HIPAA Privacy - Deceased Individuals 164.502(f)

Overview:
§164.502(f)
Standard: Deceased individuals:
A covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual. From § 160.103 Definitions. Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition,[….] (2) Protected health information excludes individually identifiable health information: [….] (iv) Regarding a person who has been deceased for more than 50 years.

Action Items:
1) Obtain and review policies and procedures regarding use and disclosure of deceased individuals' PHIs. Evaluate whether the policies and procedures are consistent with the established performance criterion.

Related Documents:
1) Policies and procedures regarding use and disclosure of deceased individuals' PHIs.

Additional Guidance:
Covered entities may disclose protected health information to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.