Deceased Client Records HIPAA

A grieving parent calls your office asking for their adult child's therapy records. A family attorney sends a letter demanding the complete clinical file. An estate executor shows up with a death certificate and a verbal request. Each scenario seems straightforward — the client is dead, the family wants the records — but every one of them has a wrong answer that could cost you your license.

HIPAA protections for mental health records don't end when the client dies. They continue for 50 years after death.

Who Can Access a Deceased Client's Records

Under HIPAA, a personal representative — an executor, administrator, or other person with authority under applicable state law to act on behalf of the deceased or the estate — generally exercises the deceased person's HIPAA rights. HIPAA also permits limited disclosure of relevant information to family members or others involved in the person's care or payment for care before death, unless that conflicts with a known prior preference.

A family member calling you in tears is not automatically the personal representative. A spouse, parent, or adult child may have no legal authority to exercise the deceased person's HIPAA rights. Before providing broader access, verify the requester's authority under applicable state law (for example, letters testamentary, a court appointment, or equivalent). For a limited disclosure to someone involved in care or payment before death, verify that HIPAA's conditions are met and that no known prior preference bars it.

This feels cold in the moment. A parent who just lost their child wants to understand what was happening in therapy. But disclosing records without a valid authorization or other HIPAA permission can violate privacy rules and expose you to federal penalties or state licensing-board action, regardless of the requester's emotional state or good intentions.

What to Do When a Family Member Calls

Keep the conversation empathetic but boundaried:

Express genuine sympathy for their loss while you determine what HIPAA permits you to disclose. "I'm so sorry to hear about your loss" is appropriate. Do not confirm a clinical relationship or share session details unless a valid authorization or another applicable HIPAA permission allows it.

If they ask whether the deceased was your client, explain that you need to verify your authority to respond. HIPAA generally allows a personal representative to exercise the deceased person's rights, and it permits limited, relevant disclosures to some people involved in care or payment before death.

For broader access, explain that the requester may need to establish personal-representative authority under applicable state law. Once that authority is verified, handle the request through your usual records process.

Document the contact — date, time, who called, what was discussed, and what you declined to disclose. This protects you if the interaction later becomes part of a complaint.

Responding to a Subpoena

A subpoena for a deceased client's records is different from a court order. It is legal process, and HIPAA may permit disclosure when required notice or qualified protective-order conditions are met; receipt alone does not automatically authorize release.

When a subpoena arrives: (1) contact your malpractice insurer's risk management line immediately, (2) verify that the subpoena is valid and properly served, (3) determine whether the HIPAA notice or qualified protective-order conditions are satisfied, and (4) respond through your attorney, not independently.

Psychotherapy notes kept separately from the medical record receive special protection under HIPAA. Do not assume a general records release or subpoena covers them; verify that an authorization specifically addresses psychotherapy notes or get legal guidance on any applicable exception.

Record Retention After Client Death

The HIPAA Privacy Rule does not set a medical-record retention period; state law generally governs how long records must be retained. Requirements vary, including for minors, so check applicable state law and licensing-board rules.

For a sudden, traumatic, or suicide death, ask your malpractice insurer or counsel promptly whether a preservation hold is appropriate. Otherwise, follow the applicable retention schedule and preserve records if a complaint, claim, subpoena, or investigation is pending or reasonably anticipated.

When routine destruction is permitted, document the date, method (shredding, secure digital deletion), and basis for destruction under your retention policy. Do not destroy records subject to a preservation hold or pending legal process.

The Final Progress Note

After learning of a client's death, complete a final clinical progress note documenting: the date you learned of the death, how you were notified, and a brief summary of the client's treatment status at the time of death. Reference your most recent risk assessment and safety plan if applicable.

Do not overwrite or backdate previous session notes. If you identify an error, preserve the original and add a dated correction or addendum consistent with applicable policy.

If you realize after the death that a previous note contains an error, add a dated addendum that identifies the original entry, states the correction, and explains the reason. Never overwrite the original.

The Therapist's Grief Counseling Framework includes the complete post-mortem HIPAA compliance protocol — personal representative verification checklists, subpoena response procedures, family communication scripts, and the final documentation templates that protect your practice when a client's records become the subject of a legal request.