HIPAA Authorization Form (Estate)

A HIPAA Authorization Form (Estate) in the United States authorises a defined activity and evidences that the necessary permission was given.

Under 45 C.F.R. § 164.502(g), a covered entity must treat the personal representative of a deceased individual the same as it would treat the individual during their lifetime for purposes of accessing PHI. A personal representative includes an executor named in a will and granted letters testamentary by a probate court, an administrator appointed by a probate court when no valid will exists (issuing letters of administration), a successor trustee of a revocable living trust that became irrevocable upon the grantor's death, and any other person authorized under applicable state law to act on behalf of a deceased person or their estate. Without a properly completed HIPAA authorization or an applicable HIPAA exception, covered entities must refuse to disclose PHI regardless of a family member's relationship to the decedent.

The Privacy Rule protects a deceased individual's PHI for 50 years following the date of death, as established by 45 C.F.R. § 164.502(f). This 50-year protection period means that even decades after a person's death, healthcare providers and health plans remain bound by HIPAA's use-and-disclosure restrictions. The executor's authorization under § 164.502(g) cuts through this restriction, permitting disclosure of records needed for legitimate estate administration without requiring court intervention or litigation.

The HIPAA Authorization Form for Estate differs from a general HIPAA authorization used during a patient's lifetime in several critical respects. A living patient's authorization under 45 C.F.R. § 164.508 is signed by the patient or their legal representative and may be revoked at any time. An estate authorization is signed by the personal representative acting in a fiduciary capacity on behalf of the estate, and the deceased patient cannot revoke it. Additionally, the authorization must be accompanied by documentation of the personal representative's authority — typically a certified copy of letters testamentary from the probate court of the decedent's domicile state — because covered entities are required under 45 C.F.R. § 164.514(h) to verify the identity and authority of any person requesting PHI on behalf of a deceased individual.

State laws governing medical records retention and estate administration interact with HIPAA to determine the practical scope of disclosure. California Health & Safety Code § 123111 requires healthcare providers to provide copies of medical records to a patient's legal representative within 15 days of a written request. New York Public Health Law § 18 grants personal representatives the right to access a decedent's medical records. Texas Health & Safety Code § 241.154 similarly permits authorized representatives to obtain a deceased patient's records. Executors in all states must verify that the particular covered entity's record retention policies have not resulted in the destruction of older records before the HIPAA authorization is submitted.

An executor or personal representative of an estate in the United States needs a HIPAA Authorization Form for Estate whenever access to a deceased person's protected health information is necessary for legitimate estate administration purposes.

Life insurance claim processing is one of the most common reasons executors require access to medical records. When a life insurance policyholder dies, the insurance company — particularly for policies with accidental death benefits, suicide exclusions, or contestability periods (typically the first two years of a policy under standard industry practice) — will request the decedent's medical records to verify the cause of death and confirm that no exclusionary conditions apply. The executor must authorize release of records from treating physicians, hospitals, and the decedent's health insurer to help this process.

Estate tax planning and final income tax return preparation may require access to medical expense records. Under 26 U.S.C. § 213 and related IRS regulations, unreimbursed medical expenses paid within one year before death are deductible on the decedent's final Form 1040. For large estates subject to federal estate tax under 26 U.S.C. § 2001, medical expenses not deducted on the final income tax return may be deductible on the estate tax return (Form 706). Executors need complete records of medical bills, pharmacy costs, and insurance reimbursements to prepare accurate tax returns and minimize tax liability.

Wrongful death and medical malpractice claims require early access to medical records. When estate beneficiaries believe a healthcare provider's negligence contributed to the decedent's death, the attorney representing the estate must review the complete medical record — including hospital admission records, operative reports, nursing notes, medication administration records, and discharge summaries — to assess the merits of a potential claim. The statute of limitations for wrongful death claims varies by state: California Code of Civil Procedure § 335.1 sets a two-year limit; New York Estates, Powers and Trusts Law § 5-4.1 sets a two-year limit from the date of death; Texas Civil Practice and Remedies Code § 71.004 also provides two years.

Will contests and testamentary capacity challenges regularly require medical documentation. When a disappointed heir challenges a will on the grounds that the testator lacked testamentary capacity or was subject to undue influence at the time of execution, medical records documenting the decedent's cognitive and mental health status in the period leading up to and including the date of the will signing are critical evidence. Courts in California, New York, and Florida have all considered medical records as central evidence in testamentary capacity proceedings.

Settlement of medical debts requires verification of outstanding medical bills. Executors must identify, validate, and pay all legitimate debts of the estate before distributing assets to beneficiaries. Medical debts are among the most common estate obligations, and executors need access to billing records, Explanation of Benefits (EOB) statements from Medicare and private insurers, and account statements from healthcare providers to verify the accuracy of claims submitted against the estate.

A HIPAA-compliant Authorization Form for Estate in the United States must contain specific elements required by 45 C.F.R. § 164.508(c) and should include additional provisions to address the unique circumstances of estate administration.

The description of protected health information to be disclosed must be specific and meaningful under 45 C.F.R. § 164.508(c)(1)(i). The authorization should describe the types of records requested — complete medical records, billing records, pharmacy records, laboratory results, radiology reports, mental health records, substance abuse treatment records — and the time period covered. For estate purposes, the scope often includes all records from the date of a diagnosis or hospitalization through the date of death. Mental health and substance abuse records carry additional federal protections: psychotherapy notes require a separate authorization under 45 C.F.R. § 164.508(a)(2), and substance abuse treatment records are protected by 42 C.F.R. Part 2 (the Confidentiality of Substance Use Disorder Patient Records regulations), which requires specific authorization language beyond standard HIPAA.

The identity of the authorized covered entity (the disclosing party) must be stated with sufficient specificity. The authorization should name the specific hospital, physician practice, health plan, or other covered entity being asked to release records. A blanket authorization addressed to all healthcare providers generally is less useful operationally than authorizations directed to specific providers, though some covered entities will accept a general authorization accompanied by appropriate credentials.

The identity of the authorized recipient must be clearly stated. For estate purposes, this will be the executor named in letters testamentary, the administrator named in letters of administration, or the authorized attorney or estate representative. The authorization should include the executor's full legal name, their capacity (executor, administrator, trustee), and the case or file number of the probate proceeding if one has been opened.

The purpose of the disclosure must be stated. For estate authorizations, the purpose is typically estate administration, probate proceedings, insurance claim processing, or tax return preparation — specific purposes that fall within legitimate estate administration activities under 45 C.F.R. § 164.502(g).

The expiration date or event must be included under 45 C.F.R. § 164.508(c)(1)(v). For estate authorizations, a common expiration provision is a fixed date one to two years after execution, or the event of final distribution of estate assets and closing of the probate estate — whichever comes first.

The personal representative's authority documentation must accompany the authorization. The covered entity is required to verify the personal representative's authority before releasing PHI. Executors should attach a certified copy of their letters testamentary or letters of administration, along with a certified copy of the death certificate. Some covered entities also require a copy of the relevant pages of the will identifying the executor.

A statement of the right to revoke the authorization and the exceptions to revocation must be included under 45 C.F.R. § 164.508(c)(2)(i). In the estate context, this provision acknowledges that the personal representative signing the authorization may revoke it by written notice to the covered entity, though revocation does not affect disclosures already made in reliance on the authorization.

A statement concerning the potential for re-disclosure of released information by the recipient is required under 45 C.F.R. § 164.508(c)(2)(iii). The authorization must note that information disclosed pursuant to the authorization may be subject to re-disclosure by the recipient and may no longer be protected by the Privacy Rule once it leaves the covered entity's custody.

The signature of the personal representative and the date of signing are required under 45 C.F.R. § 164.508(c)(1)(vi). Because the authorization is signed by a personal representative rather than the patient, the authorization must also include a description of the representative's authority — specifically, their capacity as executor or administrator and their appointment by the relevant probate court.