How can an OFR team obtain medical records after a person dies?

Medical records containing protected health information (PHI) are safeguarded by the Health Insurance Portability and Accountability Act (HIPAA) for 50 years after an individual dies. Therefore, to obtain medical records of a decedent that contain PHI from a HIPAA-covered entity, an OFR team must rely on one of the following options:

• State statute, state regulation, or local ordinance that specifically allows an OFR team to receive the information.
• State statute, state regulation, or local ordinance that allows a public health authority to access medical records for certain purposes (such as health surveillance or death investigations).
• Authorization form signed by the decedent’s authorized personal representative.

How can an OFR team obtain behavioral health records after a person dies?

Behavioral health records that DO NOT contain Part 2 records are treated the same as other medical records. Medical records containing protected health information (PHI) are safeguarded by the Health Insurance Portability and Accountability Act (HIPAA). Therefore, in order to obtain a decedent’s behavioral health records from a HIPAA-covered entity when such records do not contain Part 2 records but do contain PHI, an OFR team must rely on one of the following options:

• State statute, state regulation, or local ordinance that specifically allows an OFR team to receive the information.
• State statute, state regulation, or local ordinance that allows a public health authority to access the records for certain purposes (such as heath surveillance or death investigations).
• Authorization form signed by the decedent’s authorized personal representative.

The disclosure of behavioral health records that DO contain Part 2 records is covered by 42 U.S.C. § 290dd-2 and 42 CFR Part 2. Under these laws and regulations, OFR teams have only two options to attempt to obtain these records. These options are:

• Relying on a state law requiring the collection of death or other vital statistics or permitting inquiry into the cause of death that allows Part 2 records to be shared with an OFR team.
• Obtaining consent from the decedent’s executor or personal representative, or where no such person is appointed, his or her next of kin.

How can an OFR team obtain educational records after a person dies?

If the decedent meets the U.S. Department of Education definition of “eligible student,” the privacy protections afforded by the Family Educational Rights and Privacy Act (FERPA) lapse or expire upon the death of the student.

An “eligible student” is a student who is:

1. Over age 18; or
2. Under age 18 but enrolled in an institute of higher learning (e.g., college, university, community college).

In situations where neither (1) nor (2) are true at the time of death, the decedent’s privacy rights under FERPA are held by his or her parents until their deaths. In that situation, the OFR team would need a consent form signed by the parents allowing the team to access the records or to have the parents request the records on behalf of the OFR team.

How can an OFR team obtain child services records after a person dies?

The only way an OFR team can acquire records directly from the state department of children’s services is through state statute requiring that the records be provided to the OFR team upon request. Alternatively, OFR teams may wish to interview the family or friends of the decedent for any information or reports they can provide regarding the decedent’s potential involvement with children’s services.

How can an OFR team obtain Prescription Drug Monitoring Program records after a person dies?

In the absence of a specific state statute or regulation authorizing the release of Prescription Drug Monitoring Program (PDMP) records to an OFR team, it is unlikely the team can directly receive prescription information from the state PDMP. However, OFR teams should contact the administrator of their state PDMP to determine if other avenues exist through which one or more team members can obtain PDMP records in the absence of direct authority, such as via the decedent’s medical file or a next of kin request.

Does an OFR team need signed consent to share information from the decedent’s friends or family?

No. Health information known firsthand by a decedent’s family, friends, next of kin, or other loved ones is not subject to the Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. § 290dd-2, or 42 CFR Part 2. This is because these individuals are neither HIPAA-covered entities nor Part 2 programs. Therefore, the OFR team is free to speak with any of the decedent’s family or friends without needing a release or consent form, and any information received by the team from a decedent’s family or friends can and should be shared freely with the rest of the OFR team.

Template: Next of Kin Consent

How can an OFR team include nonmember professional observers?

Individuals who are not members of the OFR team (such as professionals from other communities, medical professionals, or other individuals who may have information relevant to the review of a particular decedent’s case) can attend OFR team meetings. However, the OFR team must ensure that:

1. Proper mechanisms are in place to allow the team to validly redisclose information about the decedent to nonmembers; and
2. Observers have signed a confidentiality agreement that expressly acknowledges that they are prohibited from redisclosing any information shared during the OFR team meeting.

For each type of information that an OFR team anticipates disclosing during an OFR team meeting at which observers will be present, the OFR team should:

1. Determine the applicable law covering redisclosure of that type of information.
2. Ensure that data-sharing agreements, if any, between the OFR team and the entity providing the information at issue appropriately cover redisclosure to observers.
3. Ensure that confidentiality/nondisclosure agreements appropriately cover their ability to receive, use, and redisclose information discussed at the meeting.

Working through these issues may be challenging for an OFR team. Teams may need to discuss the various options with the legal department in the agency that houses the team, or the team may decide to only disclose deidentified information.

How can an OFR team limit attendees’ use of shared information?

OFR teams can limit how information shared in an OFR team meeting can be used by attendees (such as police departments and prosecutors’ offices that pursue charges against those who sold drugs to overdose victims) by using interagency data-sharing agreements and confidentiality agreements.

OFR teams can limit how information shared in an OFR team meeting can be used by attendees (such as police departments and prosecutors’ offices that pursue charges against those who sold drugs to overdose victims) by using interagency data-sharing agreements and confidentiality agreements.

In addition, the OFR team should require each team member and observer to sign a confidentiality agreement that sets out all requirements for keeping information shared during the meeting confidential and that prohibits any use of such information not in alignment with the OFR team’s goals and responsibilities. The confidentiality agreement should be clear that it does not prevent a team member from fulfilling any agency-mandated responsibilities of that individual.

Must an OFR team comply with a freedom of information act request?

Maybe. The answer depends on the contents of the state law(s) that apply to disclosure of information held by an OFR team. States with OFR-specific statutes often address this issue by exempting an OFR team from state freedom of information act laws or declaring OFR information confidential. In the absence of such provisions, however, an OFR team should consult a local attorney to determine what, if any, OFR records must be produced under other protections/exceptions that exist in state disclosure laws (e.g., protections against disclosure of individuals’ health information or confidentiality of ongoing death investigation and public health authority investigation data or information).

May an overdose fatality review (OFR) team member with authorized access to the Overdose Detection Mapping Application Program’s (ODMAP) National Map share ODMAP overdose spike and aggregate data trend information to provide additional context to the OFR team?

Yes. Using ODMAP in this fashion does not violate federal health information privacy laws. In addition, it is allowed under ODMAP’s policies and procedures. For example, an ODMAP user participating on an OFR team can share—with respect to the general location of the fatal overdose under review—the number of overdose incidents reported to ODMAP in the days surrounding the fatal overdose and how this number compares to the typical number of overdose incidents in that area. The OFR team in Ocean County, New Jersey, uses ODMAP information in this manner.

Do note that only authorized users at ODMAP participating agencies granted access to the National Map by the agency administrator may view the National Map’s informational dashboard. Accordingly, for ODMAP information to be used in any form by an OFR team, one or more OFR team members must have access to the National Map.