Ethics and Morality
HIPAA Compliance After a Patient Dies
How therapists should respond to media requests in high-profile cases.
Posted July 23, 2024 Reviewed by Michelle Quirk
Key points
- MHPs offer patients confidentiality to build trust and encourage open communication.
- Under HIPAA, the duty to protect a patient’s health information extends 50 years after their death.
- MHPs shouldn't share confidential information with media after patients die, unless they've provided consent.
Imagine you had been working with Picard, a mental health patient1 who was involved in a high-profile situation that led to multiple deaths, including Picard’s. Perhaps Picard was involved in a violent crime, a murder-suicide, or a mass gun shooting incident.
The police, the community, the victims’ families, and the public are all eager to understand Picard’s motivations and background: Why did Picard have a gun, what was Picard’s childhood like, what was Picard’s mental health condition, what types of services was Picard receiving, and why wasn’t something done to prevent the tragic events?
Family members inform a journalist that you provided mental health services to Picard in recent months. The journalist requests an interview, believing your insights could help the public gain a better understanding of Picard, and perhaps learn about risk factors and measures to take to prevent similar atrocities.
You recognize the potential value of speaking with the journalist but are also aware of your duty of confidentiality. You wonder, “Under what circumstances, if any, may I divulge information about a patient after the patient’s death?”
The Life of Confidentiality
In the early stages of the helping process, mental health professionals (MHPs) assure patients that the information they share will remain confidential. Typically, MHPs do not specify how long that confidentiality lasts, leading patients to assume that it continues indefinitely.
The Health Insurance Portability and Accountability Act (HIPAA, 1996) states that the duty to protect individually identifiable health information lasts 50 years following the patient’s death. Interestingly, the codes of ethics of the National Association of Social Workers (NASW, 2021, Standard 1.07) and the American Psychological Association (APA, 2016, Standard 4) do not indicate whether the duty of confidentiality ends upon the death of a patient or after a certain period.2
Standard 1.07(k) of the NASW Code, for instance, states, “Social workers should protect the confidentiality of clients when responding to requests from members of the media.” On a plain-language reading of this standard, it seems that the duty of confidentiality is ongoing. Standard B.3.f. of the American Counseling Association (ACA, 2022) states, “Counselors protect the confidentiality of deceased patients, consistent with legal requirements and the documented preferences of the client.” This indicates an enduring ethical obligation to maintain confidentiality, unaltered by a patient’s death.
Legally Prohibited Versus Legally Permissible
HIPAA clearly prohibits breaching patient confidentiality for at least 50 years after the patient’s death. Therefore, in the situation where a journalist asks for information about Picard shortly after his death, you should not divulge any information—including whether Picard was one of your patients.
Yet assume the journalist’s request comes 50 years after Picard’s death. Although this type of request seems unlikely, it is worth noting that ethical codes for MHPs have no “expiration date” for confidentiality. Even though it may be legally permissible, sharing information at this point could still be considered a breach of confidentiality.
Exceptions to Confidentiality
Confidentiality is not an absolute ethical principle. There are exceptions—such as situations involving child abuse, abuse of adults with mental and physical incapacities, or a court order compelling MHPs to testify.
Still, none of these exceptions seem to apply to Picard’s situation. Some might argue that Picard’s next of kin could provide consent to release information about Picard to the media. Remember, your duty of confidentiality is owed to the patient: It is the patient, not the patient’s family, who may provide permission.
If Picard signed a confidentiality agreement stating that confidentiality ends upon his death, then it might be ethical to share information with the media upon his death. Although it is unlikely that most patients would sign such an agreement, it is conceivable in certain circumstances.
Conclusion
Prudent practice, therefore, suggests that MHPs should maintain patient confidentiality even after a patient dies. Laws that permit the disclosure of patient information after a specific period do not negate our ethical duties of confidentiality. Although marriage vows may be sacred “until death do us part,” an MHPs duty to respect patient confidentiality does not expire with the patient’s death.
References
1. For consistency, this article primarily uses the term “patient” rather than “client” because the Health Insurance Portability and Accountability Act uses this term. For accuracy, the term “client” is used in direct quotations from relevant codes of ethics.
2. Interestingly, the NASW Code does contemplate the death of social workers, stating that they should take steps to protect patient confidentiality even after the social worker dies.
American Counseling Association [ACA]. (2014). Code of ethics.
American Psychological Association [APA]. (2017). Ethical principles of psychologists and code of conduct.
Barsky, A. E. (2024). Clinicians in Court: A Guide to Subpoenas, Depositions, Testifying, and Everything Else You Need to Know. Guilford Press.
Health Insurance Portability and Accountability Act [HIPAA]. (1996), Pub. L. No. 104-191.
National Association of Social Workers [NASW]. (2021). Code of ethics.