Guide

The personal representative: proof before release

Summary

After a patient dies, only the personal representative — the executor or administrator of the estate, or whoever holds authority under your state's law to act for the deceased — may exercise the patient's records rights. HIPAA protects a decedent's protected health information for fifty years after death. Verify the requester's legal authority with documentation before you release a single page; a grieving relative is not automatically the personal representative.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

Who is the personal representative after a patient dies?

After a patient dies, HIPAA does not open the chart to whoever asks first. The right to a deceased patient's protected health information passes to the personal representative — the person with legal authority under your state's law to act for the estate, usually the executor named in the will or a court-appointed administrator. HIPAA lets that representative exercise the deceased's access right 1Ref 1HHS Office for Civil Rights (2026).Health Information of Deceased Individuals.That a deceased patient's PHI stays protected for fifty years and that the personal representative exercises the decedent's access right. and otherwise treats them as the individual, deferring to state law on who qualifies 2Ref 2HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA treats the personal representative as the individual, defers to state law on who qualifies, and permits refusal where release could endanger someone.. A spouse, adult child, or next of kin holds no automatic right to the record on relationship alone.

The protection does not end at the funeral. A decedent's information stays protected, so the fact that a person is grieving is not, by itself, permission. Your job is to identify the one person the law has put in the patient's shoes, verify it on paper, and release only to them.

The proof you require before you release anything

Before you release a single page, confirm the requester's authority in writing — do not rely on a phone call, a funeral-home referral, or an obituary. In common practice, clinicians ask for a certified death certificate plus the court document that names the representative: letters testamentary for an executor, or letters of administration where there is no will. Match the name on that document to the name on the request, log a government photo ID, and keep copies of everything in the chart.

Build a short intake checklist and use it every time, so a hard conversation never pushes you into releasing to the wrong person:

Letters testamentary or letters of administration — the court's appointment of the executor or administrator; this is the document that actually carries authority.
A certified death certificate — confirming the death and the patient's identity.
A written, signed request naming exactly which records are sought and where they should go.
Government photo ID matching the name on the court document.

If the paperwork does not match, stop and ask for what is missing. A polite delay to verify authority is defensible; an unverified release is not.

How long a decedent's record stays protected — and how long you keep it

A decedent's protected health information stays protected for fifty years after the date of death; after that window HIPAA's protections lapse 1Ref 1HHS Office for Civil Rights (2026).Health Information of Deceased Individuals.That a deceased patient's PHI stays protected for fifty years and that the personal representative exercises the decedent's access right.. That fifty-year figure is a confidentiality floor, not a rule about how long to keep the chart. How long you must actually retain the record is a separate, state-driven question: professional record-keeping guidance suggests holding adult records for at least seven years after the last service, longer for records of minors, and always deferring to your state's retention rule 3Ref 3American Psychological Association (2007).Record Keeping Guidelines.The professional record-keeping norm of retaining adult records at least seven years after last service, longer for minors, deferring to state law..

Set your retention clock to the longer of the two — the state minimum or your professional guideline — and treat the death as the start of a records-retention obligation, not the end of one. When the period finally ends, dispose of the record deliberately: shredding for paper and secure deletion for electronic copies, documented the same way you document a release. For the fuller picture on what to keep and for how long, this sits alongside your general retention schedule and the specific rules that apply after a client dies.

What the personal representative may actually receive

Once you have verified authority, the personal representative exercises the same right of access the patient held. They may inspect and obtain copies of the record, and you must respond within thirty days — with one thirty-day extension available if you notify them in writing of the reason — for a reasonable, cost-based fee 4Ref 4HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The right-of-access mechanics: the thirty-day response window with one extension, the cost-based fee, format, and the psychotherapy-notes exclusion.. The format follows the request where the record is producible in that form; an electronic record is generally sent electronically.

Two limits still apply. Psychotherapy notes kept separate from the rest of the chart are excluded from the access right, and you may decline to release them 4Ref 4HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The right-of-access mechanics: the thirty-day response window with one extension, the cost-based fee, format, and the psychotherapy-notes exclusion.. And because most records are now electronic, the information-blocking rule discourages foot-dragging: once authority is verified, an unreasonable delay in providing electronic health information can itself be a violation, so calendar the deadline the day the request arrives 5Ref 5Office of the National Coordinator / ASTP (2026).Information Blocking.That the information-blocking rule discourages unreasonable delay in providing electronic health information once access is authorized.. If you need the mechanics of the right of access, the timeline, and the permissible copy fees, keep those beside this page.

When the person asking is not the personal representative

Not every request after a death comes from the personal representative, and the correct answer changes with who is asking. A grieving spouse with no estate role, a life-insurance investigator, or an attorney in a lawsuit does not automatically step into the patient's shoes. HIPAA still permits some disclosures — for example, to family members who were involved in the person's care before death, limited to information relevant to that involvement — but authority to receive the full record still runs through the personal representative.

When a court gets involved, follow the paper, not the pressure. A court order authorizes only what the order specifies; a bare subpoena without a court order requires satisfactory assurances of notice to the individual or a qualified protective order before you produce anything 6Ref 6HHS Office for Civil Rights (2026).Court Orders and Subpoenas.The distinction between a court order (release only what it specifies) and a subpoena without a court order (assurances required first).. If the subpoena arrives without those assurances, that is your cue to slow down, not to comply. HIPAA also lets you refuse to treat someone as the personal representative if you reasonably believe doing so could endanger the patient or another person 2Ref 2HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA treats the personal representative as the individual, defers to state law on who qualifies, and permits refusal where release could endanger someone..

Who is asking	What proves authority	What you may release
Executor named in the will	Letters testamentary	The record, as personal representative
Administrator, no will	Letters of administration	The record, as personal representative
Spouse or relative, no estate role	Relationship alone	Nothing on relationship alone
Attorney in litigation	Court order, or subpoena with assurances	Only what the order specifies

A release sequence you can follow the same way every time

Treat every post-death request the same way, so a hard day never turns into a privacy breach and so you are not improvising under pressure from a grieving family. Work the steps in order, and stop the moment one of them fails rather than pushing through to keep the peace — an unverified release cannot be undone, and the same sequence protects you whether the requester is the rightful executor or someone hoping you will not check:

1. Confirm the death — a certified death certificate, not word of mouth. 2. Identify the requester and what authority they claim. 3. Demand the court document proving personal-representative status. 4. Match the names on the request, the court document, and a photo ID; log all three. 5. Scope the request to the minimum necessary, and pull psychotherapy notes from what you produce 7Ref 7HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.The Privacy Rule's minimum-necessary standard governing how much of the record you release.. 6. Apply your access-right timeline and cost-based fee, calendaring the deadline that day. 7. Release and document — file the proof of authority and a release log in the chart.

The verification is the work; the release is only the last step.

Common questions

Not on the marriage alone. Unless your state's law makes the spouse the personal representative, or a court has appointed them executor or administrator, marriage does not by itself grant authority over the record. A spouse who was involved in the patient's care before death may receive information relevant to that care, but the full record runs through the personal representative you have verified on paper.

No — you generally do not adjudicate the will yourself. What you need is the court document that flows from it: letters testamentary naming the executor, or letters of administration where there is no will. Those are the court's confirmation of who holds authority. Reading a will handed to you across the desk is not your role, and it does not substitute for the court appointment.

Then no one has yet stepped into the patient's shoes, and you have no personal representative to release to. Explain that authority comes from a court appointment — letters of administration — and that the family member should speak with a probate attorney or the local court. Hold the record under your retention schedule until someone presents that authority. Releasing to fill the gap is not permitted.

Not automatically. Psychotherapy notes kept separate from the rest of the chart are excluded from the HIPAA right of access, so the personal representative does not inherit a right to them the way they inherit the rest of the record. You may decline to release them. Progress notes and the general clinical record are a different matter and follow the ordinary access rules once authority is verified.

Treat it like any right-of-access request: respond within thirty days, with one thirty-day extension available if you notify the requester in writing of the reason and the new date. Charge only a reasonable, cost-based fee. Because the record is largely electronic, avoid unnecessary delay — calendar the deadline the day the request arrives, and document when and how you released.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). Health Information of Deceased Individuals. U.S. Department of Health and Human Services. linkThat a deceased patient's PHI stays protected for fifty years and that the personal representative exercises the decedent's access right.
2.HHS Office for Civil Rights (2026). Personal Representatives. U.S. Department of Health and Human Services. linkThat HIPAA treats the personal representative as the individual, defers to state law on who qualifies, and permits refusal where release could endanger someone.
3.American Psychological Association (2007). Record Keeping Guidelines. American Psychological Association. link ✓The professional record-keeping norm of retaining adult records at least seven years after last service, longer for minors, deferring to state law.
4.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkThe right-of-access mechanics: the thirty-day response window with one extension, the cost-based fee, format, and the psychotherapy-notes exclusion.
5.Office of the National Coordinator / ASTP (2026). Information Blocking. HealthIT.gov. link ✓That the information-blocking rule discourages unreasonable delay in providing electronic health information once access is authorized.
6.HHS Office for Civil Rights (2026). Court Orders and Subpoenas. U.S. Department of Health and Human Services. linkThe distinction between a court order (release only what it specifies) and a subpoena without a court order (assurances required first).
7.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkThe Privacy Rule's minimum-necessary standard governing how much of the record you release.

https://www.gale.care/for-providers/ecp-personal-representative-records · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers