psychiatrists, and certain other health care providers are privileged and cannot be disclosed without the patient's consent. If the patient is deceased, his or her authorized representative would have to authorize the disclosure. The state could amend these statutes to modify the circumstances under which the person's authorized representative could assert the privilege after the person's death. Any such amendments would have to comply with HIPAA.
In general, HIPAA preempts contrary state laws that provide less protection for individual health information. The HHS website has more information on when HIPAA preempts state law: http://www.hhs.gov/hipaafaq/state/399.html.
HIPAA PRIVACY RULE
HIPAA's privacy rule limits the circumstances under which health care providers and other covered entities can use or disclose a person's protected health information (which generally includes information that can identify an individual and relates to his or her medical conditions, health care services, and related payments). “Covered entities” include (1) health care providers who electronically transmit health information in connection with certain transactions, (2) health plans (such as insurers, HMOs, Medicare, and Medicaid), and (3) health care clearinghouses (45 C.F.R. § 160.103). In practice, most health care providers are subject to HIPAA.
The privacy rule specifies when covered entities must obtain a patient's authorization before releasing his or her protected health information. In those circumstances in which covered entities can release protected health information without the patient's authorization, they generally must limit the release of information to the minimum amount necessary to accomplish the intended purpose of the disclosure (there are some exceptions, such as disclosure to a health care provider for treatment) (45 C.F.R. § 164.502(b)).
HIPAA's privacy rule generally applies to a deceased person's health information to the same extent as to a living person's information. If HIPAA would require a person's authorization for the release of the person's protected health information and the person is deceased, the covered entity must generally obtain the authorization of the deceased person's personal representative before releasing the information (45 C.F.R. § 164.502(f), (g)).
Under HIPAA, a decedent's personal representative is the executor, administrator, or other person with authority to act on behalf of the decedent or the decedent's estate (45 C.F.R. § 164.502(g)(4)). State law determines who has authority to act on behalf of an estate – in Connecticut, an executor or administrator.
Under state law, an executor is someone named in the will to handle the person's estate. If a person dies without a will, the probate court appoints an administrator to handle the estate, after an application and hearing. The law sets a priority for appointment of an administrator (e.g., surviving spouse; then a child or the child's guardian; etc.) (CGS § 45a-303).
There are certain exceptions to the privacy rule—that is, situations where a covered entity can disclose protected heath information without the authorization of the person or his or her representative. For example, the privacy rule permits disclosure of protected health information for treatment, payment, and health care operations, under specified conditions (45 C.F.R. § 164.506).
HIPAA provides special protection for psychotherapy notes. Covered entities must obtain authorization to use or disclose psychotherapy notes, except for (1) use in the person's treatment or (2) certain narrow exceptions (such as in a legal proceeding against the covered entity or to avert a serious and imminent threat to public health or safety) (45 C.F.R. § 164.508(a)(2)).
The privacy rule also permits disclosure of protected health information without the patient's authorization, subject to various conditions and limitations, for 12 national priority purposes — categories where disclosure is permitted due to the important uses for such information in contexts outside of health care. Such categories include, among other things, (1) disclosures required by law, (2) public health activities, (3) health oversight activities, (4) judicial and administrative proceedings, (5) law enforcement purposes, (6) research, and (7) serious threats to health or safety (45 C.F.R. § 164.512).
Some of the exceptions to the privacy rule would likely only apply to a patient who was still alive, while others could apply to a deceased patient. There are also some that apply specifically to the deceased. For example, covered entities may disclose protected health information to (1) funeral directors as necessary for them to carry out their duties, consistent with applicable law and (2) coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other duties authorized by law (45 C.F.R. § 164.512(g)). Covered entities may also disclose protected health information about someone who has died to a law enforcement official for the purpose of alerting law enforcement of the person's death if the covered entity suspects that the death may have resulted from criminal conduct (45 C.F.R. § 164.512(f)(4)).
The privacy rule establishes various conditions for researchers who seek protected health information. For example, if someone requests a deceased person's protected health information for research purposes without the personal representative's authorization, the researcher must provide the covered entity with representations that the (1) use or disclosure being sought is solely for research on the protected health information of decedents and (2) information being sought is necessary for the research. The researcher must also provide documentation of the person's death if the covered entity requests it (45 C.F.R. § 164.512(i)(1)(iii)). HHS's website has more information on requirements for researchers: http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/research.html.
For more information on those situations where a covered entity is permitted to disclose protected health information without the authorization of the person or his or her representative, see the summary of the privacy rule on HHS's website: (http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html (click “Permitted Uses and Disclosures”)). If you would like more information about particular exceptions to HIPAA, please let us know.
Recent Amendments to HIPAA Regulations
HHS recently amended its HIPAA regulations. Among other things, the amendments (1) limit the applicability of HIPAA's privacy rule to 50 years after a person's death and (2) allow covered entities to disclose a decedent's protected health information to family members and others who were involved in the person's care or payment for such care unless such disclosure would be inconsistent with the person's prior expressed preference that is known to the covered entity.
Any such disclosure under (2) above must be limited to the protected health information relevant to the family member or other person's involvement in the now deceased person's health care or payment for health care. The commentary to the final rules explains that, because such disclosures are permitted but not required, a covered entity could choose not to make such a disclosure if, for example, it questions the relationship of the person to the decedent or otherwise determines that disclosure would be inappropriate. For more information, see the Federal Register notice at http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf (the changes described above are explained on pages 5613 to 5616).
PRIVILEGED COMMUNICATIONS WITH HEALTH CARE PROVIDERS UNDER STATE LAW
State law generally prevents various health care providers from disclosing communications about a patient without the consent of the patient or his or her authorized representative. Table 1 below summarizes the types of communications that are privileged, and the exceptions which allow for disclosure without consent, for five categories of health care providers: psychologists, physicians, psychiatrists, social workers, and professional counselors. We highlight these five although other statutes protect confidential communications with marriage and family therapists and battered women's or sexual assault counselors. If you would like information on these statutes, please let us know.
As shown in Table 1, most of the exceptions do not specifically reference deceased patients. The table does not contain all details about how each privilege operates, such as (1) the settings where it applies (e.g., civil court proceedings) or (2) who is considered an authorized representative for a deceased person (most of the statutes refer to the patient's personal representative or next of kin). If you would like more information, please let us know.
Table 1: Privileged Communications
Type of Communication
When Statute Permits Unconsented Disclosure
Psychologists (CGS § 52-146c)
● Oral and written communications between a person or family member and the psychologist, relating to the diagnosis and treatment of the person
● Records of such communications
● In court-ordered examinations, when the court finds the person is told the communications are not confidential, but only for the issue of the person's psychological condition
● In civil proceedings when a person introduces his or her psychological condition as an element of a claim or defense, or after death when the person's condition is introduced by someone claiming or defending through or as the person's beneficiary (a court must find the interests of justice more important than protecting the relationship between the person and psychologist)
● When the psychologist has a good faith belief that there is a risk of imminent personal injury to the person, other people, or property
● When the psychologist has a good faith suspicion of child abuse or abuse of someone who is elderly, disabled, or incompetent
● In collection matters (limited disclosure)
● To a homicide victim's immediate family, when (1) the person has been found not guilty by reason of insanity after July 1, 1989, (2) they ask for this information within six years, and (3) the information is used in a civil suit about the person
● Communications made by, or information obtained from, a patient or his or her conservator or guardian about any actual or supposed physical or mental disease or disorder
● Information obtained by examining the patient
● Pursuant to any statute, regulation, or court rule
● To an attorney or malpractice insurer, when a legal claim is pending or may be filed and the information is used in the doctor's defense
● To the Department of Public Health (DPH), when it is investigating a complaint against the doctor
● When the doctor has a good faith suspicion of child abuse or abuse of someone who is elderly, disabled, or incompetent, or who has an intellectual disability
● Oral and written communications between the patient or a family member and the psychiatrist or between any of them and a person under the psychiatrist's supervision, relating to the diagnosis or treatment of the patient's mental condition
● Records of such communications
● To other people treating or diagnosing the patient, when the doctor deems it necessary and tells the patient
● When the doctor determines there is substantial risk of imminent physical injury to the patient or others or needs to disclose to hospitalize or commit the patient
● In collection matters (limited information)
● When examination has been ordered by a court or in connection with a conservatorship application and (1) the patient is a party or his or her mental competence is at issue, (2) the court finds that the patient is informed that disclosure may occur, and (3) disclosure is limited to issues involving the patient's mental condition
● In civil proceedings, when a patient or beneficiary introduces the patient's mental state as an element of a case, under the same circumstances as apply to psychologists
● To the DPH or mental health and addiction services (DMHAS) commissioner, in connection with facility inspections, investigations, or examinations authorized by law
● To immediate family members or legal representatives of homicide victims, under the same circumstances as apply to psychologists
● To DMHAS, in connection with services provided to DMHAS clients or a behavioral health service contractor's payment claim (limited information)
● To researchers in some circumstances
Social workers (CGS § 52-146q)
● Oral and written communications between a person or a family member and a social worker or someone acting under the social worker's supervision, relating to the evaluation and treatment of the person
● Records of such communications
● To other treating providers or a mental health facility, when the social worker determines that disclosure is necessary for (1) diagnosis or treatment or (2) purposes of a referral to a facility
● When there is a substantial risk of imminent physical injury to the person or someone else, or when disclosure is otherwise mandated by statute
● In court-ordered evaluations, when the court finds that the patient is told communications are not confidential, and only for the issue of the person's mental condition
● In civil proceedings, when the person or a beneficiary introduces the person's mental state as an element of the case, under the same circumstances as apply to psychologists
● In collection matters (limited information)
Professional counselors (CGS § 52-146s)
● Oral and written communications between a person or family member and the counselor, relating to diagnosis and treatment of the person
● Records of such communications
● In court-ordered mental health assessments, when a judge finds that the person has been told that communications are not confidential, and only on issue of the person's mental condition
● In civil proceedings, when a patient or beneficiary introduces the person's mental state as an element of the case, under same circumstances as apply to psychologists
● When mandated by other statutes
● When the counselor has a good faith belief that failure to disclose presents a clear and present danger to a person's health or safety or there is a risk of imminent personal injury to a person or property
● When the counselor has a good faith suspicion of child abuse or abuse of someone who is elderly, disabled, or incompetent
● In collection matters (limited information).
In addition to the exceptions to patient confidentiality noted above, other statutes make various health care providers and specified others mandated reporters of suspected child abuse or elder abuse (CGS § 17a-101, CGS § 17b-451).