A researcher investigating long-term cancer outcomes may need to examine medical records belonging to patients who died several years ago. These records could contain valuable information about treatment decisions, disease progression, and factors associated with survival. Because the patients are deceased, the researcher might assume that informed consent and research oversight are no longer necessary. However, using deceased patients’ health information raises important questions about privacy, legal requirements, and the responsibilities of researchers who access sensitive medical records.
Medical records remain valuable long after a patient’s death. They can help researchers identify patterns in disease outcomes, evaluate healthcare practices, and understand why certain treatments succeed or fail. Yet these records may contain personal information about the deceased individual, surviving family members, and other people whose identities could be revealed through the data. According to Price and Cohen (2019), the growing use of health information for research creates significant privacy challenges, particularly when data from different sources can be combined to identify individuals.
One important distinction is that research involving deceased individuals does not always meet the federal definition of human subjects research. Under the revised Common Rule, a human subject is a living individual about whom an investigator obtains information or biospecimens through intervention or interaction, or obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens 45 C.F.R. § 46.102(e)(1). This means a study using only deceased patients’ records may fall outside federal human subjects research requirements. However, researchers should not assume that the absence of living participants automatically eliminates the need for institutional review, privacy safeguards, or documentation.
The distinction becomes particularly important when researchers seek Institutional Review Board (IRB) guidance or work with an independent IRB to determine whether their proposed activities require oversight. Even when formal IRB review is not required under the Common Rule, the Health Insurance Portability and Accountability Act (HIPAA) may continue to regulate access to deceased patients’ protected health information. Understanding how these requirements apply is essential before researchers request records, extract information, or begin analyzing patient data.
I. Understanding IRB Requirements for Research Involving Deceased Patients
Research involving deceased patients’ records occupies a distinct position within federal research regulations. The absence of living participants may change whether a study qualifies as human subjects research, but it does not automatically remove every institutional or ethical obligation. Researchers must first determine what information they intend to use, whether living individuals are involved, and which regulations apply to their proposed activities.
Does Research Using Deceased Patients’ Records Require IRB Approval?
The Common Rule defines human subjects research by reference to living individuals. Consequently, a retrospective study involving only records from deceased patients generally does not qualify as human subjects research under that definition. For example, a researcher examining historical mortality records to identify changes in cardiovascular treatment outcomes may not require Common Rule oversight if the study involves no living individuals or identifiable private information about them. Nevertheless, the researcher must still comply with applicable institutional policies, privacy requirements, and restrictions governing access to the records.
45 C.F.R. § 46.102 (2018) establishes the federal definition of a human subject in 45 C.F.R. § 46.102(e)(1). This definition provides the starting point for determining whether a study involving deceased individuals falls within the Common Rule. However, an institution may require investigators to obtain a formal determination before accessing medical records, even when the study does not meet the federal definition. Researchers seeking IRB approval should therefore distinguish between a formal approval requirement and a determination that their proposed activity does not constitute human subjects research.
Why an Official Determination May Still Be Necessary
A researcher may correctly conclude that a study involves only deceased individuals but still encounter institutional requirements for documentation. Hospitals, universities, and healthcare systems often have procedures for reviewing requests involving patient records, particularly when the information is identifiable or stored in restricted clinical databases. These procedures may require confirmation from a research compliance office, privacy officer, or ethics committee before records can be released. The purpose is to establish that the proposed activity has been appropriately classified and that applicable access requirements have been addressed.
For researchers working outside institutions with established review committees, an external IRB may provide an appropriate review or determination service, depending on the organization’s scope and the research setting. Investigators who need to find an IRB should confirm whether the reviewing organization can issue the type of determination required by the institution holding the records. An IRB’s conclusion about Common Rule applicability does not, by itself, authorize access to medical information. Permission to obtain records must come from the appropriate data custodian and comply with applicable privacy rules.
When Deceased Patients’ Records Involve Living Individuals
Although a medical record belongs to a deceased patient, it may contain information about people who are still alive. Family medical histories, inherited disease risks, genetic information, and notes about relatives can reveal identifiable details about living individuals. For example, a deceased patient’s genetic test results may suggest that surviving relatives carry a hereditary cancer-associated variant. Researchers examining such records must consider whether their activities involve obtaining or analyzing identifiable private information about those living relatives.
The National Research Council (2009) highlights that health information can carry privacy implications beyond the individual whose medical record is being examined. Information about genetic characteristics and family relationships may be relevant to other identifiable people. However, the presence of family information does not automatically make a study human subjects research involving those relatives. The determination depends on what information investigators obtain, how it is used, whether living individuals are identifiable, and whether the study meets the applicable regulatory definition.
Distinguishing Regulatory Exemption From Ethical Responsibility
A study that falls outside the Common Rule’s human subjects definition is not necessarily exempt from every ethical responsibility. Researchers may still encounter sensitive information concerning mental health, infectious diseases, substance use, reproductive history, or hereditary conditions. Unauthorized disclosure of such information can affect surviving family members and undermine public confidence in healthcare institutions. Responsible research therefore requires attention to confidentiality even when formal human subjects oversight is not mandatory.
Appropriate IRB services can help investigators identify which regulatory questions require clarification before data collection begins. Researchers may benefit from IRB training that explains the differences among activities that are not human subjects research, research that qualifies for an exemption, and research requiring formal review. These categories have different regulatory meanings and should not be treated as interchangeable. Understanding the distinctions helps investigators avoid unnecessary submissions while ensuring that genuine oversight requirements are not overlooked.
II. HIPAA Requirements for Accessing Deceased Patients’ Health Information
Determining that a study falls outside the Common Rule does not settle whether researchers may access deceased patients’ medical records. HIPAA establishes separate requirements for protected health information held by covered entities and their business associates. These requirements can apply even when the individuals whose records are being requested are no longer alive. Researchers must therefore evaluate HIPAA compliance independently of the study’s human subjects research classification.
How Long Does HIPAA Protect a Deceased Patient’s Information?
HIPAA does not end its privacy protections immediately when a patient dies. Under 45 C.F.R. § 164.502(f) (2025), a covered entity must comply with the Privacy Rule regarding a deceased individual’s protected health information for 50 years following the date of death 4. During that period, identifiable health information generally remains subject to applicable HIPAA restrictions. Researchers cannot assume that records become freely available simply because the patient is deceased.
The 50-year provision was addressed in the Department of Health and Human Services’ 2013 modifications to the HIPAA Privacy Rule. The regulation recognizes that privacy interests continue after death while establishing a defined period for HIPAA protection. Once that period expires, the information is no longer protected health information solely by virtue of the deceased individual’s identity under the HIPAA Privacy Rule. However, state laws, institutional policies, contractual restrictions, and protections for living individuals may still limit access or disclosure.
Using the HIPAA Research Provision for Deceased Individuals’ Information
HIPAA includes a specific pathway for research involving only deceased individuals’ protected health information. Under HIPAA, a covered entity may disclose protected health information for research solely on decedents’ information when the researcher provides certain representations. The researcher must represent that the use or disclosure is sought solely for research involving decedents’ information and that the requested information is necessary for the research purposes. The covered entity may request documentation of the individuals’ deaths.
This provision is especially relevant to retrospective studies examining mortality, treatment histories, and disease progression among deceased patients. For example, researchers investigating causes of death among patients who received a particular treatment may qualify for this pathway when the requested protected health information concerns only deceased individuals. Unlike the HIPAA research waiver pathway, this provision does not require researchers to obtain an IRB or Privacy Board waiver of authorization. Nevertheless, the covered entity must receive the required representations, and researchers must follow any additional institutional procedures governing access.
What Researchers Should Prepare Before Requesting Records
Researchers should prepare a clear explanation of the study’s purpose and identify the specific records needed to answer the research question. They should explain why identifiable information is necessary, if identifiers are being requested, and confirm that the proposed HIPAA pathway applies solely to decedents’ information. When appropriate, documentation should identify the source used to establish that the patients are deceased. Providing this information helps the healthcare organization assess whether the requested disclosure meets the applicable regulatory conditions.
A researcher may seek guidance from an independent IRB or institutional compliance office when uncertain about the appropriate regulatory pathway. However, IRB review and HIPAA authorization requirements are separate matters, and the reviewing committee does not automatically control the release of records. The healthcare organization holding the information remains responsible for determining whether the requested disclosure is permitted. Researchers should obtain the necessary institutional permissions before accessing or extracting records.
When Other HIPAA Research Pathways Apply
Not every retrospective records study qualifies for the decedents-only research provision. A project may involve records from both deceased and living patients, or investigators may need information about living relatives to answer the research question. In such situations, researchers must consider other HIPAA pathways, including individual authorization, a valid waiver or alteration of authorization, or the use of appropriately de-identified information. The correct approach depends on the information requested, the research activities, and the conditions established by the Privacy Rule.
An IRB or Privacy Board may approve a waiver or alteration of HIPAA authorization when specified criteria are satisfied. These include requirements concerning privacy risks, the impracticability of conducting the research without the waiver, and the impracticability of conducting it without access to the requested protected health information. Researchers should not assume that retrospective study design alone qualifies a project for a waiver. Appropriate IRB services can assist with preparing research submissions, while IRB approval or Privacy Board documentation may be necessary when the selected pathway requires a waiver.
De-Identified Information and Limited Data Sets
Researchers may be able to reduce privacy risks by requesting information without direct patient identifiers. HIPAA permits information to be treated as de-identified when it satisfies the Safe Harbor method or the Expert Determination method under 45 C.F.R. § 164.514 (2026). Properly de-identified information is not protected health information under the HIPAA Privacy Rule. However, removing names alone does not necessarily satisfy HIPAA’s de-identification requirements.
HIPAA permits certain research disclosures involving limited data sets under a data use agreement. A limited data set excludes specified direct identifiers but may retain certain information, such as dates and some geographic details, that would not ordinarily be permitted under the Safe Harbor de-identification method. The data use agreement must establish permitted uses, safeguards, and restrictions on identifying or contacting individuals. According to Price and Cohen (2019), combining health information from multiple sources can create identification risks even when obvious identifiers have been removed, making careful assessment of data-sharing practices essential.
III. Protecting Deceased Patients’ Records Throughout the Research Process
Legal permission to access medical records is only one part of responsible research. Once investigators receive the information, they must protect it throughout extraction, storage, analysis, collaboration, and eventual disposal. These responsibilities are particularly important when records contain sensitive clinical details or information that could identify surviving relatives. Researchers should establish practical safeguards before receiving the first dataset rather than attempting to resolve privacy concerns after information has already been shared.
Collecting Only the Information Necessary for the Study
Medical records often contain far more information than researchers need. A study examining treatment outcomes may require diagnosis dates, treatment types, laboratory results, and survival information but have no reason to collect full addresses, personal contact details, or unrelated clinical histories. Extracting unnecessary information increases the amount of sensitive data that must be protected. It may create additional risks without improving the quality of the research.
The National Research Council (2009) emphasizes the importance of balancing the value of health research with meaningful protections for personal information. One practical approach is to create a data extraction plan that identifies every variable required for the study and explains its purpose. Researchers should review the plan with the institution responsible for the records before extraction begins. Where appropriate, IRB training for students can introduce early-career investigators to data minimization practices and the importance of limiting access to information that serves a defined research purpose.
Establishing Secure Storage and Access Controls
Researchers should know where the requested records will be stored, who will have access, and how the information will move between authorized users. Identifiable medical records should be maintained in approved systems with appropriate safeguards, such as encryption, access restrictions, and activity monitoring where required. Research staff should not transfer sensitive records to personal email accounts, unsecured devices, or unapproved file-sharing platforms. These practices can expose information to unauthorized users and make it difficult to determine how a breach occurred.
According to Price and Cohen (2019), advances in health data analysis create important opportunities for medical research but increase concerns about privacy and the potential misuse of personal information. These concerns become especially relevant when researchers combine hospital records with external databases or collaborate across institutions. Appropriate human-subject research training can help research personnel understand confidentiality expectations, although additional institutional privacy and information security instruction may be necessary. A human subjects review board may evaluate data protections when the study falls within its jurisdiction, but researchers must follow the security requirements established by the institution holding the records.
Managing Data Sharing With External Collaborators
Collaborative research may require medical information to be shared among universities, hospitals, laboratories, and other organizations. Before transferring records, investigators should determine whether the receiving organization is authorized to obtain the information and whether a data use agreement or another contractual arrangement is required. The agreement should identify permitted uses, applicable safeguards, and restrictions on further disclosure. Researchers should establish whether collaborators may retain the information after the project ends.
These considerations matter because information may become harder to control once it leaves the institution where it was originally collected. Researchers working with an external IRB should understand that ethics review does not replace contractual or privacy obligations governing data transfers. Investigators who need to find an IRB should not assume that selecting a reviewing organization resolves data-sharing permissions. Each institution involved in the project may have separate responsibilities that must be addressed before information is transferred.
Considering Family Privacy and Genetic Information
Research involving deceased patients can reveal information that has implications for surviving relatives. A study examining hereditary cancers, for example, may identify genetic variants that could be present in family members. Researchers may encounter information about inherited conditions even when the study does not involve direct contact with living individuals. Such findings create questions about confidentiality, possible disclosure, and whether any communication with relatives would be appropriate.
The National Research Council (2009) recognizes that health information can have implications for people beyond the individual whose records are being studied. Researchers should therefore consider whether their activities could reveal identifiable information about living relatives and whether additional protections are necessary. This does not mean investigators automatically have a duty to contact family members whenever hereditary information is discovered. Any proposed communication should be evaluated in light of applicable law, consent arrangements, institutional policies, and the research team’s authority to disclose information.
Planning for Data Retention, Disposal, and Compliance
Privacy responsibilities continue after data analysis is complete. Researchers should establish how long records will be retained, whether identifiers will be removed after linkage or verification, and how information will be securely destroyed when retention is no longer required. Retention periods may depend on institutional policies, funding agreements, publication requirements, and applicable laws. Researchers should avoid assuming that HIPAA’s 50-year protection period establishes the required retention period for research datasets.
A well-prepared protocol should identify who is responsible for maintaining records, responding to suspected privacy incidents, and confirming that collaborators follow agreed restrictions. Researchers may benefit from IRB training that addresses confidentiality and research documentation, alongside specialized institutional data security instruction. When a study requires formal oversight, IRB review can examine whether the proposed protections are appropriate for the information being collected. Investigators should consult privacy and compliance personnel whenever a change in research procedures affects access, disclosure, or storage arrangements.
Conclusion
Deceased patients’ medical records can provide valuable insights into disease progression, treatment effectiveness, and long-term health outcomes. However, the scientific value of these records does not eliminate the need for careful ethical and legal consideration. Researchers must distinguish between Common Rule requirements, HIPAA permissions, and institutional policies before accessing sensitive information. Understanding these differences helps prevent unauthorized disclosure while supporting legitimate research that can improve future healthcare.
The most important step is to establish the appropriate regulatory pathway before collecting data. Researchers should determine whether the study involves living individuals, whether the decedents-only HIPAA research provision applies, and whether additional permissions are necessary. They should identify the minimum information required and establish safeguards for storage, access, sharing, and retention. Appropriate IRB training for students and experienced investigators can strengthen understanding of these responsibilities, while human-subject research training provides a foundation for recognizing ethical concerns associated with medical records research.
For investigators planning retrospective studies, BeyondBound IRB offers IRB services to support research review and regulatory preparation. Whether a project requires guidance from an independent IRB, clarification of IRB approval requirements, or assistance understanding the role of IRB oversight, early consultation can help researchers identify the appropriate next steps. Through IRB Heart, researchers can strengthen their understanding of ethical research practices and prepare more effectively for future studies.
Using deceased patients’ records responsibly requires more than confirming that the individuals are no longer alive. It requires respecting the sensitivity of medical information, protecting the interests of living individuals, and following the legal requirements that govern access to healthcare records. When researchers approach these responsibilities carefully, historical patient information can contribute to meaningful scientific discoveries without compromising the trust placed in healthcare and research institutions.
References
Definitions for purposes of this policy, 45 C.F.R. § 46.102 (2018). https://www.ecfr.gov/current/title-45/section-46.102
National Research Council. (2009). Beyond the HIPAA Privacy Rule: Enhancing privacy, improving health through research. The National Academies Press. https://doi.org/10.17226/12458
Other requirements relating to uses and disclosures of protected health information, 45 C.F.R. § 164.514 (2026). https://www.ecfr.gov/current/title-45/section-164.514
Price, W. N., II, & Cohen, I. G. (2019). Privacy in the age of medical big data. Nature Medicine, 25, 37–43. https://doi.org/10.1038/s41591-018-0272-7
U.S. Department of Health and Human Services. (2013). Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other modifications to the HIPAA Rules. Federal Register, 78(17), 5566–5702. https://www.federalregister.gov/d/2013-01073
Uses and disclosures of protected health information: General rules, 45 C.F.R. § 164.502 (2025). https://www.ecfr.gov/current/title-45/section-164.502