Guide · HIPAA & personal representatives
Getting a deceased relative's records
Settling an estate, answering a family health question, or understanding what happened — there are real reasons to need a loved one's records. Their privacy still holds after death, so access runs through the right person. Here's how it works, gently.
How to request them
1. Confirm you're the personal representative
You'll usually need to be the executor or administrator of the estate, or otherwise have authority under your state's law to act for the deceased or the estate.
2. Gather your proof
A certified death certificate, plus documentation of your authority — often letters testamentary or letters of administration issued by a probate court. Requirements vary by state.
3. Send a written request to the provider
Ask the records or Health Information Management department for the records, attaching your proof. You're using the same right of access the person would have had.
4. Know what you can receive
You can request the designated record set — the medical and billing records used in the person's care. Providers have the standard response timelines and may charge a reasonable, cost-based copy fee.
Common questions
Are a person's medical records private after they die?
Yes. The HIPAA Privacy Rule continues to protect a person's health information for 50 years after death. Access is generally limited to the deceased's 'personal representative' — and, in some situations, to family members who were involved in the person's care. Source: HHS.
Who counts as the 'personal representative'?
The executor or administrator of the estate, or another person with authority under state law to act on behalf of the deceased or the estate. That person has the same right of access to the records that the deceased would have had. Source: HHS; 45 CFR 164.502(g).
I'm a family member but not the executor — can I get anything?
Sometimes. A provider may share information relevant to your involvement in the person's care or payment, or that isn't inconsistent with any prior expressed wishes of the deceased. But full access to the record generally requires personal-representative status. When in doubt, ask the provider's records office what it can release and what proof it needs.
Source: U.S. Department of Health & Human Services (HHS), HIPAA Privacy Rule; 45 CFR 164.502(g) (personal representatives). Records remain protected for 50 years after death. General information, not legal advice; representative requirements vary by state — check your probate court. Last reviewed: 2026.