The recent death of Major League Baseball pitcher Joe Kennedy is a tragic reminder that employees die.  However, in many ways, the employment relationship lives on, albeit under different terms.  Estates may need to be administered.  Law enforcement may need to investigate the cause of death.  Children may need to know if their deceased parent was diagnosed with a genetically transmitted disease.  How are employers supposed to respond to these requests?  More pointedly, do deceased employees have any privacy rights in their health information?  The short answer is “yes”.

Under the HIPAA Privacy Rule, the deceased have virtually the same privacy rights as the living.  In other words, a deceased employee’s protected health information generally can not be disclosed without the authorization of the decedent’s personal representative.  Whether someone can act as a personal representative depends upon applicable state law, which typically limits personal representatives to a current surviving spouse or a court-appointed executor of the deceased’s estate.  Employers often will be required to confer with the personal representative before responding to a request for the dead employee’s medical records — even if the request comes from someone close to the decedent, such as a child or an attorney representing the employee in litigation against the employer.

Employers should bear in mind that the HIPAA Privacy Rule applies only to health information created or received by, or on behalf of, a HIPAA-covered plan, i.e., a self-insured group health, dental or vision plan, a health care reimbursement flexible spending account, or an employee assistance program.  For other medical information, such as sick leave requests and reasonable accommodation and workers’ compensation information, employers will need to look to state law or the confidentiality provisions of the Americans with Disabilities Act.  As a general rule, however, these statutes follow the same scheme as HIPAA for disclosing the health information of a deceased employee.