§164.512(f)(4) Permitted disclosure: Decedents. A covered entity may disclose protected health information about an individual who has died to a law enforcement official for the purpose of alerting law enforcement of the death of the individual if the covered entity has a suspicious that such death may have resulted from criminal conduct.

Audit Inquiry

Are policies and procedures in place to determine when it is permitted to disclose PHI to law enforcement about an individual who has died as a result of suspected criminal conduct?
Obtain and review policies and procedures related to disclosures of PHI to law enforcement officials that address the requirement.
Obtain and review documentation of such a disclosure, if available. Elements to consider include, but are not limited to, documentation of:
-Whether the entity exercised professional judgment
-Whether the entity believes in good faith that there was evidence of criminal conduct.