A Deceased Patient's Dental Records: Who Can Get Them Under HIPAA (2026)

This article explains who can obtain a deceased patient's records under HIPAA. It is general information, not legal advice for your specific situation. For that, consult a healthcare attorney or a qualified HIPAA compliance professional.

Does HIPAA still protect a patient's records after they die?

It does, for 50 years. The Privacy Rule requires you to protect a deceased patient's records for fifty years following the date of death. Only after that long does the information stop being what HIPAA calls protected health information, the patient data the Privacy Rule guards. In plain terms, a patient passing away does not free you to release the chart to anyone who asks. The same care you owe a living patient's records, you owe a deceased one's, for the rest of most people's working lives and beyond.

Who is the personal representative of a deceased patient?

The personal representative of someone who has died is the person your state's law puts in charge of their estate. Usually that is the executor named in the patient's will, or, if there was no will, the administrator the probate court appoints. In some states, another person authorized under state law, such as a surviving spouse or next of kin, may have that authority instead. HIPAA treats that person as the patient. They stand in the patient's shoes and can get the records relevant to carrying out their duties, which in practice covers what they need to settle the estate. Their authority comes from the estate, not from any medical role, so it does not matter whether they ever helped the patient with health decisions.

Because the authority comes from a court, you can ask to see the court's paperwork. For an estate with a will, that document is called Letters Testamentary. For one without a will, it is Letters of Administration. Either one names the person the court has authorized to act for the estate. In one OCR case, the daughter requesting her late father's records sent the practice a copy of her Letters of Administration along with the request. You are allowed to ask for that proof, or for comparable proof of authority under your state's law, before you release anything.

What about a spouse, a child, or someone with power of attorney?

This is where practices slip. A health-care power of attorney lets someone make medical decisions for a patient while the patient is alive, and during that time it makes them the patient's personal representative for health information. It ends at death. After death, a health-care power of attorney does not by itself prove authority, and HIPAA looks to state law for who may act for the deceased person or the estate, usually an executor or administrator, and sometimes another authorized person. A former power-of-attorney agent holds no special status unless they are also that person. The same is true of being a spouse or an adult child. Relationship alone does not make someone the personal representative. A surviving spouse who is the named executor qualifies, and a surviving spouse who is not may still qualify if state law gives that spouse authority to act for the estate. If not, the spouse may still get records through the involved-family route below. That covers an adult who has died. For a living minor child, a parent is usually the personal representative under a different part of the same rule, which we cover separately.

Can a family member who was involved in the patient's care get records?

Yes, within limits. Separate from the personal-representative rule, HIPAA lets you share a deceased patient's information with a family member, relative, or close friend who was involved in the patient's care or payment for that care before death. Two conditions come with it. You share only the information relevant to that person's involvement, not the whole chart, and you do not share at all if it would go against something the patient had told you they wanted. This route is permission, not a requirement, and it is narrower than what the personal representative gets.

In practice this covers ordinary, humane situations. A sibling asking what happened can be told the circumstances around the death. A family member closing out the estate can be given the billing records they need. What it does not cover is an open-ended request for the entire file from a relative who simply wants to see it.

There is also a quieter path that has nothing to do with the family asking directly. If another dentist or physician is treating a surviving relative and needs the deceased patient's records for that relative's care, say to understand an inherited condition, you can release the relevant records to that provider without an authorization, because disclosures for treatment do not require one. The request comes from the treating provider, and you limit it to what is relevant to the living patient's care.

Who can get a deceased patient's dental records, at a glance

Here is the same logic in one place. When someone asks for a deceased patient's records, the first question to answer is which of these they are.

What OCR has actually done about this

This is not a hypothetical risk. The Office for Civil Rights, the part of HHS that enforces HIPAA, has settled cases over exactly this scenario, and both involved a daughter trying to get her deceased father's records. In one, a diagnostic lab in Georgia, Life Hope Labs, took 225 days to send a personal representative the records she had asked for. OCR settled the matter for $16,500, the forty-third action in its initiative on timely records access.

In the other, a Florida primary care practice, Health Specialists of Central Florida, did the same thing to another daughter, who had even sent in her Letters of Administration with the request. That one settled for $20,000. Neither practice admitted wrongdoing, and neither failure was exotic. The lesson is plain. Once you have confirmed that the person is the personal representative, their request runs on the same clock as any records request, and being busy or unsure is not a defense. The fulfillment rules, including the thirty-day deadline, are the same ones that apply to a living patient's request.

Handling a request like this correctly is one piece of a front desk that holds up under scrutiny, and the practices that get tripped up are usually the ones whose baseline was shaky to begin with. The free HIPAA Scorecard checks ten core Security Rule controls that line up with the issues OCR raises most, like your risk analysis and your vendor agreements, then scores your practice and names your biggest gap in about three minutes. It does not check how you handle a deceased patient's records, but it shows whether your broader HIPAA foundation is in order.

What a dental practice should do

Most routine requests do not require a lawyer on call. They require a short routine the front desk can follow, plus a clear escalation point for when the proof of authority is not obvious.

This is general information about HIPAA, and a deceased patient's records are an area where your state's law also has a say in who counts as the personal representative. Before you release records, confirm who is authorized under your state's law, and when you are not sure, check with a healthcare attorney or a qualified HIPAA compliance professional.

About the author

Dolev Arama is Hipsana's founder. He's the one behind the Scorecard and the short risk reviews it produces. He is not an attorney, and Hipsana is a publisher and referral service, not a law firm or a healthcare provider. The writing here starts where the rules actually live, at HHS, OCR, and NIST, and gets checked against their current text before it goes up. Regulatory claims trace back to those sources, and figures name where they come from; anything that can't be verified is labeled rather than asserted. More about Hipsana →

Sources

• 45 CFR § 164.502(g) (personal representatives), including § 164.502(g)(1) (a covered entity must treat a personal representative as the individual) and § 164.502(g)(4) (an executor, administrator, or other person with authority over a deceased individual or the estate is treated as the personal representative for protected health information relevant to that representation) (eCFR, current as of June 2026).
• 45 CFR § 164.502(f) (a covered entity must protect a deceased individual's protected health information for 50 years following death), with the definition of “protected health information” at 45 CFR § 160.103, which excludes information about a person deceased more than 50 years (eCFR, current as of June 2026).
• 45 CFR § 164.510(b)(1) and § 164.510(b)(5) (a covered entity may disclose a deceased individual's relevant protected health information to a family member or other person who was involved in the individual's care or payment for care, unless inconsistent with the individual's prior expressed preference) (eCFR, current as of June 2026). Paragraph (b)(5) was added by the 2013 HIPAA Omnibus Rule, 78 FR 5566.
• 45 CFR § 164.506 (treatment, payment, and health care operations may be disclosed without authorization), the basis on which a deceased patient's records may be provided to a provider treating a surviving relative (eCFR, current as of June 2026).
• U.S. Department of Health and Human Services, Office for Civil Rights, “Health Information of Deceased Individuals” and “Personal Representatives” guidance (hhs.gov, accessed June 2026): the personal representative of a decedent is the executor, administrator, or other person authorized under state law to act for the decedent or the estate, and stands in the individual's shoes; involved family members who are not personal representatives may receive relevant information under § 164.510(b).
• HHS Office for Civil Rights, FAQ on whether a health-care power of attorney allows access to a patient's records (hhs.gov, accessed June 2026): a health-care power of attorney makes a person the patient's personal representative for health information while the patient is alive.
• HHS Office for Civil Rights, FAQ on how a deceased individual's family can obtain records relevant to their own health care (hhs.gov, accessed June 2026).
• HHS Office for Civil Rights, “Lab Pays $16,500 Settlement to HHS, Resolving Potential HIPAA Violation over Medical Records Request” (Life Hope Labs, LLC), with the resolution agreement and corrective action plan (hhs.gov, January 2023): the personal representative of a deceased patient's estate waited 225 days for the records; OCR cited a failure to provide timely access under 45 CFR § 164.524; the settlement is not an admission of liability.
• HHS Office for Civil Rights, “HHS Civil Rights Office Resolves HIPAA Right of Access Investigation with $20,000 Settlement” (Health Specialists of Central Florida, Inc.), with the resolution agreement and corrective action plan (hhs.gov, December 2022): a daughter acting as personal representative of her deceased father, who submitted Letters of Administration, waited about five months for the records.