HIPAA Compliance After a Patient Dies

Imagine you had been working with Picard, a mental health patient¹ who was involved in a high-profile situation that led to multiple deaths, including Picard’s. Perhaps Picard was involved in a violent crime, a murder-suicide, or a mass gun shooting incident.

The police, the community, the victims’ families, and the public are all eager to understand Picard’s motivations and background: Why did Picard have a gun, what was Picard’s childhood like, what was Picard’s mental health condition, what types of services was Picard receiving, and why wasn’t something done to prevent the tragic events?

Family members inform a journalist that you provided mental health services to Picard in recent months. The journalist requests an interview, believing your insights could help the public gain a better understanding of Picard, and perhaps learn about risk factors and measures to take to prevent similar atrocities.

You recognize the potential value of speaking with the journalist but are also aware of your duty of confidentiality. You wonder, “Under what circumstances, if any, may I divulge information about a patient after the patient’s death?”

The Life of Confidentiality

In the early stages of the helping process, mental health professionals (MHPs) assure patients that the information they share will remain confidential. Typically, MHPs do not specify how long that confidentiality lasts, leading patients to assume that it continues indefinitely.

The Health Insurance Portability and Accountability Act (HIPAA, 1996) states that the duty to protect individually identifiable health information lasts 50 years following the patient’s death. Interestingly, the codes of ethics of the National Association of Social Workers (NASW, 2021, Standard 1.07) and the American Psychological Association (APA, 2016, Standard 4) do not indicate whether the duty of confidentiality ends upon the death of a patient or after a certain period.²

Standard 1.07(k) of the NASW Code, for instance, states, “Social workers should protect the confidentiality of clients when responding to requests from members of the media.” On a plain-language reading of this standard, it seems that the duty of confidentiality is ongoing. Standard B.3.f. of the American Counseling Association (ACA, 2022) states, “Counselors protect the confidentiality of deceased patients, consistent with legal requirements and the documented preferences of the client.” This indicates an enduring ethical obligation to maintain confidentiality, unaltered by a patient’s death.

Legally Prohibited Versus Legally Permissible

HIPAA clearly prohibits breaching patient confidentiality for at least 50 years after the patient’s death. Therefore, in the situation where a journalist asks for information about Picard shortly after his death, you should not divulge any information—including whether Picard was one of your patients.

Yet assume the journalist’s request comes 50 years after Picard’s death. Although this type of request seems unlikely, it is worth noting that ethical codes for MHPs have no “expiration date” for confidentiality. Even though it may be legally permissible, sharing information at this point could still be considered a breach of confidentiality.

Exceptions to Confidentiality

Confidentiality is not an absolute ethical principle. There are exceptions—such as situations involving child abuse, abuse of adults with mental and physical incapacities, or a court order compelling MHPs to testify.

Still, none of these exceptions seem to apply to Picard’s situation. Some might argue that Picard’s next of kin could provide consent to release information about Picard to the media. Remember, your duty of confidentiality is owed to the patient: It is the patient, not the patient’s family, who may provide permission.

If Picard signed a confidentiality agreement stating that confidentiality ends upon his death, then it might be ethical to share information with the media upon his death. Although it is unlikely that most patients would sign such an agreement, it is conceivable in certain circumstances.

Conclusion

Prudent practice, therefore, suggests that MHPs should maintain patient confidentiality even after a patient dies. Laws that permit the disclosure of patient information after a specific period do not negate our ethical duties of confidentiality. Although marriage vows may be sacred “until death do us part,” an MHPs duty to respect patient confidentiality does not expire with the patient’s death.

Ethics and Morality Essential Reads

How Patience Is the Virtue of Remaining in Difficulty

How Does Morality Develop and Differ as We Age?