HIPAA regulations strictly control access to a deceased spouse’s medical records, including those from Medicare. You can only access these records if you legally represent their estate or have permission to access them.

Thinking about death can be difficult, but as we age, that possibility becomes increasingly real.

If your partner has a chronic condition, is living with an end stage illness, or if you’re both at an age when health problems are more likely to occur, it’s wise to ensure you both have access to each other’s medical records in case one of you passes away.

This article discusses what you need to know about getting medical records for a spouse after their death, including from health insurance like Medicare.

The best way to make sure you have access to your partner’s medical records in the event of their death is to have them grant you this permission while they are still living.

The primary way to do this is to fill out a HIPAA release form, which is standard in all states except California and Texas.

The Health Insurance Portability and Accountability Act (HIPAA) guarantees that you or your authorized representative can access health records held by hospitals, healthcare facilities, and health plan providers.

In addition, it might be a good idea to make a will that designates your spouse as the executor of your estate, and vice versa. This will grant you or your spouse automatic access to each other’s medical records under HIPAA.

Marriage under HIPAA

HIPAA allows the release of deceased medical records to a spouse due to the HIPAA Privacy Rule. This law recognizes how important family members, like spouses, are in a patient’s healthcare journey.

It allows healthcare providers to share information with them under certain conditions and treats a personal representative almost like the patient when they need protected health information (PHI). The rule also ensures that genetic details, including those of family members, are protected from being used in insurance decisions.

Several major court decisions over the years have also helped expand the recognition of same-sex marriages. Under HIPAA, the terms marriage, spouse, and family member include all lawful marriages and their dependents, regardless of gender.

According to HIPAA, any legally recognized marriage, whether from here or abroad, counts, and a spouse is defined as anyone in such a marriage.

To access your spouse’s medical records from Medicare, the best course of action is to fill out the Authorization to Access Medicare Information form.

In addition, you can also designate each other as medical representatives or healthcare proxies, which typically requires a power of attorney, depending on the laws in your state.

Note that in the event of your death or that of your spouses, you will need to inform the Social Security Administration (SSA). The SSA will then automatically update Medicare.

If your spouse was insured by Medicare Advantage (Part C), Medigap, a Part D plan, or another private insurance plan, you must notify these insurers separately.

The HIPAA Privacy Rule provides guidelines on handling protected health information (PHI) to keep it safe from misuse or unauthorized access. This rule ensures that your PHI and privacy are protected not just during your lifetime but also for 50 years after your death.

So if your spouse hadn’t filled out either a Medicare or HIPAA release form before their death, how you’ll get access to your spouse’s medical records depends on the state.

In some states, if there is no will that designates a legal executor, the law automatically gives you priority access to records as the person’s spouse, followed by your children.

But in other states, the only way to do it is to become a legal executor of your spouse’s estate, which usually requires a court order but grants an automatic legal right to the deceased person’s medical records. In this case, providers or insurers would not violate HIPAA by granting you your spouse’s records.

Sample letter requesting medical records of deceased parent or spouse

While the HIPAA Privacy Rule offers protection for up to 50 years after death, it doesn’t require that medical records be kept or archived for that long.

For this reason, it’s essential to educate yourself on the specific laws in your state to understand the right timeframes for keeping and disposing of such records.

Once you have legal access to your deceased partner’s medical records, you’ll need to request those records from your partner’s insurer or healthcare professional.

In the context of Medicare, the Centers for Medicare & Medicaid Services (CMS) recommends writing a letter to the CMS office in your area using a specific format, which you can consider following regardless of which entity you’re petitioning for access.

You might need to access a deceased loved one’s medical records to handle administrative tasks like billing, social security, workers’ compensation, and insurance claims, or, for example, to preserve family history and contribute to medical research.

The laws regarding whether you’d be responsible for your deceased spouse’s medical bills depend on your state. The nonprofit organization Triage Cancer has a helpful list of the laws in individual states.

An adult child of a deceased parent should follow the same process for requesting access to medical records before or after death as they would if they were a spouse. That said, there are states where the priority for access will go to the spouse before the child.

Contemplating mortality can be challenging, but if your partner is living with a chronic condition or an end stage illness, or if you’re both at an age where health issues are more prevalent, it’s prudent to ensure you have mutual access to each other’s medical records in the event one of you passes away.

It’s essential to prepare in advance, if possible, because HIPAA regulations strictly govern access to a deceased spouse’s medical records, including those from Medicare. You can only obtain these records if you have legal authority over their estate or have been granted special permission to access them.