How to Get Medical Records After Death

Getting access to a deceased family member's medical records is a process that trips up almost everyone who tries it. Hospitals have gatekeepers, legal departments, and compliance officers who will decline your request if you don't have the right documentation — even when you're the spouse, the adult child, or the person who was standing in the room when your family member died.

The short version: being next of kin does not automatically give you the full HIPAA right of access to a deceased person's records. For that access, you generally need to establish personal representative status or equivalent legal authority under state law.

Who Can Access Records Under HIPAA

The HIPAA Privacy Rule protects a patient's health information for 50 years after death. During that period, a verified personal representative may exercise the deceased person's HIPAA rights. HIPAA also permits a provider to disclose relevant information to family members involved in care or payment before the death, unless that conflicts with a known preference of the deceased.

A personal representative is the person legally authorized to act on behalf of the deceased's estate. That's typically the executor named in a will, or the administrator appointed by a probate court when there's no will. In some states, a surviving spouse or adult child can qualify under state law without a formal court appointment — but the hospital isn't obligated to accept that without documentation.

The documents that establish your authority:

• Letters testamentary (if there's a will and probate has been opened)
• Letters of administration (if there's no will and the court has appointed you)
• Small estate affidavit (in states that allow it for estates below a dollar threshold)
• Court order specifically granting access to medical records

A power of attorney does not work. POA authority extinguishes at the moment of death — it cannot be used to access records after the person has died.

The Request Process Step by Step

Step 1: Identify the right department. Call the hospital's Health Information Management (HIM) or Medical Records department directly. Don't go through the general information line — they'll redirect you repeatedly.

Step 2: Submit a written request. The hospital will have its own authorization form, but you can also submit a letter citing 45 CFR § 164.524, the federal regulation that establishes the right of access. Your letter should identify the patient by full name, date of birth, date of death, medical record number (if you have it), and the specific records you're requesting.

Step 3: Request the complete designated record set. Don't ask for "the chart" or "the medical records." Use the HIPAA term: designated record set. This includes clinical notes, physician orders, nursing assessments, lab results, radiology reports, operative reports, anesthesia records, and — critically — billing records. Billing files reveal what procedures were actually performed and billed, which sometimes differs from what the clinical record describes.

Step 4: Specify the format. If records are maintained electronically, you may request an electronic copy and state your preferred form and format. The provider must use that format if it is readily producible or work with you on an acceptable alternative. An electronic copy does not necessarily include system audit metadata.

The 30-Day Compliance Window

Once a covered entity receives an access request, federal law generally gives it 30 days to act. It may take one additional 30-day period if it gives written notice explaining the delay. A denial must be in writing and state the basis for it.

If the covered entity misses the applicable deadline or you believe it violated HIPAA, you can file a complaint with the HHS Office for Civil Rights (OCR). Other state-law complaint routes depend on the state and the issue.

What to Do If Records Seem Incomplete

If you suspect the clinical records you received are incomplete — missing nursing notes, gaps in monitoring logs, absent physician orders for the period surrounding the death — you can separately ask for the EHR audit trail. Depending on the system, it may record user identification, timestamps, actions, affected fields, and device or network information; it may not show every event or preserve every version of the record.

An audit trail may be requested in formal discovery, subject to the rules and any objections; it is not necessarily included in a routine access response. A written preservation request can identify the audit data you want preserved.

If you suspect records have been altered — late entries, copy-paste notes that don't match the clinical timeline, or documentation that contradicts what you personally witnessed — the audit trail is where that evidence lives.

When You Need Records Urgently

When a family suspects medical malpractice, the clock on evidence preservation starts immediately. Record-retention periods depend on applicable law and provider rules; HIPAA does not generally set a retention period for medical records. If litigation is reasonably anticipated, preservation duties may apply. A prompt written preservation request to the hospital's risk management department documents notice and asks it to preserve records, metadata, and communication logs.

For a complete framework covering medical record requests, evidence preservation timelines, and the audit trail process, the After a Medical Malpractice Death guide includes step-by-step templates for each stage.