The Georgia Supreme Court has found state law does not preempt HIPAA regarding a surviving spouse’s ability to access her dead husband’s medical records. In the case, the surviving spouse sought medical records from a nursing home as part of a possible wrongful death action. The nursing home denied the request, contending that under HIPAA, the records only could be released to a permanent administrator or executor of the estate. Finding that Georgia statutory law permits a surviving spouse to file suit on behalf of the deceased spouse, the court concluded that HIPAA’s regulation allowing an authorized person to act on behalf of the deceased person “under applicable law” was sufficient to allow access to the medical records. In so doing, the court rejected the contention that the HIPAA regulation preempts Georgia state law, noting that HIPAA does not preempt any state law which provides more stringent disclosure requirements and that the Georgia law limited disclosure of only certain records to the surviving spouse while the HIPAA regulation permits any executor, administrator, or authorized person to have access to protected health information. In a dissent, Justice Melton of the Georgia Supreme Court concluded that the surviving spouse was acting on her own behalf in pursuing a wrongful death claim which was unrelated to any authority to act on behalf of her deceased husband.

Tip: Note that state statutes governing protected health data which are more restrictive than the HIPAA regulations are likely to be upheld.