After a client dies: personal representatives and surviving privilege

Who controls the record after death

When a client dies, the record does not become public and it does not pass to whichever relative asks first. Control transfers to the personal representative of the estate — typically the executor named in a will or an administrator appointed by a court — who is recognized under state law to act for the deceased. HIPAA generally treats that person as the individual, so their authority, not a family relationship, governs disclosure 1Ref 1HHS Office for Civil Rights (2026).Personal Representatives.That after death, control of the record passes to the personal representative recognized under state law, whom HIPAA treats as the individual..

The underlying protection does not lapse at death, either. The Privacy Rule continues to guard the deceased's protected health information, and the duty of confidentiality you owed in life carries forward 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule continues to protect a deceased person's protected health information and the duty of confidentiality carries forward after death.. Practically, that means the same care you took while the client was alive still applies: you disclose to those with authority, for permitted purposes, and no further.

Proving personal-representative status before you release

Before you release anything, confirm the legal authority — do not take a self-description on faith. A person claiming to be the personal representative should provide documentation your state recognizes: letters testamentary, letters of administration, or a court appointment naming them executor or administrator. Once verified, that representative may authorize disclosures and exercise the deceased's right of access, generally on the same timeline that applied in life 3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That a verified personal representative may exercise the deceased's right of access on the same access timeline that applied in life..

A relationship alone is not authority. A surviving spouse, an adult child, or a parent is not automatically the personal representative; someone else may hold letters, or the estate may not be probated at all. When no representative exists yet, the safe response is to hold the record and explain what documentation you need, rather than releasing to the most insistent relative. Log who asked, what you required, and what you provided.

Privilege and protection survive death

Confidentiality does not end at the graveside. The Privacy Rule continues to guard the deceased's protected health information, so the duty of care you owed in life carries forward 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule continues to protect a deceased person's protected health information and the duty of confidentiality carries forward after death.. As a general legal matter, psychotherapist-patient privilege also survives the client's death and belongs to the estate, which is why a family member's grief, however real, does not by itself unlock the file.

The person who can waive privilege or authorize disclosure is the one holding legal authority over the estate — the same personal-representative analysis, not a next-of-kin shortcut. This is where solo clinicians feel the most pressure, because the request often comes wrapped in loss. A parent wanting to understand a child's final months, a spouse seeking answers — the human pull is strong, and the discipline is to route it through authority rather than sympathy. The care is not coldness; it is the same protection the client trusted you with in life, extended past it. Where the deceased was one member of a couple, the couples records rules add a second layer, because the surviving partner's information is entangled in the same file.

Psychotherapy notes and the estate

Your separately kept psychotherapy notes keep their heightened protection after death. They are not part of the ordinary record release, and disclosing them requires authorization even from a verified personal representative, just as they would in life 4Ref 4HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes keep their separate, heightened protection and require authorization to disclose even to a verified personal representative.. A representative's authority to access the record does not automatically pull open your private process notes; those remain behind their own lock.

This matters most when a family wants to read your impressions of the client's state of mind — after an unexpected death, in a custody fight, or during estate litigation. The progress note carries the reachable clinical record; the psychotherapy notes carry your analysis and stay separate. Keep the two genuinely distinct so that when a request arrives, you can release the record cleanly and answer the notes question with a clear rule rather than an improvised judgment.

Retention: how long you keep the file after death

Death does not reset your retention clock; if anything, it extends them. Professional record-keeping guidance offers, as an example, seven years after the last service for adult records and longer for minors, but always defers to your state's specific retention law, which controls 5Ref 5American Psychological Association (2007).Record Keeping Guidelines.The record-keeping guideline example of seven years' retention after last service for adults, longer for minors, always deferring to state law, plus secure disposition planning.. Treat the guideline as a floor to check against your board's rule, never as a national deadline.

Why keep it after death at all? Estate litigation, malpractice claims, and later requests from an authorized representative can all arrive months or years out. Calendar the retention period for each closed file, and when it genuinely expires, dispose of the record securely — shredding for paper, certified destruction for electronic media — with a disposal log. A clear retention schedule is the difference between a defensible file and a box of liability.

Subpoenas and court orders naming a deceased client

After a death, the demands still come — often from lawyers handling the estate or a related dispute. The same paper analysis applies: an attorney's subpoena is not a court order, and under HIPAA you may respond only with satisfactory assurances of notice or a protective order, while a signed court order authorizes only what it specifies 6Ref 6HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That an attorney subpoena requires satisfactory assurances or a protective order while a court order authorizes only what it specifies.. Do not release a deceased client's record on a bare subpoena, and do not assume death lowers the bar.

Work the same sequence you would for a living client:

• The subpoena or the law-office letter arrives — do not send records on its strength alone
• Identify who holds authority for the estate and give required notice
• Release only what a valid court order compels, or what the verified personal representative authorizes
• Document every request, the authority you confirmed, and what you disclosed

Handled this way, the loss of a client — never a routine event when a patient dies — does not also become a privacy breach layered on top of it.