|“HHS Regulations as Amended January 2013
General Rules for Uses and Disclosures of Protected Health Information: Deceased Individuals – § 164.502(f)
Standard: deceased individuals. A covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.
HHS Description and Commentary From the January 2013 Amendments
Section 164.502(f) requires covered entities to protect the privacy of a decedent’s protected health information generally in the same manner and to the same extent that is required for the protected health information of living individuals. Thus, if an authorization is required for a particular use or disclosure of protected health information, a covered entity may use or disclose a decedent’s protected health information in that situation only if the covered entity obtains an authorization from the decedent’s personal representative. The personal representative for a decedent is the executor, administrator, or other person who has authority under applicable law to act on behalf of the decedent or the decedent’s estate. The Department heard a number of concerns since the publication of the Privacy Rule that it can be difficult to locate a personal representative to authorize the use or disclosure of the decedent’s protected health information, particularly after an estate is closed. Furthermore, archivists, biographers, and historians had expressed frustration regarding the lack of access to ancient or old records of historical value held by covered entities, even when there are likely few surviving individuals concerned with the privacy of such information. Archives and libraries may hold medical records, as well as correspondence files, physician diaries and casebooks, and photograph collections containing fragments of identifiable health information, that are centuries old. Currently, to the extent such information is maintained by a covered entity, it is subject to the Privacy Rule. Accordingly, we proposed to amend § 164.502(f) to require a covered entity to comply with the requirements of the Privacy Rule with regard to the protected health information of a deceased individual for a period of 50 years following the date of death.
We also proposed to modify the definition of “protected health information” at § 160.103 to make clear that the individually identifiable health information of a person who has been deceased for more than 50 years is not protected health information under the Privacy Rule. We proposed 50 years to balance the privacy interests of living relatives or other affected individuals with a relationship to the decedent, with the difficulty of obtaining authorizations from personal representatives as time passes. A 50-year period of protection had also been suggested at a National Committee for Vital and Health Statistics (the public advisory committee which advises the Secretary on the implementation of the Administrative Simplification provisions of HIPAA, among other issues) meeting, at which committee members heard testimony from archivists regarding the problems associated with applying the Privacy Rule to very old records. See http://ncvhs.hhs.gov/050111mn.htm. We requested public comment on the appropriateness of this time period.”
READ THE ENTIRE ARTICLE AT: