Privacy Protections for Deceased Patients

This resource describes the key privacy protections for deceased patients’ treatment records under 42 CFR Part 2 and the way these protections interact with similar provisions in the HIPAA Privacy Rule.

Please note that the CoE-PHI Team is currently working on an updated version of this resource that will reflect the 2024 final rule changes to 42 CFR Part 2.

Key Points

• Both HIPAA and Part 2 generally protect the privacy of individuals after their death to the same extent as during their life.
• Part 2 permits disclosures of information identifying a deceased patient as seeking or receiving treatment for a substance use disorder with written consent, including with a special consent provision for deceased patients.
• A deceased patient’s Part 2 records may be released without consent in limited circumstances.