Employers HIPAA Obligations for Deceased or Incapacitated Employees

After the death or incapacitation of an employee, family members and other interested parties may request medical information from the employer. However, many employers required to follow the Health Insurance Portability and Accountability Act of 1996 (HIPAA) do not have policies for protecting the employee’s medical information after the employee dies or is incapacitated. Here are some general guidelines for who can receive the  employee’s HIPAA protected information in such a case:

• The person considered the employee’s legal representative as directed by state law, such as the estate’s administrator, may receive health information regarding the employee.
• Other close family members may only receive information if it relates to their involvement in the care or payment of care for the employee, and the employee did not previously express otherwise to the employer.
• Information may also be released to law enforcement if for use in a criminal investigation.

See Brandon K. Johnson, HIPAA Considerations In The Event of Employee Death or Incapacitation, The National Law Review, Dec. 5, 2014.

Special thanks to Jim Hillhouse (Professional Legal Marketing (PLM, Inc.)) for bringing this article to my attention.