Release of Medical Records of Deceased Residents

In Alabama, one has the right to obtain a deceased resident's medical records from an Alabama health care provider if the requester is the personal representative (such as the executor or administrator) of the deceased resident's estate.

The new HIPAA privacy final rule passed 3/26/2013 with a compliance deadline of 9/23/2013. The new final HIPPA rule says that those family members, relatives, and others who had access to the health information of the deceased prior to death, but had not qualified as a "personal representative"(PR) of the decedent under HIPAA Privacy Rule 164.502(g)(4) the final Privacy Rule allows covered entities (facility) to disclose a decedent's protected health information(PHI) to family members and others who were involved in the care or payment for care of the descendent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity. Whether to adhere to the new HIPAA final rule is now at the discretion of the facility and is not mandatory.

We do not plan to make any changes to our current procedure unless the facility/covered entity directs us to do so. As such, we will still require a written request for the deceased resident's medical records signed by the personal representative of the estate on a HIPAA compliant release form along with the accompanying legal authority from the Probate court naming the requester as the PR.

This recent HIPAA amendment is addressed under number 2 below and authorizes the covered entity to produce protected health information or medical records to individuals who are not the PR, so long as those individuals were involved in the decedent's care/payment, need the PHI for that purpose and the decedent did not express a preference (that was known to the covered entity) for his/her PHI to not be released to the individual now seeking it. It will be interesting to see how this new HIPAA amendment plays out. Under this new amendment, the covered entity has the discretion to produce the PHI or not; HIPAA does not require that the covered entity produce, but rather permits the disclosure.

Under HIPAA, the confidentiality of a resident's protected health information continues after the resident's death. In general, the covered entity is not required to disclose a decedent's PHI to anyone other than the decedent's personal representative. The covered entity must (1) verify the identity of the individual and (2) verify that the individual has the legal authority to access the decedent's PHI. Recent amendments to the HIPAA privacy rule limit the time period for which the covered entity must protect a decedent's PHI to 50 years after the person's death. See45 C.F.R. 164.502(f). HIPAA provides for disclosure of a decedent's PHI as follows:

(1)Disclosure of PHI to Personal Representative- upon verification of identity and legal authority, the personal representative must be treated as the individual for purposes of disclosure

See 45 C.F .R. 164.502(g)(1)Standard: Personal representatives.As specified in  this paragraph, a covered entity must, except as provided in paragraphs (g)(3) and (g)( 5) of this section, treat a personal representative as the individual for purposes of this subchapter.

See 45 C.F.R. 164.502(g)(4)Implementation specification: Deceased individuals.  If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered  entity must treat such person as a personal representative under this subchapter,  with respect to protected health information relevant to such personal representation.

(2) Disclosure of PHI to family member, other relative, or close personal friend of decedent - The covered entity is permitted, but not required to disclose PHI to theseindividuals so long as the individual was involved in the decedent's care or payment for healthcare prior to death and the PHI is relevant to the family member, other relative or close personal friend's involvement; the disclosure also must not be contrary to the decedent's prior expressed preference. [1]

See 45 C.F.R 164.510(b)Standard: Uses and disclosures for involvement in the  individual's care and notification purposes-

(1) Permitted uses and disclosures.  (i) A covered entity may, in accordance with paragraphs (b )(2), (b )(3), or (b )(5) of this section, disclose to a family member, other relative, or a close personal friend  of the individual, or any other person identified by the individual, the protected health information directly relevant to such person's involvment with the individual's health care or payment related to the individual's health care.

See 45 C.F.R. 164.510(b)(5)Uses and disclosures when the individual is  deceased.If the individual is deceased, a covered entity may disclose to a family  member, or other persons identified in paragraph (b) (1) of this section who were  involved in the individual's care or payment for health care prior to the  individual's death, protected health information of the individual that is relevant to such person's involvement, unless doing so is inconsistent with any prior  expressed preference of the individual that is known to the covered entity.

(3) Disclosure of PHI to law enforcement- if the covered entity has suspicion that death may have resulted from a criminal act, then disclosure is permitted.

See 45 C.F.R. 164.512 Uses and disclosures for which an authorization or  opportunity to agree or object is not required. A covered entity may use or  disclose protected health information without the written authorization of the  individual, as described in § 164.508, or the opportunity for the individual to  agree or object as described in§ 164.510, in the situations covered by this section, subject to the applicable requirements of this section. When the covered entity is  required by this section to inform the individual of, or when the individual may  agree to, a use or disclosure permitted by this section, the covered entity's  information and the individual's agreement may be given orally.

See 45 C.F.R. 164.512(f)(4)Permitted disclosure: Decedents. A covered entity  may disclose protected health information about an individual who has died to a  law enforcement official for the purpose of alerting law enforcement of the death  of the individual if the covered entity has a suspicion that such death may have  resulted from criminal conduct.

(4) Disclosure of PHI to Coroners and Medical Examiners

See 45 C.F.R. 164.512(g)Standard: Uses and disclosures about decedents-(1)  Coroners and medical examiners. A covered entity may disclose protected health  information to a coroner or medical examaniner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. A covered entity that also performs the duties of a coroner or medical examiner may use protected health information for the purposes described in this paragraph.

(5) Disclosure of PHI to Funeral Directors

See 45 C.F.R. 164.512(g)(2) Funeral directors. A covered entity may disclose  protected health information to funeral directors, consistent with applicable law,  as necessary to carry out their duties with respect to the decedent. If necessary for  funeral directors to carry out their duties, the covered entity may disclose the  protected health information prior to, and in reasonable anticipation of, the  individual's death.

(6) Disclosure of PHI for Research Purposes-The covered entity is permitted to disclose PHI for research subject to various criteria not set out fully herein

See45 C.F.R. 164.512(iii)Research on decedent's information. The covered  entity obtains from the researcher:

(A) Representation that the use or disclosure sought is solely for research on the  protected health information of decedents;

(B) Documentation, at the request of the covered entity, of the death of such  individuals; and

(C) Representation that the protected health infomation for which use or disclosure is sought is necessary for the research purposes.

Member may login to review new and revised related forms.

Lavonya K. Chapman, Esq., RN, Claims Compliance Director

Arthur J. Gallagher Risk Management Services, Inc.

2200 Woodcrest Place, Suite 250

Birmingham, AL  35209

lavonya_chapman@ajg.com

(205) 414-2649 (direct)

(205) 414-2632 (fax)

(205) 542-2771 (mobile)

To visit the LTC Provider University website go to   www.ltcpu.com

 [1]Attached is an excerpt from the Federal Register which discusses this new amendment to the HIPAA Rule. It is helpful and explains in some detail the rationale, concerns, etc. behind extending permissible disclosures of PHI to family members, other relatives and close friends of the decedent who would not qualify as a personal representative and otherwise would not have access to the decedent's PHI.