HIPAA authorization after death: a deceased insured's medical records

A HIPAA authorization remains valid after death until the expiration date or event written on it, unless it was revoked or is defective; the insured's death is not one of the defects the Privacy Rule lists. So the authorization an insured signed with a life application can still support record requests on a contestable death claim, and while the insurer has a right to contest, it cannot be revoked to block the review. Its weak point is time: where a state adopted the NAIC privacy model, an application authorization lasts at most 30 months from signing, and many forms say less. When it has expired, or a provider will not accept it, the insurer asks the estate's personal representative, usually the executor or administrator, to sign a new one. Botminds' Contestable Claim Review requests each source under the signed authorization and chases it until it arrives, so the review starts with complete records and the beneficiary is asked for as little as possible.

Is a HIPAA authorization valid after death?

Yes, until its own expiration date or event. The Privacy Rule says an authorization is not valid if "the expiration date has passed or the expiration event is known by the covered entity to have occurred", if it is incomplete, if it is known to have been revoked, if it breaks the rules on combining or conditioning, or if material information in it is known to be false. Death is not on that list. What the form says about its own term is therefore the first thing to read.

Two drafting details decide most cases. A form whose expiration event is the individual's death fails the moment the provider knows of the death, which on a death claim it always will. A form with a fixed term, such as a number of months from signing, survives the death and runs to that date. Every authorization must carry one or the other: the rule requires "an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure."

Revocation is the other question, and the rule answers it for insurers. An individual may revoke an authorization in writing at any time, except to the extent the provider has already relied on it or "if the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself." During the contestable period that exception keeps an application authorization from being withdrawn to stop the review. What an application authorization must contain in the first place is covered in HIPAA authorization for life insurance.

Why the application authorization so often runs out on a contestable claim

Because its term and the contestable period are measured from different dates, and the claim adds weeks after both. In states that adopted the NAIC's Insurance Information and Privacy Protection Model Act, an authorization signed with a life application may last no longer than "thirty (30) months from the date the authorization is signed". The contestable period usually runs two years from issue, and the authorization was signed at application, often weeks before.

A death late in the period, plus the time to receive the death certificate and claimant statement, can leave a 30-month form near its end; a form written with a shorter term may already have lapsed. A new authorization signed for the claim has a different ceiling under the same model: for a claim that is not for a health insurance benefit, it may last for "the duration of the claim". That is why many carriers ask the estate to sign one at claim intake even when the application form is still in date: it removes the expiry risk for the rest of the review.

Who signs for a deceased insured? The personal representative under state law

The person state law gives authority to act for the decedent or the estate, usually the executor named in the will once appointed, or a court-appointed administrator. HIPAA does not choose that person; it requires providers to honour whoever has the authority. A provider must treat as personal representative an "executor, administrator, or other person" with authority to act for the deceased or the estate, for the information relevant to that representation.

HHS states the scope plainly. During the 50 years of protection, the personal representative "has the ability to exercise the rights under the Privacy Rule with regard to the decedent's health information, such as authorizing certain uses and disclosures of, and gaining access to, the information." Its guidance on personal representatives gives the example that an executor has the right to access all of the decedent's information relevant to those responsibilities, and adds that "State or other law should be consulted to determine the authority of the personal representative".

For the claims file that means two documents, not one. The authorization signed by the representative must carry, under the rule, "a description of such representative's authority to act for the individual", and providers will ask for proof of that authority, typically the court's appointment of the executor or administrator. Where no one has yet been appointed, the authority question belongs to state probate law, and the request waits for it. Family members who are not the representative have a narrower route: a provider may share with them what is relevant to their own involvement in the person's care or payment before death, "unless doing so is inconsistent with any prior expressed preference of the individual". That is a permission for the provider, not a channel an insurer can rely on.

Three routes to a decedent's records on a contestable claim

A life insurer has three ways to obtain a deceased insured's records, and each leaves a different trail in the file. Which one an examiner uses decides how long the records take, what the provider will test and how the beneficiary experiences the review.

A fourth lever sits with the representative rather than the insurer. Under the access rule a personal representative can ask a provider to send a copy directly to a third party: if the request "directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy", on a written, signed request naming the recipient. That request carries the access rule's 30-day clock, which an authorized disclosure to an insurer does not.

What can a life insurer require of the beneficiary?

The claim form, proof of death and honest answers, but in New York not the medical records. The Department of Financial Services told life insurers in 2017 that "A life insurance company cannot require a beneficiary to produce a deceased policyholder's medical records"; beneficiaries may help, but they are not required to. DFS described insurers that could not obtain the records rescinding anyway, which shifted the burden of proof onto beneficiaries. The insurer has to obtain its own evidence.

New York's statute supplies a counterweight that claims counsel should know precisely. Where the insurer proves a misstatement about medical treatment and the insured or "any other person having or claiming a right under such contract" prevents full disclosure of the impairment, "such misrepresentation shall be presumed to have been material." Declining to fetch records is not preventing disclosure; refusing to let a provider release them may be. The same DFS release warned that anyone who obtains benefits through fraud or misrepresentation on claim forms may be investigated and prosecuted.

The practical rule for an examiner follows: ask the estate for a signature where one is needed, never for the chart. A signature request through an approved template is one contact; a request to collect records from four providers is a burden the regulator has said the beneficiary need not carry, and a file that shows one invites a complaint. Why a rescission must then rest on the insurer's own evidence, tested on the manual in force at issue, is set out in the materiality test before a rescission.

How long do providers take to release a decedent's records?

HIPAA sets no deadline for a disclosure made under an authorization; the 30-day clock applies only to an individual's or representative's own access request. A provider must act on an access request "no later than 30 days after receipt of the request", with one extension of up to 30 more if it explains the delay in writing, and may charge only a reasonable, cost-based fee. A request from an insurer under an authorization is a permitted disclosure, released on the provider's own schedule, which is why records retrieval is mostly follow-up.

The insurer's own clocks keep running meanwhile. The NAIC's life and health claims model, which many states drew on, expects the insurer to "begin any necessary investigation of the claim within fifteen (15) days" of proof of loss, to send the beneficiary a reasonable written explanation once the claim is unresolved for 30 days, and to write again 45 days from notice and every 45 days after while the investigation is incomplete. Records retrieval usually decides how many of those letters a file needs; the whole calendar of a contestable file, with interest, is in how long a life insurance investigation takes.

Record retention: why the requests go out in the first week

HIPAA protects a decedent's records for 50 years but does not require anyone to keep them. HHS is direct: "No, the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained." After 50 years the information is no longer protected health information at all (45 CFR 160.103), which matters to archives, not to claims.

For a contestable review the risk runs the other way. The question is what the insured knew and was told in the years before the application, and the records that answer it sit with practices that close, merge or purge on their own schedules, and with pharmacies whose dispensing records follow their own retention rules. Sending every request in the first days after proof of loss, under an authorization checked for its term, is cheaper than chasing a record that no longer exists. The pharmacy's own dispensing record matters for a particular reason, explained in what the prescription history report misses.

What a decedent records file should be able to prove

That every page was obtained under authority that was valid on the day it was requested, and that the beneficiary was asked for no more than the law allows. Market conduct examiners, claims counsel and, in a rescission suit, a court can ask those questions of the file, not of the examiner's memory.

Where Contestable Claim Review fits in decedent records retrieval

Contestable Claim Review's records retrieval agent requests each source under the signed authorization, follows up with a provider that has not sent records on an interval the carrier sets (seven days in the sample settings), and logs each page received; the review starts only when the sources are complete. It never requests without a signed authorization and contacts the family only with approved templates.

Each source requested under the executor's authorization, chased until it arrived

In the sample claim the insured, 53, died in month 18 of a $1,500,000 term policy issued through an accelerated program with no exam and no physician statement, so the claim was the first time anyone read his records. His wife was both beneficiary and executor, and signed one authorization on 11 September 2026. Four providers were asked; the last, the hospital, sent 236 pages on 6 October. With 412 pages in, the agents dated 31 events and matched 14 application answers against them in 41 minutes, and the decisions stayed with the examiner, a medical director and claims counsel.

The follow-up interval and decision target are settings in Contestable Claim Review

Questions people ask

Does a HIPAA authorization expire at death?

Not by itself. It expires on the date or event written on it, and is invalid if that date has passed or the event is known to have occurred under 45 CFR 164.508(b)(2). A form that names the individual's death as its expiration event does end at death; one with a fixed term runs to that date.

Can an executor sign a HIPAA authorization for a deceased person?

Yes, if state law gives the executor authority to act for the decedent or the estate; HIPAA then requires providers to treat the executor as personal representative. The authorization must include a description of the representative's authority, and providers usually ask for proof of the appointment.

What is a personal representative's access to medical records after death?

The same access the patient had, for the information relevant to the representation, for 50 years after death. A provider must act within 30 days, with one 30-day extension, and may charge a reasonable, cost-based fee; the representative can also direct the copy to a named third party in a signed written request.

Can a provider release a deceased patient's records to family members?

It may share information relevant to a family member's involvement in the person's care or payment before death, unless the person had expressed a contrary preference the provider knows of. That is a permission, not a right; full access belongs to the personal representative.

How long is a life insurance claim authorization valid?

Under NAIC Model #670, where a state adopted it, an authorization signed for a claim that is not a health insurance benefit may last for the duration of the claim, against at most 30 months for one signed with a life application. State versions differ, so the issue state's own law governs.

Does the minimum necessary rule apply to records sent to a life insurer?

Not to a disclosure made under an authorization: 45 CFR 164.502(b)(2) excludes uses and disclosures made pursuant to an authorization from the minimum necessary standard. The scope of what is released is set by what the authorization describes, which is why the request should name the sources and periods the review needs.