On this page
Yes. HIPAA protects a deceased person's health information for 50 years after the date of death, and after that it is no longer protected health information (45 CFR 164.502(f); 45 CFR 160.103). During those 50 years, an executor, administrator or other person with legal authority to act for the deceased or the estate is treated as the personal representative and can exercise the person's HIPAA rights (45 CFR 164.502(g)(4)). Curve Compliance, which helps healthcare marketers keep protected health information (PHI) out of ad platforms, checked each rule on eCFR and HHS on November 2, 2026.
Book a call. Records of patients who have died stay PHI for 50 years (45 CFR 164.502(f)), including in your ad data. Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side, and keeps contact identifiers off by default on Meta, Google Ads and TikTok. Book a call with Curve.
The 50-year rule
The rule is one sentence: “A covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual” (45 CFR 164.502(f)). The definition of PHI matches it, excluding individually identifiable health information “Regarding a person who has been deceased for more than 50 years” (45 CFR 160.103).
HHS explains why 50 years: the period “balances the privacy interests of surviving relatives and other individuals with a relationship to the decedent, with the need for archivists, biographers, historians, and others to access old or ancient records on deceased individuals for historical purposes.” During that period, the rule “generally protects a decedent's health information to the same extent the Rule protects the health information of living individuals,” with a few special disclosure provisions. After it, a covered entity holding records on people who died more than 50 years ago “may use or disclose the information without regard to the Privacy Rule” (HHS).
Personal representatives
“If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative” (45 CFR 164.502(g)(4)). HHS's table of personal representatives describes the role for a deceased person as “A person with legal authority to act on behalf of the decedent or the estate (not restricted to persons with authority to make health care decisions),” with two examples: the executor or administrator of the estate, and next of kin or another family member if relevant law provides authority (HHS).
The personal representative can exercise the person's Privacy Rule rights, “such as authorizing certain uses and disclosures of, and gaining access to, the information.” For uses or disclosures the rule doesn't otherwise permit, HHS says a covered entity “must obtain a written HIPAA authorization from a personal representative of the decedent who can authorize the disclosure” (HHS). That authorization needs the usual elements plus a description of the representative's authority (45 CFR 164.508(c)(1)(vi)); see the HIPAA release form checklist. Who holds that authority depends on state and other law, so for a specific estate, talk to your counsel.
Sharing with family members
Family and friends who helped with care have their own path. If the individual is deceased, a covered entity may disclose to a family member or others “who were involved in the individual's care or payment for health care prior to the individual's death,” the PHI “that is relevant to such person's involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity” (45 CFR 164.510(b)(5)).
HHS says this “may include disclosures to spouses, parents, children, domestic partners, other relatives, or friends of the decedent, provided the information disclosed is limited to that which is relevant to the person's involvement in the decedent's care or payment for care” (HHS). Access beyond that involvement belongs to the personal representative, who can exercise the person's rights (HHS).
Other disclosures allowed after death
HHS describes “a number of special disclosure provisions relevant to deceased individuals” (HHS). Together with the family and representative rules, they are:
| Recipient | What the rule allows | Rule |
|---|---|---|
| Law enforcement | Alerting law enforcement to the death when the covered entity suspects it resulted from criminal conduct | 164.512(f)(4) |
| Coroners and medical examiners | Identifying the person, determining a cause of death, or other duties authorized by law | 164.512(g)(1) |
| Funeral directors | What they need to carry out their duties, including before death when it is reasonably anticipated | 164.512(g)(2) |
| Organ, eye and tissue donation | Facilitating donation and transplantation | 164.512(h) |
| Researchers | Research solely on decedents' information, with the researcher's representations and, on request, documentation of the deaths | 164.512(i)(1)(iii) |
| Family and friends involved in care | Information relevant to their involvement, unless that conflicts with a prior expressed preference the covered entity knows of | 164.510(b)(5) |
| Personal representative | The person's Privacy Rule rights, including access and authorizations | 164.502(g)(4) |
For the full list of permitted disclosures for living patients too, see PHI disclosure rules.
Is disclosing a death a HIPAA violation?
Not when the rule permits it. A covered entity may use or disclose PHI “to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual's location, general condition, or death,” following that section's conditions (45 CFR 164.510(b)(1)(ii)). Coroners, funeral directors and law enforcement have their own permissions, listed above.
Outside those permissions, a death tied to a person's health details is PHI like any other for 50 years (45 CFR 164.502(f)). The rules bind covered entities and their business associates; HHS lists organizations that don't have to follow the Privacy and Security Rules, such as life insurers and employers (HHS).
Marketing lists and deceased patients
For 50 years, a deceased patient's details that a covered entity holds on a mailing list, email list or ad audience are still PHI (45 CFR 164.502(f)). Marketing uses of PHI need an authorization, apart from face-to-face communications and promotional gifts of nominal value (45 CFR 164.508(a)(3)), and after death HHS says the authorization has to come from a personal representative (HHS). Some messages are not marketing under the rule, such as refill reminders, where any payment for sending them is reasonably related to the cost, and communications about the covered entity's own health-related services that no third party pays it to make (45 CFR 164.501); those don't need a marketing authorization.
A simple step is to mark deceased patients in your records and exclude them from reminders, email lists and any audience uploads. Patient lists sent to ad platforms raise their own PHI questions; see customer match for clinics.
How Curve Compliance helps
Curve Compliance helps keep PHI out of what ad platforms receive, for living and deceased patients alike. Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.
Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry), and Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: 45 CFR 164.502; 45 CFR 160.103; 45 CFR 164.510; 45 CFR 164.512; 45 CFR 164.508; 45 CFR 164.501; HHS, Health Information of Deceased Individuals; HHS, Personal Representatives; HHS, Your Rights Under HIPAA.
Frequently Asked Questions
Does HIPAA apply after death?
Yes, for 50 years after the date of death (45 CFR 164.502(f)). After that, the information is no longer PHI (45 CFR 160.103).
How long after death is HIPAA protected?
Fifty years from the date of death. HHS says records about people who died more than 50 years ago may be used or disclosed without regard to the Privacy Rule (HHS).
Is disclosing a death a HIPAA violation?
Not when a permission applies, such as notifying a family member or personal representative of the death, or disclosures to coroners, medical examiners and funeral directors (45 CFR 164.510(b)(1)(ii); 45 CFR 164.512(g)).
Who can request a deceased person's medical records?
The personal representative: an executor, administrator or other person with authority under applicable law to act for the deceased or the estate (45 CFR 164.502(g)(4)). HHS says the personal representative can exercise the person's Privacy Rule rights, including gaining access (HHS).
Can a doctor talk to family after a patient dies?
Yes, about information relevant to a family member's involvement in the patient's care or payment for care before death, unless the patient had expressed a contrary preference the provider knows about (45 CFR 164.510(b)(5)).
Should deceased patients be removed from marketing lists?
Their information stays PHI for 50 years (45 CFR 164.502(f)), and marketing uses of PHI need an authorization, which after death has to come from a personal representative (HHS). Excluding them from marketing lists and audiences avoids the question.
What happens to medical records after 50 years?
They are no longer PHI under HIPAA, so the Privacy Rule no longer limits their use or disclosure (45 CFR 160.103; HHS).
Talk to Curve Compliance
Book a call. Want ad tracking that keeps PHI out of ad platforms? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Book a call with Curve.