| Course | HI135 Legal Aspects of Health Information |
|---|---|
| Unit | Unit 10 |
| Paper type | Privacy policy draft |
| Length | About 920 words, 6 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | BS in Health Information Management |
| Updated | October 2026 |
Free sample paper for HI135 Unit 10
Fifty Years After the Last Visit: A Unit 10 Privacy Policy Draft Governing Release of a Deceased Patient's Records by a Composite Hospital, From Verifying the Death to Deciding Who Speaks for the Estate
[Student Name]
Purdue University Global
HI135: Legal Aspects of Health Information
Unit 10 Privacy Policy Draft
[Instructor Name]
[Date]
The hospital, its policy number and its roles are composite; the rules the policy applies and the sources cited are real.
Header
Policy: Release of Information for Deceased Patients. Number: HIM-ROI-014. Department: Health Information Management. Effective date: to be set on approval. Reviewers: privacy officer, hospital counsel, director of health information management.
Purpose
To ensure that requests for the records of deceased patients are answered consistently, promptly and within the privacy rule and state law.
Scope
All requests to the release of information office for health information of a patient who has died, in any format. Requests by the hospital's own clinicians for treatment of others, such as genetic counseling of family members, follow the treatment policy.
Definitions
1. Decedent: a patient whose death has been verified under Procedure step 2.
2. Personal representative of a decedent: an executor, administrator or other person with authority under state law to act for the decedent or the estate.
3. Family member involved in care: a relative or other person the decedent involved in their care or payment before death.
Policy Statements
1. A decedent's health information remains protected for 50 years after the date of death (45 C.F.R. § 164.502, 2024). After 50 years, the information is no longer protected health information, though state law or hospital policy may still limit release.
2. A decedent's personal representative may exercise the decedent's rights, including the right of access, and may sign authorizations (45 C.F.R. § 164.502, 2024).
3. The hospital may share with a family member or other person involved in the decedent's care or payment information relevant to that involvement, unless doing so is inconsistent with a preference the decedent expressed and the hospital knows of (45 C.F.R. § 164.510, 2024).
4. The hospital may release information to medical examiners and coroners for identification and determining cause of death, and to funeral directors as needed to carry out their duties (45 C.F.R. § 164.512, 2024).
The policy separates the person who speaks for the estate from the family member who was at the bedside, because the rules give them different reach.
Procedure
1. Log the request on receipt with the requester's name, relationship and what is requested.
2. Verify death through the hospital record, a death certificate or a funeral home statement. If death cannot be verified, process the request as for a living patient.
3. Identify the requester's category. Go to step 4 for a personal representative, step 5 for a family member, step 6 for a medical examiner, coroner or funeral director, step 7 for any other party.
4. Personal representative: require court letters appointing the executor or administrator, or the small estate document state law recognizes. If valid, process as a patient access request, with the same timeliness and fee limits. If not valid, return to step 5 or deny with an explanation.
5. Family member: confirm involvement in care or payment from the record, such as visitor notes, health care proxy or billing contact. Release only information relevant to that involvement, such as the final admission's summary for a daughter who was the health care proxy. Check for any documented objection by the decedent. For anything broader, require an authorization from the personal representative. Decision point: if no personal representative has been appointed, follow the state's next-of-kin access statute where one exists, as determined by counsel.
6. Medical examiner, coroner or funeral director: release what is needed for the stated duty on official request; log it.
7. Any other party, such as a life insurer or an attorney: require an authorization signed by the personal representative.
8. Special categories: psychotherapy notes require a personal representative's separate authorization. Treatment records from a federally funded addiction program follow the federal confidentiality rules for deceased patients, which require consent from a personal representative or, where none is appointed, from the spouse or a responsible family member (42 C.F.R. § 2.15, 2024).
9. Log every disclosure in the release log, including those requiring no authorization.
Exceptions
Requests involving litigation against the hospital, or where family members dispute who speaks for the estate, go to counsel before any release.
Responsibilities
Release staff follow the procedure. The release supervisor decides steps 4 and 5 when documents are unclear. Counsel advises on state next-of-kin law and disputes. The privacy officer reviews the policy annually.
Forms
Request for decedent records; authorization for disclosure signed by personal representative; family involvement verification checklist.
Why the Policy Is Needed
Release staff at the hospital handled about 340 decedent requests last year, and an audit of 40 of them found three patterns this policy corrects. Adult children received full charts on their own signature with no personal representative documents, which overreached what the involvement-in-care permission allows. A life insurer received records on an authorization signed by the decedent years before death, which may have expired or been revoked. And a medical examiner's request waited six days in the general queue. Each pattern traces to the absence of a single procedure that tells staff which category a requester belongs to and what document moves them from one category to another.
Review Cycle
Annually, and after any change in federal or state law on decedents' records.
References
42 C.F.R. § 2.15 (2024). https://www.ecfr.gov/current/title-42/section-2.15
45 C.F.R. § 164.502 (2024). https://www.ecfr.gov/current/title-45/section-164.502
45 C.F.R. § 164.510 (2024). https://www.ecfr.gov/current/title-45/section-164.510
45 C.F.R. § 164.512 (2024). https://www.ecfr.gov/current/title-45/section-164.512
What the HI135 Unit 10 assignment asks for
The final unit usually asks you to draft a departmental privacy policy that pulls together the term's work. Follow the facility template where one exists; without one, a policy normally runs from its header and purpose through definitions, statements and a numbered procedure to exceptions, responsibilities, forms and a review date. Write policy statements as short declarative sentences and the procedure as one action per step, marking decision points where the path splits. Cite federal rules beside the statements they support and name state law where your scenario gives a state. Address special categories of records. Explain briefly why the policy is needed. Write it as a document staff could follow on an ordinary shift, not as an essay.
How the HI 135 Unit 10 example is put together
The draft opens with a header block and short purpose and scope sections, then three definitions. Four policy statements follow, each citing its rule, and a highlighted line separates the estate's representative from family at the bedside. The nine-step procedure verifies death, sorts requesters into four paths, requires court letters from representatives, limits family releases to involvement in care, and addresses special categories, with a margin note on decision points. Exceptions, responsibilities and forms follow. A section reports an audit of 40 requests that shows three problems the policy fixes, and a review cycle closes it. Each procedure step contains one action, so staff can follow it under pressure.
Where the points sit in the HI135 Unit 10 rubric
Policy drafts in HI 135 are generally graded on completeness, accuracy and usability. Points go to correct statements of the rules, each tied to a citation, and to a procedure staff could follow without interpretation. Credit rises for clear decision points, correct handling of special categories and defined responsibilities. Instructors value a document in policy form rather than an essay, and a brief justification grounded in facility data. A review cycle and forms list show completeness. Accurate citations complete the rubric. Drafts that leave key decisions to staff judgment, or that blur family members with personal representatives, tend to lose points. Graders also notice whether the draft says who decides when documents are unclear.
HI135 Unit 10 help from the desk
Many drafts read as research papers about the law rather than as policies. Write declarative statements and numbered steps. Another common gap is failing to say what document proves someone is a personal representative. Do not treat every relative as entitled to the whole record. Remember special categories, which follow their own rules. Keep definitions to terms the procedure actually uses. If your section assigns a different policy topic, send the scenario and template and we will draft the policy in that format. Test the procedure by walking one real-looking request through every step before you submit. Name the reviewer for each year.
Get an HI135 Unit 10 example written to your instructions
If your section supplies a policy template, include it alongside the Unit 10 instructions and rubric; if not, say which department the policy is for. A custom draft comes back within 24-48h, built around any earlier unit work you choose to share. The first one is free of charge, and the approval block stays blank for the right signer. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More HI135 papers and BS in Health Information Management samples
- HI135 Unit 1: Discussion Board Post
- HI135 Unit 2: Authorization Review
- HI135 Unit 3: Release of Information Case
- HI135 Unit 4: Privacy Notice Comparison
- HI135 Unit 5: Retention Schedule
- HI135 Unit 6: Seminar Reflection
- HI135 Unit 7: Amendment Response Letter
- HI135 Unit 8: Breach Notification Memo
- HI135 Unit 9: Disclosure Log Entry
HI135 Unit 10 questions, answered
How long should a departmental privacy policy be?
Long enough for every step to be complete and no longer. The example runs a few pages because the procedure has to cover validity, scope, special categories, exceptions and logging, but each step is a sentence or two. Instructors in this course often mark down padding, so length that comes from background discussion rather than procedure usually costs more than it earns.
Can the policy cite my state's law?
It should, if your scenario names a state, and the reference belongs next to the step it governs as well as in the reference list. Without a named state, the example leaves a marked placeholder rather than inventing a citation. A policy that cites a real provision incorrectly is worse than one that honestly shows where the facility would insert it.
Is a policy the same thing as a procedure?
Not quite, and the draft keeps them apart. The policy statements say what the department does and why, in a few declarative sentences. The procedure says how, step by step, and by whom. Many facilities combine them in one document, as the example does, but a reader should still be able to point to where the rule ends and the steps begin.
Where can I find a free HI135 Unit 10 sample paper?
This page carries the complete Unit 10 policy on releasing deceased patients' records, with its nine-step procedure.
How long are a deceased patient's records protected under the privacy rule?
For 50 years after the date of death, after which the information is no longer protected health information under the federal rule.