The person entitled to a deceased or incapacitated person's health records.
50 jurisdictions · 5 countries ·
role id health-records-representative
Einsichtsberechtigter in die Behandlungsakte — Person entitled to inspect the medical records
After death, heirs may see the medical record to pursue financial interests and next of kin to pursue non-material ones — unless it would go against the patient's wishes.
Applicant for a deceased patient's health records
Data protection law covers only living people, so a deceased patient's records are reached through separate statutes. In England, Wales and Scotland the Access to Health Records Act 1990 lets the personal representative, and anyone who may have a claim arising from the death, apply to the record holder. Northern Ireland has a parallel Order from 1993.
Something missing or wrong for UK — England & Wales?
Access to Health Records Act 1990 s 3(1)(f); Access to Health Records (Northern Ireland) Order 1993, SI 1993/1250 (NI 4), art 5(1)(e)
Applicant for a deceased patient's health records
Data protection law covers only living people, so a deceased patient's records are reached through separate statutes. In England, Wales and Scotland the Access to Health Records Act 1990 lets the personal representative, and anyone who may have a claim arising from the death, apply to the record holder. Northern Ireland has a parallel Order from 1993.
Something missing or wrong for UK — Northern Ireland?
Access to Health Records Act 1990 s 3(1)(f); Access to Health Records (Northern Ireland) Order 1993, SI 1993/1250 (NI 4), art 5(1)(e)
Personal representative or claimant: access to a deceased patient's health records
After a patient dies, their personal representative, or anyone who may have a claim arising from the death, may apply to the record holder for access. Access is refused if the patient asked for a note that they did not want this.
Something missing or wrong for UK — Northern Ireland?
Access to Health Records (Northern Ireland) Order 1993 art 5(1)(e); Access to Health Records (Northern Ireland) Order 1993 art 6(3)
Applicant for a deceased patient's health records
Data protection law covers only living people, so a deceased patient's records are reached through separate statutes. In England, Wales and Scotland the Access to Health Records Act 1990 lets the personal representative, and anyone who may have a claim arising from the death, apply to the record holder. Northern Ireland has a parallel Order from 1993.
Something missing or wrong for UK — Scotland?
Access to Health Records Act 1990 s 3(1)(f); Access to Health Records (Northern Ireland) Order 1993, SI 1993/1250 (NI 4), art 5(1)(e)
Estate administrator exercising Privacy Act rights for a deceased person (federal institutions)
For personal information held by federal government institutions (including health and benefits records), the Privacy Regulations let a person authorized under federal or provincial law to administer a deceased person's estate exercise that person's Privacy Act rights, only for administering the estate. Information about someone dead more than 20 years is not 'personal information' for the use, disclosure and ATIA s 19 rules.
Something missing or wrong for Canada — British Columbia?
Privacy Regulations, SOR/83-508, s 10(b); Privacy Act, RSC 1985, c P-21, s 3 "personal information" para (m)
Person who may act for a deceased individual under BC privacy law
Public bodies such as health authorities fall under FIPPA. There, a committee acting under Patients Property Act s 24, otherwise the personal representative, otherwise the nearest relative, may make access requests and give consents for a deceased adult. Private organizations such as private clinics fall under PIPA. There, the personal representative acts, including an executor named in the will before any grant, otherwise the nearest relative.
Something missing or wrong for Canada — British Columbia?
Freedom of Information and Protection of Privacy Regulation, BC Reg 155/2012, s 5; Personal Information Protection Act Regulations, BC Reg 473/2003, s 3; Personal Information Protection Act, SBC 2003, c 63, s 22
Estate administrator exercising Privacy Act rights for a deceased person (federal institutions)
For personal information held by federal government institutions (including health and benefits records), the Privacy Regulations let a person authorized under federal or provincial law to administer a deceased person's estate exercise that person's Privacy Act rights, only for administering the estate. Information about someone dead more than 20 years is not 'personal information' for the use, disclosure and ATIA s 19 rules.
Something missing or wrong for Canada — Ontario?
Privacy Regulations, SOR/83-508, s 10(b); Privacy Act, RSC 1985, c P-21, s 3 "personal information" para (m)
Substitute decision-maker for personal health information (PHIPA)
Under PHIPA, consent about an incapable person's health information goes to a hierarchy that mirrors the HCCA: guardians and attorneys (within their authority), then the Board representative, spouse, and so on. That person can also make access requests. After death, the estate trustee (or whoever has assumed administration if there is none) acts. PHIPA stops applying 50 years after death, or 120 years after the record was created if earlier.
Something missing or wrong for Canada — Ontario?
Personal Health Information Protection Act, 2004, SO 2004, c 3, Sched A, ss 25, 26; Personal Health Information Protection Act, 2004, SO 2004, c 3, Sched A, s 23(1) para 4; Personal Health Information Protection Act, 2004, SO 2004, c 3, Sched A, s 9(1)
Estate administrator exercising Privacy Act rights for a deceased person (federal institutions)
For personal information held by federal government institutions (including health and benefits records), the Privacy Regulations let a person authorized under federal or provincial law to administer a deceased person's estate exercise that person's Privacy Act rights, only for administering the estate. Information about someone dead more than 20 years is not 'personal information' for the use, disclosure and ATIA s 19 rules.
Something missing or wrong for Canada — Québec?
Privacy Regulations, SOR/83-508, s 10(b); Privacy Act, RSC 1985, c P-21, s 3 "personal information" para (m)
Persons entitled to a deceased person's personal or health information
Health and social services bodies fall under R-22.1 (S.Q. 2023, c. 5). Heirs, liquidators and beneficiaries get information needed for their role. A spouse or close relative gets information that helps the grieving process, and a spouse or direct relatives get the cause of death, unless the deceased refused in writing. Private enterprises fall under P-39.1 as amended by Law 25 (S.Q. 2021, c. 25). The grieving-process disclosure (s 40.1) applies there too; other access is limited to what affects the requester's rights.
Something missing or wrong for Canada — Québec?
Act respecting health and social services information, CQLR c R-22.1, ss 27-30 (S.Q. 2023, c. 5); Act respecting the protection of personal information in the private sector, CQLR c P-39.1, ss 30-31; Act respecting the protection of personal information in the private sector, CQLR c P-39.1, ss 40.1, 41 (s 40.1 added by S.Q. 2021, c. 25, s. 129); Act respecting health and social services information, CQLR c R-22.1, s 26 (S.Q. 2023, c. 5, s. 26); Act respecting the protection of personal information in the private sector, CQLR c P-39.1, archival disclosure provision (30 years after death)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — uniform/model law + federal?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Arizona?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — California?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Colorado?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Delaware?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Florida?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Idaho?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Illinois?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Indiana?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Iowa?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Kansas?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Kentucky?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Louisiana?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Maine?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Maryland?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Massachusetts?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Michigan?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Minnesota?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Missouri?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Nebraska?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — New Jersey?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — New York?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — North Carolina?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Ohio?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Oklahoma?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Pennsylvania?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Texas?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Utah?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Virginia?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — Washington?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
HIPAA personal representative
Federal privacy law does not appoint anyone. A health care provider or health plan must treat a person as the patient for HIPAA purposes, such as getting records or signing authorizations, when state or other law gives that person authority: authority over health-care decisions for a living adult, or authority over the decedent or the estate after death. The role is derived: it starts and ends when the underlying state-law role (health care agent, guardian, parent, executor/administrator) starts and ends. For decedents, protection lasts 50 years after death.
Something missing or wrong for US — West Virginia?
45 CFR 164.502(g)(2); 45 CFR 164.502(g)(4); HHS OCR, Personal Representatives (45 CFR 164.502(g)) guidance, last reviewed Jan. 5, 2024; 45 CFR 164.502(g)(1); 45 CFR 164.502(f); 45 CFR 160.103, definition of "protected health information" para. (2)(iv)
My Health Record authorised representative
Someone who acts in place of an adult, whom the System Operator is satisfied cannot make decisions, for everything the My Health Records Act allows. It is first a person authorised under Commonwealth, state or territory law or by a court or tribunal (for example an attorney or guardian), otherwise another appropriate person. While one exists, the recipient cannot act for themselves. Also covers parents of children under 14.
Something missing or wrong for Australia — New South Wales?
My Health Records Act 2012 (Cth) s 6, Compilation No. 18 (1 Jul 2026); My Health Records Act 2012 (Cth) s 6(7); My Health Records Act 2012 (Cth) s 7A; My Health Records Act 2012 (Cth) s 51(1), (6), (7); My Health Records Act 2012 (Cth) s 17(2)–(4)
My Health Record nominated representative
An individual the healthcare recipient chooses by agreement and notifies to the System Operator. They can act on the record within the limits the recipient sets, alongside (not instead of) the recipient.
Something missing or wrong for Australia — New South Wales?
My Health Records Act 2012 (Cth) s 7; My Health Records Act 2012 (Cth) s 7(4); My Health Records Act 2012 (Cth) s 51(1), (6), (7); My Health Records Act 2012 (Cth) s 17(2)–(4)
Authorised representative under the Health Records and Information Privacy Act
For NSW health-privacy purposes, an enduring attorney, guardian, person responsible, parent of a child, or other person empowered by law can act for an individual. The scope depends on that underlying role.
Something missing or wrong for Australia — New South Wales?
Health Records and Information Privacy Act 2002 (NSW) s 8; Guardianship Act 1987 (NSW) s 6E
My Health Record authorised representative
Someone who acts in place of an adult, whom the System Operator is satisfied cannot make decisions, for everything the My Health Records Act allows. It is first a person authorised under Commonwealth, state or territory law or by a court or tribunal (for example an attorney or guardian), otherwise another appropriate person. While one exists, the recipient cannot act for themselves. Also covers parents of children under 14.
Something missing or wrong for Australia — Queensland?
My Health Records Act 2012 (Cth) s 6, Compilation No. 18 (1 Jul 2026); My Health Records Act 2012 (Cth) s 6(7); My Health Records Act 2012 (Cth) s 7A; My Health Records Act 2012 (Cth) s 51(1), (6), (7); My Health Records Act 2012 (Cth) s 17(2)–(4)
My Health Record nominated representative
An individual the healthcare recipient chooses by agreement and notifies to the System Operator. They can act on the record within the limits the recipient sets, alongside (not instead of) the recipient.
Something missing or wrong for Australia — Queensland?
My Health Records Act 2012 (Cth) s 7; My Health Records Act 2012 (Cth) s 7(4); My Health Records Act 2012 (Cth) s 51(1), (6), (7); My Health Records Act 2012 (Cth) s 17(2)–(4)
My Health Record authorised representative
Someone who acts in place of an adult, whom the System Operator is satisfied cannot make decisions, for everything the My Health Records Act allows. It is first a person authorised under Commonwealth, state or territory law or by a court or tribunal (for example an attorney or guardian), otherwise another appropriate person. While one exists, the recipient cannot act for themselves. Also covers parents of children under 14.
Something missing or wrong for Australia — Victoria?
My Health Records Act 2012 (Cth) s 6, Compilation No. 18 (1 Jul 2026); My Health Records Act 2012 (Cth) s 6(7); My Health Records Act 2012 (Cth) s 7A; My Health Records Act 2012 (Cth) s 51(1), (6), (7); My Health Records Act 2012 (Cth) s 17(2)–(4)
My Health Record nominated representative
An individual the healthcare recipient chooses by agreement and notifies to the System Operator. They can act on the record within the limits the recipient sets, alongside (not instead of) the recipient.
Something missing or wrong for Australia — Victoria?
My Health Records Act 2012 (Cth) s 7; My Health Records Act 2012 (Cth) s 7(4); My Health Records Act 2012 (Cth) s 51(1), (6), (7); My Health Records Act 2012 (Cth) s 17(2)–(4)
Authorised representative / legal representative under the Health Records Act 2001
For a living person who cannot consent or request access, an authorised representative may exercise their Health Records Act rights to the extent needed for the representative's functions. Authorised representatives include a guardian, an enduring attorney, a medical treatment decision maker or an administrator. The Act protects deceased persons for 30 years after death. During that period a legal representative (executor with probate, or administrator) exercises the deceased's rights.
Something missing or wrong for Australia — Victoria?
Health Records Act 2001 (Vic) s 85(6); Health Records Act 2001 (Vic) s 3(1) (def. legal representative); Health Records Act 2001 (Vic) s 95
The interactive viewer carries the lifecycle diagram, the state machine and the full source list, including the quoted text of each provision. Not legal advice. This is a research aid summarising primary legal sources as retrieved on the dates shown; always read the cited current text and consult a lawyer licensed in the jurisdiction.