HIPAA After Death in a Nursing Home: What Staff Can and Cannot Disclose

The Record Request That Arrives Before the Funeral

A daughter calls the nursing station three hours after her father's death. She wants to see his medication records from the past week — she thinks something was missed. The charge nurse wants to help. But opening that chart and sharing its contents without following the right steps can trigger a federal HIPAA violation that follows the facility for years.

This scenario plays out constantly in long-term care. Staff want to comfort grieving families with transparency, but HIPAA's post-mortem protections are stricter than most nurses realize.

The 50-Year Protection Window

Under the HHS Omnibus Rule, a deceased resident's Protected Health Information remains fully safeguarded under HIPAA for 50 years following the date of death. That means a resident who dies in 2026 has privacy protections running through 2076.

This is not a technicality that regulators overlook. The Office for Civil Rights investigates post-mortem HIPAA complaints, and nursing homes have faced corrective action plans for unauthorized disclosures made during the chaos of the first 24 hours after a death.

Who Gets Access — and Who Doesn't

The Personal Representative

The only person with full, unrestricted access to a deceased resident's complete medical record is the legally appointed personal representative of the estate. This is typically an executor named in a will or a court-appointed administrator.

The personal representative must produce official documentation — letters testamentary, letters of administration, or a court order — before the facility can release any records. Verbal claims of authority are not sufficient.

One critical point that catches families off guard: a healthcare power of attorney expires the moment the patient dies. The person who made medical decisions for the resident last week may have no legal authority over the records this week. The authority transfers to whoever the probate court appoints.

The Involved-in-Care Exception

Under 45 CFR § 164.510(b)(5), staff may share limited medical information with family members or close friends who were directly involved in the resident's care or payment for care before death. But "limited" means exactly that:

• The information must be relevant to that person's specific involvement
• The disclosure cannot contradict any preferences the resident expressed while alive
• Broad disclosures of unrelated medical history, psychiatric records, or past diagnoses remain violations

A daughter who managed her father's medications can be told about his final hours and the clinical circumstances of his death. She cannot be handed his complete chart, his psychiatric history, or his records from a previous facility.

What About the Roommate?

The fact that someone has died is not PHI — it is a matter of public record. Staff can and should tell the roommate that their friend has passed away. But disclosing how or why the resident died — the diagnosis, the clinical details, the medication changes — is a HIPAA violation, even if the roommate asks directly.

The Three Mistakes Staff Make Most Often

Over-sharing during the bedside conversation. A nurse who feels pressure from a crying family member starts explaining lab results, medication adjustments, or clinical decisions from the previous shift. Each detail that goes beyond the immediate circumstances of the death is a potential violation.

Releasing records to the wrong family member. Not every relative has legal authority. An adult child who was estranged, a sibling who was not involved in care, or a family friend — none of these qualify unless they hold the personal representative designation or fall under the involved-in-care exception.

Failing to keep required disclosure records. Keep any HIPAA disclosure records, written authorizations, breach analyses, and administrative reviews required by the facility's procedures and applicable rules. The facility must retain this documentation for a minimum of six years.

How to Handle Records Requests the Right Way

When a family member requests records after a death, the process should follow this sequence:

1. Ask whether they are the court-appointed personal representative of the estate
2. If yes, request official documentation (letters testamentary, court order) before releasing any records
3. If no, determine whether they qualify under the involved-in-care exception — and limit disclosures to what is relevant to their involvement
4. Record disclosures as required by the facility's procedures and applicable HIPAA documentation rules
5. Retain HIPAA disclosure records, written authorizations, breach analyses, and administrative reviews for a minimum of six years

Building a System That Protects Staff and Families

Individual nurses should not be making HIPAA judgment calls alone at 2 a.m. The facility needs a clear protocol that walks every staff member through the same decision tree — who can receive information, what level of detail is permissible, and how to document every interaction.

The Nursing Home Staff — Family Communication After Death toolkit includes a HIPAA Decision Matrix designed for exactly this scenario: a shift-ready reference that helps staff give families the information they are entitled to while protecting the facility from violations.

Grief and compliance do not have to be in conflict. A clear protocol means staff can be both compassionate and legally protected — and families get honest answers without unnecessary delays.