Modern end-of-life care can involve much more information than a traditional medical chart. Hospital records, hospice notes, telehealth visits, patient portals, connected monitors, medication applications, and digital support platforms may all collect details about a person’s health and daily life. Family members often help manage these tools, raising an important question: who controls end-of-life health data, and who can access it during care and after death?

The issue received new research attention in October 2026. A qualitative preprint on arXiv, “When Care Expands and Control Declines,” examined privacy experiences involving terminally ill patients, caregivers, and physicians. It is not a nationwide survey or a statement of United States law, but it raises practical questions about consent and access.

What Counts as Health Data at the End of Life?

Health information includes more than diagnoses, test results, and prescriptions. Depending on the services a person uses, digital records may include:

• Hospital, physician, hospice, and palliative-care records
• Patient portal messages, appointment notes, and discharge instructions
• Medication lists, symptom logs, and pain or mood journals
• Readings from connected blood-pressure, heart-rate, oxygen, sleep, or activity devices
• Information stored in telehealth, wellness, caregiving, or grief-support applications
• Messages, recordings, or notes entered into AI-assisted support tools

Some systems also generate alerts, risk scores, or predictions from existing data. Patients may not know how platforms combine readings or who can see the resulting analysis.

Why Privacy Can Become Harder to Manage During Serious Illness

When a person is well, they can review settings and decide which relatives receive updates. Serious illness, fatigue, pain, medication, or cognitive changes can make account management harder. Caregivers may step in, but helpful access can gradually expand beyond the task the patient intended.

The October 19 study involved 21 patients, 11 caregivers, and eight physicians at three tertiary hospitals in mainland China. It identified concerns about continuous monitoring, informal account handovers, inferred health information, and data that remains after death. Its small, single-country qualitative sample cannot show how common these issues are in the United States, but it offers a useful framework for discussion.

How HIPAA Applies to End-of-Life Care in the United States

In the United States, the HIPAA Privacy Rule applies to health plans, health care clearinghouses, and certain health care providers. Vendors performing covered services for them may also be business associates.

HIPAA does not cover every company that handles health-related information. A hospital portal is generally connected to a covered provider, while a direct-to-consumer wellness app or grief platform may follow different rules. See the HHS explanation of covered entities and business associates.

Can a Family Member Access a Patient’s Medical Information?

Being a spouse, adult child, or caregiver does not automatically grant unrestricted access to another adult’s medical records. A patient with decision-making capacity can tell providers whom to involve and authorize disclosures.

If a patient is absent or incapacitated, a provider may share relevant information with someone involved in care or payment when professional judgment indicates it is in the patient’s best interest. This does not create automatic full-record access. See HHS guidance on family access when a patient is incapacitated.

A health care power of attorney or other legally recognized personal representative may have access within the scope of their authority. The HHS personal-representative guidance explains that authority depends on applicable law and the document’s terms.

Privacy and Good Care Can Coexist

Protecting privacy does not mean shutting out everyone who helps. A caregiver may need medication instructions, appointment details, or emergency contacts to provide safe support. The goal is to match access to the task: a relative coordinating transportation may not need counseling notes, while someone managing medication may need an up-to-date list. Ask providers whether they offer separate proxy accounts or role-based access instead of sharing the patient’s password. Revisit permissions when care needs or relationships change.

What Happens to Medical Records After Death?

HIPAA protection does not end immediately after death. HHS says the Privacy Rule protects identifiable health information for 50 years after death. During that period, an authorized personal representative can exercise relevant rights.

People involved in the person’s care or payment may also receive relevant information unless that conflicts with a known prior preference. This is not blanket access for every relative. See HHS guidance on deceased individuals’ health information.

Families may need records for estate administration, insurance, or a surviving relative’s care. Providers may request proof of identity and authority; state law and record type can affect the process.

Health Apps and Wearables May Follow Different Privacy Rules

Watches, blood-pressure monitors, medication apps, and symptom trackers can help with care, but calling a product “health” or “secure” does not mean HIPAA covers it.

The FTC’s Health Breach Notification Rule covers certain personal health record vendors and related services when unsecured identifiable health data is breached. Its 2024 amendments clarified its application to many health apps and connected devices outside HIPAA.

In September 2026, the FTC withdrew an older policy statement because the amended rule had made it unnecessary. The agency did not repeal the rule itself. See the FTC’s September 2026 announcement.

Practical Steps Patients and Families Can Take

Privacy planning need not become another burden during serious illness. A few decisions made while the patient can express their wishes can reduce confusion later.

• List the systems. Identify portals, telehealth services, apps, wearables, and devices that hold health information.
• Set caregiver access. Decide who may receive updates or manage a device, and limit access to what is needed.
• Use formal permissions. Ask about proxy access, health care power of attorney documents, release forms, and how to change or revoke access.
• Review app policies. Check collection, sharing, retention, deletion, and account-closure terms.
• Secure accounts. Use unique passwords and multifactor authentication. Prefer separate proxy access over shared credentials.
• Record post-death wishes. Note who should handle records and which accounts should be closed or preserved.

The National Institute on Aging’s advance-planning checklist can help organize documents and wishes. NewDeaths also explores related issues in its guides to digital time capsules and AI afterlife avatars.

Be Careful When Sharing Medical Records With AI or Memorial Platforms

Digital memorials and AI grief tools can help preserve memories or offer support, but they are not automatically medical-record systems. Before uploading diagnoses, medication lists, hospice notes, or private conversations, check how the service stores, analyzes, shares, and retains that information.

NewDeaths has covered AI grief companions and digital bereavement support. Share only what is necessary, confirm who can access it, and do not assume HIPAA applies simply because a platform discusses health or grief.

What to Do If You Suspect Improper Access

Record what happened, when, which account was involved, and any notices received. Contact the provider’s privacy officer or the app’s privacy contact. Ask what was accessed or shared and how to secure the account.

For a suspected HIPAA violation involving a covered entity or business associate, individuals can learn about filing a complaint through the HHS Office for Civil Rights. For certain consumer health-app breaches, the FTC provides information about the Health Breach Notification Rule. The correct route depends on the organization and the type of information involved.

Conclusion

End-of-life health data privacy is about dignity, consent, family relationships, and the ability to decide who knows intimate details. Digital tools can support care, but access should be clear, limited to a real need, and consistent with the patient’s wishes.

In the United States, HIPAA protects covered health information, including for 50 years after death, while other rules may apply to consumer apps. Documenting preferences, setting up appropriate proxy access, and reviewing app policies can reduce uncertainty while respecting the patient’s right to privacy and control.

This article is for general educational purposes, focuses on United States rules, and is not legal or medical advice. State laws and individual circumstances may differ.