Source: https://www.cga.ct.gov/2013/rpt/2013-R-0124.htm
Timestamp: 2019-04-20 10:24:36+00:00

Document:
Under federal law, the confidentiality of patient health information generally continues after the patient's death. The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) “privacy rule” generally prohibits health care providers and other covered entities from disclosing a decedent's protected health information to anyone other than the decedent's personal representative. The personal representative could then choose to keep the information confidential.
There are certain exceptions to the privacy rule—situations where covered entities are allowed to disclose information without the person's authorization. Some of these exceptions tie in to requirements in state law. Thus, while the General Assembly cannot alter the HIPAA requirements, there could be situations where a change in state law would affect the permissibility under HIPAA of the disclosure of a deceased person's health information.
who was involved in a person's care or payment for care (but who is not the personal representative) can access the person's medical information after the person's death.
HIPAA and its regulations are complex, and whether a particular disclosure is authorized under HIPAA depends upon several factors. The U.S. Department of Health and Human Services (HHS) website has a detailed summary of the privacy rule: http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html.
There are also state laws that affect the confidentiality of a patient's health information after death. Subject to certain exceptions and conditions, a patient's communications with physicians, psychologists, psychiatrists, and certain other health care providers are privileged and cannot be disclosed without the patient's consent. If the patient is deceased, his or her authorized representative would have to authorize the disclosure. The state could amend these statutes to modify the circumstances under which the person's authorized representative could assert the privilege after the person's death. Any such amendments would have to comply with HIPAA.
In general, HIPAA preempts contrary state laws that provide less protection for individual health information. The HHS website has more information on when HIPAA preempts state law: http://www.hhs.gov/hipaafaq/state/399.html.
HIPAA's privacy rule limits the circumstances under which health care providers and other covered entities can use or disclose a person's protected health information (which generally includes information that can identify an individual and relates to his or her medical conditions, health care services, and related payments). “Covered entities” include (1) health care providers who electronically transmit health information in connection with certain transactions, (2) health plans (such as insurers, HMOs, Medicare, and Medicaid), and (3) health care clearinghouses (45 C.F.R. § 160.103). In practice, most health care providers are subject to HIPAA.
The privacy rule specifies when covered entities must obtain a patient's authorization before releasing his or her protected health information. In those circumstances in which covered entities can release protected health information without the patient's authorization, they generally must limit the release of information to the minimum amount necessary to accomplish the intended purpose of the disclosure (there are some exceptions, such as disclosure to a health care provider for treatment) (45 C.F.R. § 164.502(b)).
HIPAA's privacy rule generally applies to a deceased person's health information to the same extent as to a living person's information. If HIPAA would require a person's authorization for the release of the person's protected health information and the person is deceased, the covered entity must generally obtain the authorization of the deceased person's personal representative before releasing the information (45 C.F.R. § 164.502(f), (g)).
Under HIPAA, a decedent's personal representative is the executor, administrator, or other person with authority to act on behalf of the decedent or the decedent's estate (45 C.F.R. § 164.502(g)(4)). State law determines who has authority to act on behalf of an estate – in Connecticut, an executor or administrator.
Under state law, an executor is someone named in the will to handle the person's estate. If a person dies without a will, the probate court appoints an administrator to handle the estate, after an application and hearing. The law sets a priority for appointment of an administrator (e.g., surviving spouse; then a child or the child's guardian; etc.) (CGS § 45a-303).
There are certain exceptions to the privacy rule—that is, situations where a covered entity can disclose protected heath information without the authorization of the person or his or her representative. For example, the privacy rule permits disclosure of protected health information for treatment, payment, and health care operations, under specified conditions (45 C.F.R. § 164.506).
HIPAA provides special protection for psychotherapy notes. Covered entities must obtain authorization to use or disclose psychotherapy notes, except for (1) use in the person's treatment or (2) certain narrow exceptions (such as in a legal proceeding against the covered entity or to avert a serious and imminent threat to public health or safety) (45 C.F.R. § 164.508(a)(2)).
The privacy rule also permits disclosure of protected health information without the patient's authorization, subject to various conditions and limitations, for 12 national priority purposes — categories where disclosure is permitted due to the important uses for such information in contexts outside of health care. Such categories include, among other things, (1) disclosures required by law, (2) public health activities, (3) health oversight activities, (4) judicial and administrative proceedings, (5) law enforcement purposes, (6) research, and (7) serious threats to health or safety (45 C.F.R. § 164.512).
Some of the exceptions to the privacy rule would likely only apply to a patient who was still alive, while others could apply to a deceased patient. There are also some that apply specifically to the deceased. For example, covered entities may disclose protected health information to (1) funeral directors as necessary for them to carry out their duties, consistent with applicable law and (2) coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other duties authorized by law (45 C.F.R. § 164.512(g)). Covered entities may also disclose protected health information about someone who has died to a law enforcement official for the purpose of alerting law enforcement of the person's death if the covered entity suspects that the death may have resulted from criminal conduct (45 C.F.R. § 164.512(f)(4)).
The privacy rule establishes various conditions for researchers who seek protected health information. For example, if someone requests a deceased person's protected health information for research purposes without the personal representative's authorization, the researcher must provide the covered entity with representations that the (1) use or disclosure being sought is solely for research on the protected health information of decedents and (2) information being sought is necessary for the research. The researcher must also provide documentation of the person's death if the covered entity requests it (45 C.F.R. § 164.512(i)(1)(iii)). HHS's website has more information on requirements for researchers: http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/research.html.
For more information on those situations where a covered entity is permitted to disclose protected health information without the authorization of the person or his or her representative, see the summary of the privacy rule on HHS's website: (http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html (click “Permitted Uses and Disclosures”)). If you would like more information about particular exceptions to HIPAA, please let us know.
HHS recently amended its HIPAA regulations. Among other things, the amendments (1) limit the applicability of HIPAA's privacy rule to 50 years after a person's death and (2) allow covered entities to disclose a decedent's protected health information to family members and others who were involved in the person's care or payment for such care unless such disclosure would be inconsistent with the person's prior expressed preference that is known to the covered entity.
Any such disclosure under (2) above must be limited to the protected health information relevant to the family member or other person's involvement in the now deceased person's health care or payment for health care. The commentary to the final rules explains that, because such disclosures are permitted but not required, a covered entity could choose not to make such a disclosure if, for example, it questions the relationship of the person to the decedent or otherwise determines that disclosure would be inappropriate. For more information, see the Federal Register notice at http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf (the changes described above are explained on pages 5613 to 5616).
State law generally prevents various health care providers from disclosing communications about a patient without the consent of the patient or his or her authorized representative. Table 1 below summarizes the types of communications that are privileged, and the exceptions which allow for disclosure without consent, for five categories of health care providers: psychologists, physicians, psychiatrists, social workers, and professional counselors. We highlight these five although other statutes protect confidential communications with marriage and family therapists and battered women's or sexual assault counselors. If you would like information on these statutes, please let us know.
As shown in Table 1, most of the exceptions do not specifically reference deceased patients. The table does not contain all details about how each privilege operates, such as (1) the settings where it applies (e.g., civil court proceedings) or (2) who is considered an authorized representative for a deceased person (most of the statutes refer to the patient's personal representative or next of kin). If you would like more information, please let us know.
● In collection matters (limited information).
In addition to the exceptions to patient confidentiality noted above, other statutes make various health care providers and specified others mandated reporters of suspected child abuse or elder abuse (CGS § 17a-101, CGS § 17b-451).

References: § 160
 § 164
 § 164
 § 164
 § 45
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 17
 § 17