The Therapist
May/June 2017
Anastasia Johnson, JD (Former CAMFT Staff Attorney)
Updated November, 2022 by Alain Montgomery, JD (CAMFT Staff Attorney)

Having a current or former patient pass away can be one the most challenging and devastating times for a therapist. Not only must the therapist confront their own emotional reaction to the loss and grief, often times the deceased patient’s friends and family want to talk to the therapist about the deceased patient, or may even want a copy of their records. One of the many questions that can confront the therapist at such a time is “What is my responsibility with respect to the patient’s right to confidentiality?” The right to confidentiality does not end at death, in fact, the therapists must continue to protect patient confidentiality after the patient’s death. This article will discuss some of the most common situations a therapist may confront when dealing with a request for a deceased patient’s psychotherapy records. 

Please note that both California law and Health Insurance Portability and Accountability Act (HIPAA) are referenced in this article. Therapists who are considered “covered entities” should comply with HIPAA law, unless California law provides more protection to patients’ privacy and confidentiality rights. For further reading about whether you or your practice is a covered entity, please see “Are you a Covered Entity” by David Jensen, JD, which can be found on the CAMFT website at www.camft.org.  

1.  With limited exceptions, only the Personal Representative has the right to access a deceased patient’s records.  
The “personal representative” has a right under California and HIPAA to access a deceased patient’s (“decedent”) records. This individual is the only person who, by law, has the authority to authorize access to or release a copy of a decedent’s records, with limited exceptions. ^{1 2}  

2. The term “personal representative” has different titles depending on whether the decedent had a will.  
Under California law, the choice of a personal representative depends on whether the decedent left a will (the legal document instructing how his or her estate is to be divided). If the will names a personal representative, that person is called an executor. The court will accept the representative unless they do not meet statutory qualifications. If there is no legally valid will, the decedent is said to have died intestate. In such cases, the court appoints a personal representative for the decedent’s estate. The court-appointed representative is called an administrator. 

In California, a personal representative must be at least 18 years old and must not be subject to conservatorship. Therefore, it is not likely that the personal representative would be a patient’s minor child or an adult child under conservatorship.^{3 4 5}

HIPAA states that a person must be treated as a personal representative when “under applicable law an executor, administrator or other person has authority to act on behalf of a deceased individual or of the individual’s estate.” ⁶

3. Therapists should request and review certain legal documents which provide information about the right of access.  
In California, the personal representative will have “Letters” which are the official documents from the court. The documents are also referred to as “letters testamentary” for executors or “letters of administration” for administrators. Other appropriate documentation may also be a copy of the last will and testament or other court document naming the personal representative, executor, administrator, fiduciary or trustee. On request for inspection or copies of the deceased patient’s clinical record, you should ask for a copy of one of these documents.  

4. The Personal Representative is the holder of the psychotherapist-patient privilege for a deceased patient.  
In California, the issue of privilege is addressed in the Evidence Code. The law asserts that after death, the psychotherapist-patient privilege passes to the personal representative of the decedent.⁷ Therefore, if a therapist receives a subpoena for records, the therapist should try to confirm the holder of privilege and obtain the appropriate signed authorization before releasing information, without a court order.  

5. A signed HIPAA release form authorizing disclosure of confidential information is sufficient for the named recipient to view a patient’s records after his or her death.  
The revised Privacy Rule under HIPAA now allows family members, relatives, and others who had access to a patient’s protected health information prior to death through a HIPAA release form to have those same access rights after the patient’s death, but only up until the expiration date indicated on the release form.8 It is important to note that this amendment does not change the authority of a decedent’s appointed personal representative with regard to the decedent’s protected health information. The personal representative would continue to have the right to access protected health information of the decedent, as well as to authorize the use and disclosure of the protected health information that are not otherwise permitted or required by the Privacy Rule.  

6. There are limitations to what you should disclose to law enforcement and government agents.  
A covered entity may disclose protected health information about a deceased patient to a medical examiner, forensic pathologist or coroner for the purpose of their investigation. Disclosure of protected health information may also be made for the purpose of identifying the decedent or locating next of kin, or when investigating deaths that may involve public health concerns, suspicious deaths, unknown deaths, or criminal deaths.⁹  

In other situations, if a law enforcement or government agent is requesting confidential information about a deceased patient, the therapist should consider the following issues before responding:  

• If the therapist is unfamiliar with the law enforcement or government agent, the therapist must verify the identity of the person by requesting identification.¹⁰  
• When reasonable to do so, the therapist should limit disclosure to what is minimally necessary. Therapists may rely upon the representations of the law enforcement or government agent (as a public officer) as to what information is minimally necessary for their lawful purpose.11 12  
• If law enforcement offers the legal document that fits within one of the exceptions allowing disclosures (such as a court order or a lawfully issued warrant) the provider should explain their limits to law enforcement. It is important to note California has somewhat stronger privacy rules that require court involvement, and because HIPAA does not preempt more privacy-protective state laws, these laws must also be followed. In California, search warrants for medical records are generally authorized under the Penal Code and require judicial approval. And in California, if an administrative subpoena is issued, an authorizing court order is needed before the therapist can provide confidential information or records to law enforcement.¹³ 

7. A coroner or medical examiner is legally entitled to information about a deceased patient in certain circumstances. 
HIPAA allows covered entities to disclose protected health information including psychotherapy notes, when it is requested by a coroner or medical examiner for three specific purposes 1) to identify a deceased patient, 2) to determine a cause of death, or 3) other duties as authorized by law.¹⁴ California law actually compels therapists to disclose information requested by the coroner’s office in the course of an investigation for the purpose of identifying the decedent or when investigating certain deaths that may involve public health concerns, such as suicides or accidents. The information disclosed should be limited to information regarding the patient who is the decedent and who is the subject of certain investigations, such as investigations of suicide.¹⁵ A coroner’s office is prohibited by law from disclosing the information contained in the clinical record to a third party without a court order or other legal authorization.¹⁶ 

California law also imposes an additional condition that requires the provider first get a written request from the coroner or medical examiner for the health information.¹⁷ The request should be retained as part of the deceased patient’s record. 

8. Recommendations for Best Practices  
A good rule to remember is that California and HIPAA laws generally apply to a deceased person’s protected health information to the same extent as to a living person’s information. If the laws require a valid authorization for the release of the patient’s confidential information and the person is deceased, the therapist should generally obtain the authorization from the deceased person’s personal representative before releasing the information.¹⁸  

Also remember that even after patients die, therapists and covered entities can still face liability for breaching the patient’s confidentiality. This article does not offer any legal advice and should not be relied on for such. Prior to sending any records or taking any action that could be governed under HIPAA or California law, it is suggested that therapists obtain legal consultation.  

Endnotes

¹ Health and Safety Code §§ 123110, 123105(e); Civil Code §56.11(c)(4)  
² Probate Code§ 58  
³ Evidence Code §1158  
⁴ Health & Safety Code §§123100, 123149.5  
⁵ 45 CFR 164.502(g)(4)  
⁶ 45 CFR § 164.502(g)(4)  
⁷ Evidence Code § 1013(c)  
⁸ 45 CFR §164.502(g)(4) 
⁹ Civil Code 56.10(b)(8)  
¹⁰ 45 CFR § 164.514(h)  
¹¹ 45 CFR § 164.502(b), 164.514(d)  
¹² 45 CFR § 164.514(d)(3)(iii)(A) 
¹³ Penal Code, § 1543  
¹⁴ 45 C.F.R. § 164.512(g)(1)  
¹⁵ Civil Code 56.10(b)(8)  
¹⁶ Civil Code 56.10(b)(8)  
¹⁷ HIPAA Privacy and Security http://www.hcpro.com/content/42703.pdf  
¹⁸ 45 C.F.R. § 164.502(f)(g)