[0] https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...
HIPAA, actually.
> Presumably it really only applies to interstate insurers,
It applies to all public and private health insurers/payers and healthcare providers in the United States. (Source: over a decade working in roles with some involvement in HIPAA compliance for a large, public, intrastate healthcare payer.)
Specifically, relating to the protection of information after death, the HIPAA Privacy Rule protects information for 50 years after death, but does give full control to the decedent's “personal representative” as determined by applicable law during that period.