PHI Access and Release for Deceased Patients

According to the Office for Civil Rights (OCR), the Privacy Rule allows for pharmacies to disclose PHI about a deceased patient to person(s) involved in the individual’s health care prior to their death, unless doing so is going against the patient’s documented requests. If under law an executor, administrator, or similar individual has the authority to act on behalf of the deceased patient, a pharmacy can treat that person as a personal representative with respect to disclosing PHI.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

When assessing a deceased patient PHI request, can you ensure the relationship to the patient is understood to the extent you feel comfortable with disclosing a patient’s PHI? In such precarious situations, documentation is key. If there is a question about how to proceed, partner with your pharmacy’s Privacy Officer. For PAAS National® Fraud, Waste & Abuse and HIPAA Compliance members, reference Section 10.5 of your Policy and Procedure Manual and utilize Appendix B documents. The Manual, and PAAS staff, are here as a resource to make sure the pharmacy is aware of how to proceed appropriately.  Reach out to PAAS for additional guidance by calling (608) 873-1342 or emailing info@paasnational.com.

PAAS Tips:

  • Properly vet individuals who are requesting PHI on a patient’s behalf. Could you justify giving them the deceased patient’s PHI if asked? What supporting documentation would you have?
  • Document all PHI requests whether such requests have been granted or denied
  • Retain forms for a period of at least six years after date last in effect
Meredith Thiede, PharmD
Latest posts by Meredith Thiede, PharmD (see all)