How would the proposed modifications affect PHI of decedents?
There are two primary proposed changes. The proposed modifications would permit covered entities to disclose a decedent’s information to family members and others who were involved in the care or payment for care of the decedent prior to death (in addition to the decedent’s personal representative), unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity. As discussed in Part One, HHS has proposed to modify the definition of PHI to include individually identifiable health information of a person who has been deceased for 50 or fewer years. In addition, the proposed modifications would require a covered entity to comply with the Privacy Rule with regard to the PHI of a deceased individual for a period of 50 years following the date of death. The 50 year period (which would take us back to individuals deceased since 1960) is new.
