NRPM: Standards for Privacy of Individually Identifiable Health Information. b. Proposed requirements.


Proposed § 164.510(e) would allow covered entities to disclose protected health information about a deceased person without individual authorization to coroners and medical examiners, consistent with other law, for the purpose of a post-mortem investigation.

We recognize that a deceased person’s medical record could include information that potentially could reveal health information about others, for example, relatives who have the same genetically linked disease as the deceased individual. In developing this section of the proposed rule, we considered requiring covered entities to redact any protected health information about persons other than the deceased before giving the record to coroners or medical examiners.

We rejected this option for two reasons. First, coroners and medical examiners typically need significant portions of a deceased person’s medical record, and, in some cases, all medical records that are available, to conduct a post-mortem investigation, which may also include an autopsy. Second, they need to obtain the record quickly, because there is a limited time period after death within which an autopsy can be conducted. Requiring covered entities to take the time to review and redact portions of the health information before providing it to a coroner or medical examiner would create delays that could make it impossible to conduct an autopsy appropriately. Nothing in this rule would prohibit a covered entity from undertaking such redaction on its own initiative so long as the information provided would meet the needs of the coroner or medical examiner.

In addition to these two reasons, it is our understanding that health care providers, as a standard record keeping practice, rarely identify specific persons other than the patient in the record. We are soliciting comment on whether health care providers routinely identify other persons specifically in a individual’s record and if so, whether we should require the provider to redact the information about the other person before providing it to a coroner or medical examiner.

Under §164.518(c), covered entities would have an obligation to verify the identity of the coroner or medical examiner making the request for protected health information and the legal authority supporting the request, before the disclosure would be permitted under this subsection. Preamble section II.G.3. describes these requirements in more detail.

We intend to allow only those disclosures that are authorized by other applicable law. Laws vary widely regarding release of health information to coroners and medical examiners for the purposes of identifying deceased persons or determining cause of death, and we do not intend to disturb those practices.