When a patient dies: HIPAA and practice contact

When a patient dies, the practice systems keep running. The recall list still has their name, the reminder platform still has their mobile number, the billing system still has a balance, and the birthday greeting is still scheduled. A text that says the patient is overdue for a checkup can reach a grieving family a week after the funeral. Separately, staff who knew the patient for years may want to send a card, share the obituary or post a tribute on the practice page. Each of these touches the patient’s health information, and HIPAA keeps protecting that information after death.

This guide covers how long the protection lasts, who can act for the patient after death, what the practice may tell family members, condolence notes, taking the patient off recall, reminder, billing and marketing lists, and why a memorial post or an obituary share from the practice account needs a written authorization. Recall lists themselves are covered in our guide to a patient recall system, greeting lists in our guide to birthday and holiday messages to patients, and questions from reporters after a death in the news in our guide to HIPAA rules for media inquiries.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: 45 CFR 160.103, 164.501, 164.502, 164.508 and 164.510 (eCFR, current as of October 28, 2026), and the HHS page Health Information of Deceased Individuals (content last reviewed September 19, 2013). We found no federal rule or agency guidance written for condolence notes, memorial posts or stopping patient outreach after a death as such. State rules on patient privacy, estates and who may act for a person who has died differ from state to state, so check yours, and have a health care attorney review your process before you rely on it.

The short version

Protection lasts 50 years after death. 45 CFR 164.502(f) requires a covered entity to keep following the Privacy Rule for a deceased person’s protected health information for 50 years following the death.
The personal representative acts for the patient. Under 45 CFR 164.502(g)(4), an executor, administrator or other person with authority under applicable law to act for the deceased person or the estate is treated as the personal representative.
Family involved in care may hear what is relevant. 45 CFR 164.510(b)(5) lets you share information relevant to a family member’s involvement in the patient’s care or payment before death, unless that conflicts with a preference the patient expressed that you know about.
A short condolence note is not marketing. It promotes no product or service, so it falls outside the marketing definition in 45 CFR 164.501. Keep it free of offers and health details.
No memorial post or obituary share without authorization. A post from the practice account naming the patient tells the public the person was your patient. That is a disclosure of protected health information, and it needs a written authorization signed by the personal representative.
Stop the automated messages the day you learn of the death. Recall, reminder, greeting, survey and promotional lists all need a deceased flag that the systems actually check.

How long the protection lasts

The definition of protected health information in 45 CFR 160.103 excludes individually identifiable health information regarding a person who has been deceased for more than 50 years. The rule that applies to the practice is in 45 CFR 164.502(f): a covered entity must comply with the Privacy Rule for the protected health information of a deceased individual for 50 years following the death. For a practice, that means a patient who died last month, or 30 years ago, is protected to the same extent as a living patient for outreach purposes.

The HHS page on health information of deceased individuals says that during the 50-year period, the Privacy Rule generally protects a decedent’s health information to the same extent the Rule protects the health information of living individuals. It also lists special disclosure provisions for decedents, such as disclosures to coroners, medical examiners and funeral directors under 45 CFR 164.512(g). None of those special provisions covers marketing, memorial posts or social media.

The fact that a person was your patient is itself health information under HIPAA. The definition of individually identifiable health information in 45 CFR 160.103 covers information that relates to the provision of health care to an individual and identifies the individual. A post that says “we will miss our patient [Name]” identifies the person and relates to the care you gave them.

Who can act for the patient after death

45 CFR 164.502(g)(4) says that if, under applicable law, an executor, administrator or other person has authority to act on behalf of a deceased individual or of the individual’s estate, the covered entity must treat that person as a personal representative, with respect to protected health information relevant to that representation. The HHS page explains that the personal representative can exercise the patient’s rights under the Privacy Rule, such as authorizing certain uses and disclosures and gaining access to the information.

Who that person is comes from state law, not from HIPAA. A spouse, an adult child or the person who answers the phone is not automatically the personal representative. No federal rule tells a practice what proof to ask for. We recommend writing down what your practice accepts, such as court papers naming an executor or administrator, after your attorney confirms what your state recognizes, and keeping a copy with the record.

What you may tell family members

45 CFR 164.510(b)(5) applies when the patient has died. A covered entity may disclose to a family member, or to other persons identified in paragraph (b)(1) who were involved in the individual’s care or payment for health care before the death, the protected health information relevant to that person’s involvement. The limit is any prior expressed preference of the individual that the covered entity knows about. 45 CFR 164.510(b)(1)(ii) also permits using or disclosing information to notify a family member, a personal representative or another person responsible for the patient’s care of the patient’s death.

In practice, this lets the front desk talk with the daughter who drove her father to appointments about his upcoming visit or his last bill. It does not open the whole chart to any relative who calls, and it does not reach relatives who were not involved in the care. When a record shows the patient asked that a family member not be given information, follow that note after the death as well.

Condolence notes

HIPAA defines marketing in 45 CFR 164.501 as a communication about a product or service that encourages recipients to purchase or use the product or service. A handwritten card that says the team is sorry for the family’s loss is not about a product or service, so it does not meet that definition. HIPAA does not mention condolence notes, and we found no HHS guidance that addresses them.

The card still uses information from the practice: the knowledge of the death, the family’s name and the address. No federal rule says who may receive one. We recommend sending it only to the family member the practice already dealt with as part of the patient’s care, under the permission in 164.510(b)(5), and keeping it short and personal.

Leave out the diagnosis, the cause of death and the care given. The family knows; a card on the kitchen table can be read by visitors.
Leave out offers. A line inviting the family to book their own visits, or a coupon, turns the card into a communication about a service. That line belongs in no condolence note.
Leave out the practice’s marketing. No brochure, no review request, no newsletter signup inserted in the envelope.
Send it by hand or by mail, not through an automated sequence. A note produced by a marketing platform reads like one.

Taking the patient off recall, reminder, billing and marketing lists

A message that can hurt a family after a death is the recall text that nobody turned off. No federal rule sets a process for this, but the HIPAA analysis of each list does not change because the patient has died: a promotional message to a deceased patient’s email is still a use of protected health information for marketing under 45 CFR 164.508(a)(3). We recommend one deceased flag in the practice management system that each outbound tool reads, set the same day the practice learns of the death.

Recall and reminders. Cancel future appointments, close open recall items and remove the patient from automated reminder queues. Check the texting platform separately if it keeps its own contact list.
Greetings and surveys. Birthday, holiday and satisfaction survey lists are exports. A flag in the chart does not stop a list exported last week, so check the scheduled sends too.
Promotional email and text. Remove the address and number from newsletters and campaign lists, including any list a vendor holds as your business associate.
Billing. Send statements for the patient’s account to the personal representative or the estate, not to whoever shares the household, unless that person was involved in payment under 164.510(b)(5). Debt collection after a death has its own federal and state rules; check them with your attorney before a balance goes to a collector.
Advertising audiences. If your practice uploads patient lists to ad platforms, that raises its own HIPAA questions; at a minimum, remove the patient from those uploads.
Family accounts. When a spouse or child is also your patient, keep their reminders running, and check that their messages do not mention the person who died.

Memorial posts and obituary shares

Staff who cared for a patient for years may want to post a tribute or share the obituary on the practice’s page. The obituary may already be public, but a post from the practice account adds a fact the obituary does not: that the person was your patient. That is a disclosure of protected health information to the public, and it is not treatment, payment or health care operations. 45 CFR 164.508(a)(1) says a covered entity may not use or disclose protected health information without a valid authorization except as the Privacy Rule otherwise permits.

After a death, the person who signs that authorization is the personal representative. Under 45 CFR 164.508(c)(1)(vi), when an authorization is signed by a personal representative, it must include a description of that person’s authority to act for the individual. A family member’s verbal blessing at the funeral, or a comment on the post saying “he would have loved this,” is not a valid authorization.

The same reasoning applies to replies. If a family member posts about the death on your page or leaves a review that names the patient, a reply from the practice that confirms the care relationship is a disclosure. Our guides to HIPAA and negative review replies and to patient photo consent for marketing cover replies and images, including photos of patients who have died.

Staff on their personal accounts raise the same question. No federal rule addresses staff condolence posts as such. We recommend a social media policy that tells staff not to post about a patient’s death in any way that shows the person was a patient of the practice, and our social media policy guide covers how to write one.

Questions to ask before you set up a process

Who at the practice is told when a patient dies, and how does that news reach the chart?
Does one deceased flag stop each automated tool, including the texting platform, the survey vendor and the greeting list?
What proof does the practice accept that a person is the personal representative, and has our attorney confirmed it for our state?
Does the record show any preference the patient expressed about what family members may be told?
Who decides whether the practice sends a condolence note, and to whom?
Does our social media policy cover posts about patients who have died, on practice and personal accounts?

Use and avoid

Use: a short handwritten card to the family member the practice dealt with. Avoid: a card that mentions the diagnosis or invites the family to book a visit.
Use: one deceased flag read by recall, reminder, greeting, survey and promotional tools. Avoid: removing the patient from the recall list only and leaving the texting platform list as it was.
Use: statements addressed to the personal representative or the estate. Avoid: a balance reminder text to the patient’s old mobile number.
Use: a written authorization signed by the personal representative before any tribute post. Avoid: sharing the obituary from the practice page with “one of our favorite patients.”
Use: a private message of thanks when a family member posts about the death. Avoid: a public reply that confirms the care you gave.

An illustration

This example is invented. A family practice in [Town] learns from a local obituary that a long-time patient has died. The front desk cancels her next appointment. Two weeks later, her husband receives a text on her old phone saying she is due for her annual visit, and a week after that, a birthday greeting. A medical assistant shares the obituary on the practice page with a line about how much the team will miss her.

The practice owner reviews what happened with their attorney. The post comes down. The practice adds a deceased flag that the texting platform, the greeting list and the survey export all check before each send, and assigns one person to set it the same day the practice learns of a death. The physician sends a short handwritten card to the husband, who came to her appointments. The social media policy gets a paragraph on patients who have died, and a future tribute post goes up only with an authorization signed by the personal representative.

Checklist

Treat a deceased patient’s information as protected for 50 years after the death.
Set a deceased flag the same day the practice learns of a death.
Check that the flag stops recall, reminder, greeting, survey and promotional sends, including vendor lists.
Remove the patient from ad audience uploads.
Route the patient’s billing to the personal representative or the estate.
Write down what proof of personal representative status the practice accepts.
Share with family only what relates to their involvement in the care or payment, and follow any known preference of the patient.
Keep condolence notes short, personal and free of offers and health details.
Get an authorization signed by the personal representative before any post that names the patient.
Add patients who have died to the social media policy.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For outreach after a patient dies, we set up a single deceased flag that the recall, reminder, greeting and promotional flows we build all check before they send. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Does HIPAA still apply after a patient dies?

Yes. 45 CFR 164.502(f) requires a covered entity to follow the Privacy Rule for a deceased person’s protected health information for 50 years following the death. After 50 years, the information is no longer protected health information under the definition in 45 CFR 160.103.

Can we send a condolence card to the family?

HIPAA does not mention condolence cards. A card that promotes nothing is not marketing under 45 CFR 164.501. We recommend sending it to the family member who was involved in the patient’s care, since 164.510(b)(5) permits disclosures relevant to that involvement, and keeping health details and offers out of it.

Can we share a patient’s obituary on our practice page?

Not without authorization. A share from the practice account tells the public the person was your patient, which is a disclosure of protected health information. Under 45 CFR 164.508, that needs a valid authorization, signed after the death by the personal representative with a description of their authority.

Who can sign for a patient who has died?

The personal representative. Under 45 CFR 164.502(g)(4), that is an executor, administrator or other person with authority under applicable law to act for the deceased person or the estate. State law decides who that is.

What can we tell a family member who calls?

Under 45 CFR 164.510(b)(5), you may share information relevant to that person’s involvement in the patient’s care or payment before the death, unless the patient expressed a different preference that you know about. A relative who was not involved does not get information under that provision.

When a patient dies: stopping reminders, condolence notes and memorial posts under HIPAA