HIPAA Final Rule: More on Uses and Disclosures of Protected Health Information of Decedents

Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule:  Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013.  The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.

Our focus yesterday was on the modified rule: 45 CFR 164.502(f): StandardDeceased individuals. Today, we finish up with a related modified rule: 164.510(b):  Disclosures about a decedent to family members and others involved in care, which is in 164.510(b)(5):

Uses and disclosures when the individual is deceased. If the individual is deceased, a covered entity may disclose to a family member, or other persons identified in paragraph (b)(1) of this section who were involved in the individual’s care or payment for health care prior to the individual’s death, protected health information of the individual that is relevant to such person’s involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.”

For reference, we provide modified 164.510(b)(1) here:

“(b) Standard:  Uses and disclosures for involvement in the individual’s care and notification purposes—(1) Permitted uses and disclosures.

“(i) A covered entity may, in accordance with paragraphs (b)(2), (b)(3), or (b)(5) of this section, disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person’s involvement with the individual’s health care or payment related to the individual’s health care.

“(ii) A covered entity may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual’s location, general condition, or death.  Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs (b)(2), (b)(3), (b)(4), or (b)(5) of this section, as applicable.”

78 Federal Register 5699

We provide here the content of the Final Rule preamble that underpins the Disclosure about a decedent to family members and others involved in care:

“The final rule adopts the proposal to amend 45 CFR 164.510(b) to permit covered entities to disclose a decedent’s protected health information to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

“In response to commenters who opposed this provision, we believe the provision strikes the appropriate balance in allowing communications with family members and other persons who were involved in the individual’s care or payment for care prior to death, unless doing so is inconsistent with the prior expressed wishes of the individual. This will ensure family members and others can find out about the circumstances surrounding the death of their loved ones, unless the individual prior to his or her death objected to the covered entity making such communications. Further, the Privacy Rule limits such disclosures, similar to the other disclosures permitted under 164.510(b), to the protected health information relevant to the family member or other person’s involvement in the individual’s health care or payment for health care. For example, a covered health care provider could describe the circumstances that led to an individual’s passing with the decedent’s sister who is asking about her sibling’s death. In addition, a covered health care provider could disclose billing information to a family member of a decedent who is assisting with wrapping up the decedent’s estate. However, in both of these cases, the provider generally should not share information about past, unrelated medical problems. Finally, these disclosures are permitted and not required, and thus, a covered entity that questions the relationship of the person to the decedent or otherwise believes, based on the circumstances, that disclosure of the decedent’s protected health information would not be appropriate, is not required to make the disclosure.”

78 Federal Register 5615

Tomorrow, we begin two days presentation of modifications to the Notice of Privacy Practices for Protected Health Information.

3 comments on “HIPAA Final Rule: More on Uses and Disclosures of Protected Health Information of Decedents”

  1. i m surprised that in spite of all agencies , books, and work on HIPAA, there is no standard HIPAA form or Medical Record Release Authorization form to be used in all healthcare facilities. and there is no one sheet of paper to give to patients about HIPAA. let me know if you have these 2 forms. Every doctor and hospital I know has different form?! which doesnt make sense. even board of family medicine, internal medicine, AMA, AAFP dont have or offer any help.

  2. Diaa,

    Unfortunately, the regulations don’t provide for a standard set of forms, which is why you see so many different variations out there.

    That said, we’re going to look into this a bit more and see if there’s something we can do to help out.

    -k

Leave a Reply

Your email address will not be published. Required fields are marked *