Brian Caldwell-White, case manager at Medical Protection, provides guidance on handling requests to release the medical records of a deceased patient

GPs will occasionally receive a request to disclose part or all of the medical records of a patient who is deceased. The request for the information can come from various sources and have a wide variety of reasons including:

• For the purpose of a clinical negligence claim
• A family member disputing the last will
• A family member or friend trying to understand the circumstances surrounding the death
• For the purpose of an official inquiry or inquest

Before releasing any information that has been requested, there are a number of key factors that must be considered by the person handling the request including the purpose of the request, the relevant legislation, the status of the requestor and if the deceased person made their wishes known in life.

Legislation

As the General Data Protection Regulations 2018 (GDPR) and the Data Protection Act 2018 (DPA) relate to natural (living) persons, it is the Access to Health Records Act 1990 (AHRA) that remains the current legislation in relation to the release of a deceased patient’s medical records.

The statutory rights of access are set out in the Access to Health Records Act 1990 and the corresponding legislation in Northern Ireland, the Access to Health Records (Northern Ireland) Order 1993. The Access to Health Records Act 1990 covers manual health records made since 1 November 1991. In Northern Ireland the Access to Health Records (Northern Ireland) Order 1993 covers manual records from 30 May 1994. Access must also be given to information recorded before these dates, if this is necessary to make any later part of the records intelligible.

The AHRA permits a personal representative (which would be an executor, or administrator, of the estate) or any person who may have a claim arising out of a deceased patient’s death to make an application for access to a health record, or to any part of a health record, of a deceased patient. There is an exemption to this, which is if the patient clearly stated in life that they would not wish such a disclosure to be made.

The Coroners and Justice Act 2009 gives power to the coroner to obtain the medical records of a deceased person for the purpose of an investigation or inquest. In the case of a Fatal Accident Inquiry (FAI) in Scotland, the Procurator Fiscal may submit a request to access the health records of a deceased patient.

Section 251 of the National Health Service Act 2006 (which applies in England and Wales) and the Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 allow the common law duty of confidentiality to be set aside for defined purposes where it is not possible to use anonymised information and where seeking consent is not practicable

For example, there could be a request made by Public Health England where there is a threat to the health of the public at large.

What can be disclosed? 

When considering disclosure to a personal representative or person who may have a claim arising, it is worth noting that as per section 5(4) of the Access to Health Records Act, a person with a claim arising is only entitled to information that is relevant to a claim. Whereas a personal representative, as per recent clarification from the High Court in the matter of Re AB [2020] EWHC 691 (Fam), has a right of access to all of the deceased’s records, not just those relevant to any claim which may arise out of the patient’s death.

A doctor should also take into consideration paragraphs 136 and 137 of the GMC’s Confidentiality in handling patient information after death:

“…whether and what personal information may be disclosed after a patient’s death will depend on the facts of the case. If the patient had asked for information to remain confidential, you should usually abide by their wishes. If you are unaware of any instructions from the patient, when you are considering requests for information you should take into account:

• whether disclosing information is likely to cause distress to, or be of benefit to, the patient’s partner or family
• whether the disclosure will also disclose information about the patient’s family or anyone else
• whether the information is already public knowledge or can be anonymised or de-identified for the purpose of the disclosure.

Circumstances in which you should usually disclose relevant information about a patient who has died include:

• the disclosure is permitted or has been approved under a statutory process that sets aside the common law duty of confidentiality, unless you know the patient has objected
• when disclosure is justified in the public interest to protect others from a risk of death or serious harm
• for public health surveillance, in which case the information should be anonymised, unless that would defeat the purpose
• when a parent asks for information about the circumstances and causes of a child’s death
• when someone close to an adult patient asks for information about the circumstances of that patient’s death, and you have no reason to believe the patient would have objected to such a disclosure
• when disclosure is necessary to meet a professional duty of candour
• when it is necessary to support the reporting or investigation of adverse incidents, or complaints, for local clinical audit, or for clinical outcome review programmes.”

Can a fee be charged?

Legislative changes to the Data Protection Act 2018 also amended the Access to Health Records Act 1990, which now states access to the records of deceased patients, and any copies, must be provided free of charge.

If you need assistance with this situation or anything similar, please call the Medical Protection advice line on 0800 561 9090.