How to Get Medical Records of a Deceased Parent

HIPAA Doesn't End at Death

The HIPAA Privacy Rule protects a deceased person's medical records for 50 years after the date of death. During that window, covered entities generally need an authorized personal representative to disclose PHI, although HIPAA permits limited disclosures to certain people who were involved in the patient's care or payment before death.

This catches most families off guard. A death certificate alone doesn't unlock medical records. A power of attorney — even a durable one — expires the moment the person dies. To get access, you need to establish yourself as the decedent's "personal representative" under HIPAA's specific rules.

Three Legal Pathways to Access

1. Court-Appointed Personal Representative (Most Reliable)

Under 45 CFR § 164.502(g)(4), a covered entity generally must treat the legally appointed executor or administrator of an estate as the patient for PHI relevant to estate administration, subject to applicable exceptions. This is the most reliable route to access.

What you need:

• Letters Testamentary (if there's a will) or Letters of Administration (if there's no will), issued by the probate court
• A certified copy of the death certificate
• Your government-issued photo ID

Once you have letters from the court, your HIPAA access is limited to PHI relevant to estate administration — which can include billing records, clinical notes, lab results, imaging reports, and insurance correspondence.

2. Next-of-Kin Default Hierarchy (When There's No Probate)

If the estate is too small for formal probate or you're still waiting for court appointment, some states may allow a relative to request records under a state-specific rule. HIPAA does not establish a nationwide next-of-kin hierarchy; ask the provider what state rule and documentation apply.

This pathway is state-dependent and discretionary — providers may release records, but they're not required to. Many hospital legal departments deny access through this route to minimize their liability exposure.

3. The Caregiver Exception (Limited Scope)

Under 45 CFR § 164.510(b)(5), a provider can disclose relevant PHI to a family member or close friend who was actively involved in the patient's care or payment for care before death. This disclosure is limited to information directly relevant to that person's involvement.

This exception is useful when you need billing records for bills you were helping pay or medical information related to treatment decisions you participated in. It doesn't grant blanket access to the full medical file.

What to Do When a Provider Refuses

Hospital billing departments regularly deny records requests from family members who don't have formal probate letters — even when state law or the caregiver exception would allow disclosure. If you're getting stonewalled:

Request the denial in writing. Ask the provider to cite the specific HIPAA provision or state law they're relying on to deny your request. This forces their compliance office to evaluate the request rather than leaving it to a front-desk staffer.

File a HIPAA complaint. If a provider denies access to PHI relevant to estate administration without an applicable exception, ask the provider to explain its basis and consider a complaint to the HHS Office for Civil Rights.

Escalate to the hospital's privacy officer. Every covered entity is required to have a designated privacy officer. Billing departments and medical records clerks may not understand the personal representative rule — the privacy officer should.

Use certified mail for requests. A formal written request with copies of your court letters, death certificate, and ID creates a documented paper trail. Providers are less likely to ignore a certified-mail request than a phone call.

Why Medical Records Matter for Estate Administration

Medical records aren't just a family keepsake — they're important evidence for auditing bills for accuracy. Without access to clinical notes and medication administration records, you may not be able to verify whether every billed charge corresponds to a service actually provided. Billing errors (upcoding, unbundling, phantom charges for services never rendered) are common and can inflate the estate's liability by thousands of dollars.

You also need records to file insurance appeals. If a claim was denied, the appeal packet requires clinical documentation — physician notes, letters of medical necessity, and lab results that support the case for coverage.

The Health Insurance & Medical Bills After Death toolkit includes step-by-step scripts for establishing HIPAA authority with providers, requesting administrative holds on accounts while records are being gathered, and conducting the line-item bill audit once you have the files in hand.