How to Get a Deceased Person's Medical Records

Families ask for medical records after a death for many reasons: to understand what happened, to resolve a billing or insurance question, to share a hereditary risk with other relatives, or because a legal matter depends on them. The federal rules are clearer than most people expect, but the question of who counts as entitled depends on state law.

How long are the records protected?

The HIPAA Privacy Rule protects a deceased person’s health information for 50 years after death. After that, the information is no longer considered protected health information under HIPAA, which HHS says is meant to balance family privacy with access for historians and archivists.

Protection doesn’t mean the records are sealed. It means a doctor, hospital, or health plan can release them only in the ways the rule allows.

Who can get them?

1. The personal representative. HHS defines this as the executor, the administrator, or another person with authority under applicable state or other law to act on behalf of the deceased person or the estate. A provider must treat that person as the individual for matters within the scope of that authority, including the right to see and get copies of the records and to authorize release to others
2. Family and others involved in the person’s care or payment for care. Even if you aren’t the personal representative, a provider may disclose the relevant information to a spouse, parent, child, domestic partner, other relative, or friend who was involved in the person’s care or in paying for it, unless that would conflict with a preference the person expressed that the provider knows about. The disclosure is limited to what’s relevant to that involvement, not the whole chart
3. A treating provider for a relative. If the information is relevant to a surviving family member’s own health care (for example, a hereditary condition), the rule allows the provider to disclose the deceased person’s information to that relative’s treating provider without an authorization
4. Coroners, medical examiners, and funeral directors. The rule has special provisions that allow disclosures to them. See coroner vs. medical examiner

HHS says whether a family member or another person is a personal representative, and so has a right to the full record, generally depends on whether that person has authority under state law to act for the person or the estate. A spouse or adult child is not automatically a personal representative everywhere.

What if there is no executor or the estate hasn’t been opened?

This is the common sticking point. If you aren’t the executor or administrator, a provider may ask for court papers, or may release only the information relevant to your involvement in the person’s care. Your options:

• Ask whether state law gives you authority. State law decides who has authority to act, and in some places that can include relatives. The provider’s privacy officer or medical records department can tell you what documents they accept
• Get appointed. If there’s a will, the executor named in it can request records once they have letters from the court; see what letters testamentary are. Some places also have simplified procedures for small estates, such as D.C.’s small estate options, though whether a simplified route gives you authority for HIPAA purposes is a question for the provider or an attorney
• Ask the executor to request them, or to sign an authorization allowing the provider to release the records to you

How do I request them?

1. Identify every source. Records may be held by hospitals, physicians, specialists, labs, imaging centers, pharmacies, hospice agencies, and health plans. HHS says the right of access covers the “designated record set,” which includes medical records and also billing and payment records. Statements and explanation-of-benefits forms in the person’s mail can tell you which providers to contact. See how to find everything a person owned for the broader search
2. Send a written request to each provider (many have a medical records or “health information management” department). Include the person’s full name, date of birth, and dates of care, the specific records you want, and the format you prefer. You don’t have to explain why you want them
3. Attach proof of authority: typically a copy of the death certificate, your photo ID, and letters testamentary, letters of administration, or other court documents showing you are the personal representative. See getting death certificates
4. Ask for the records in the form you can use. HHS says individuals can receive an electronic copy of electronically maintained records, in the format they request if the provider can readily produce it, and can’t be required to pick records up in person if they ask for mail or email. A personal representative can also direct that the copy be sent to a third party, such as an attorney, in writing
5. Keep a record of when you sent each request. See keeping the estate’s records

How long can they take?

HHS says a provider must act on a request no later than 30 calendar days after receiving it. It can take one extension of up to 30 more days if, within the first 30 days, it gives a written statement of the reasons for the delay and the date it will finish. HHS describes the 30 days as an outer limit, not a goal.

What can they charge?

Only a reasonable, cost-based fee, according to HHS. It may include:

• Labor for copying the records
• Supplies, such as paper or the cost of media
• Postage, if you ask for the records to be mailed
• Labor to prepare a summary or explanation, only if you chose that in advance and agreed to the fee

Providers can’t include charges for searching for and retrieving the records, and can’t pass on the cost of outsourcing the work to a records vendor. They must tell you the approximate fee in advance. For electronic copies of records kept electronically, providers may use a flat fee of up to $6.50 instead of calculating actual costs. There’s no charge just to inspect the records. And a provider may not withhold records because of an unpaid medical bill.

State law can matter in both directions. HHS says a state fee schedule applies only if it covers the same kinds of costs HIPAA permits and is reasonable, but that a state law giving you a free copy or lower fees still applies, because HIPAA doesn’t override state laws that give more access.

What can a provider refuse to give me?

HHS says a provider may deny access only in very limited circumstances. Two examples are psychotherapy notes and information compiled in anticipation of, or for use in, a legal proceeding, though you can still get the underlying records in the designated record set. A provider is also not required to create new analyses or explanations that don’t already exist. If you’re refused, ask for the reason in writing, and consider an attorney or a complaint to HHS’s Office for Civil Rights.

What if the records are very old, or the practice has closed?

HIPAA says individuals have a right to access records regardless of how old they are or where they’re stored, so age alone isn’t a reason for denial. But HHS also says the Privacy Rule has no record retention requirement: providers may destroy records at the time permitted by state law. So protection for 50 years doesn’t mean the provider kept the chart for 50 years. Ask promptly, and if a practice has closed, ask the state health department or medical board where its records went.

What about an autopsy report or the death certificate?

Those aren’t a hospital’s medical records. Autopsy reports come from the medical examiner or coroner’s office; see coroner vs. medical examiner. If a death certificate contains an error, see how to correct an error on a death certificate.

What should I do next?

1. Find out who the personal representative is, or whether you can become one
2. List the providers, using statements and insurance forms
3. Send written requests with the death certificate and proof of authority
4. Ask about fees up front, and note the 30-day mark
5. If you were involved in the person’s care but aren’t the personal representative, ask what the provider can share

HIPAA sets a federal floor, and state laws on who may access records, fees, and retention differ. This is general information, not legal advice; the provider’s privacy officer or an attorney can confirm what applies.