Medical Privacy After Death: Implications of New Modifications to the Health Insurance Portability and Accountability Act Privacy Rule

Abstract

From the Office of Health Affairs, Department of Homeland Security, Washington, DC (C.G.K.); The Judge Advocate General’s Corps, US Air Force Reserve, Washington, DC (C.G.K.); and Department of Psychiatry and Behavioral Sciences, The George Washington University, Washington, DC (L.H.K.). O n January 25, 2013, the US Department of Health and Human Services (HHS) published “the most sweeping changes” to its health information regulations “since they were first implemented” more than a dozen years earlier. Among the modifications to the Privacy Rule, a regulation issued under the Health Insurance Portability and Accountability Act (HIPAA) to establish national standards to protect individuals’ personal health information, was a substantial shift in the way that medical records of deceased patients are treated under the law. Throughout the Privacy Rule’s history, the status of decedents’ health information has oscillated between greater and lesser protection. In the rule’s first iteration in 1999, the HHS proposed extending confidentiality for 2 years after a person died. This proposal was largely consistent with traditional privacy law, in which an individual’s protectable interests cease at death, but at odds with US medical ethics, whereby postmortem confidentiality mirrors that during life. Faced with criticism that the 2-year time frame was “not sufficiently protective” of medical privacy, the final Privacy Rule of 2000 jettisoned the temporal limitation in favor of extending protection indefinitely. Agreeing that the 2-year period was “both inadequate and arbitrary,” the HHS declined to specify an alternative time frame and opted to safeguard decedents’ information “in the same manner and to the same extent” as living individuals. The new modifications, which became effective on March 26, 2013, and mandate compliance by September 23, 2013, make 2 important changes regarding the records of decedents (Table). First, the regulation returns to the formula of a temporal restriction on privacy protection but opts for a considerably longer period of 50 years after death. Second, disclosure of a decedent’s health information is now permitted to family members or others