After a patient has died, GP practices are often approached by relatives, carers or officials asking for confidential information about the patient.
There are a number of reasons why they might do so, such as:
- they may wish to make a complaint about the care the patient received
- they may want the information as part of a possible claim
- they may be challenging the patient's will
- they may need the information to complete official documents - for example, for family members to make an insurance claim on a cancelled holiday.
It can be very difficult for practices to know what, when and to whom it is appropriate to disclose a deceased patient's records. You should be aware of both the legislation and the GMC's requirements in this area.
Legislation
The relevant legislation is:
- Access to Health Records Act 1990 - applies in England, Scotland and Wales.
- Access to Health Records (Northern Ireland) Order 1993 - applies in Northern Ireland.
Both Acts give a deceased patient's personal representative, and anyone who may have a claim arising out of the patient's death, a right to make an application for the patient's medical records.
Terminology
'Personal representative' is the general term for a person or people who deal with the estate of a deceased person. If there is a will, the personal representative is known as an executor. If there is no will (or if the will did not appoint executors) the personal representative is called an administrator.
The duties of an executor and an administrator are broadly similar. The term 'personal representative' in this guidance refers to both roles.
The right of access
The right of access is not a general right and access may be limited to information relevant to the possible claim when the applicant is not the personal representative.
Access should be limited or refused if one of the following conditions applies:
- there is evidence the patient would not have expected the information to be disclosed to the applicant
- if the disclosure is likely to cause serious harm to anyone else
- if it would also disclose information about a third party (other than a health professional involved in the care) who does not consent
- if it would disclose information that is not relevant to any claim that may arise out of the patient's death (if the applicant is not the personal representative)
- if it predates 1 November 1991 in England, Scotland and Wales (unless earlier records are required to understand subsequent entries).
Access must be refused to records containing a note, made at the patient's request, stating they did not wish access to be given on an application under this legislation.
GMC guidance
The relevant provisions are set out in the GMC's Confidentiality: good practice in handling patient information (2017), paragraphs 134-138.
134. Your duty of confidentiality continues after a patient has died.
135. There are circumstances in which you must disclose relevant information about a patient who has died. For example:
a. when disclosure is required by law
b. to help a coroner, procurator fiscal or other similar officer with an inquest or fatal accident inquiry
c. on death certificates, which you must complete honestly and fully
d. when a person has a right of access to records under the Access to Health Records Act 1990 or the Access to Health Records (Northern Ireland) Order 1993, unless an exemption applies
e. when disclosure is necessary to meet a statutory duty of candour.
136. In other circumstances, whether and what personal information may be disclosed after a patient's death will depend on the facts of the case. If the patient had asked for information to remain confidential, you should usually abide by their wishes. If you are unaware of any instructions from the patient, when you are considering requests for information you should take into account:
a. whether disclosing information is likely to cause distress to, or be of benefit to, the patient's partner or family
b. whether the disclosure will also disclose information about the patient's family or anyone else
c. whether the information is already public knowledge or can be anonymised or de-identified
d. the purpose of the disclosure.
137. Circumstances in which you should usually disclose relevant information about a patient who has died include:
a. the disclosure is permitted or has been approved under a statutory process that sets aside the common law duty of confidentiality, unless you know the patient has objected (see paragraphs 103-105)
b. when disclosure is justified in the public interest to protect others from a risk of death or serious harm
c. for public health surveillance, in which case the information should be anonymised, unless that would defeat the purpose
d. when a parent asks for information about the circumstances and causes of a child's death
e. when someone close to an adult patient asks for information about the circumstances of that patient's death, and you have no reason to believe the patient would have objected to such a disclosure
f. when disclosure is necessary to meet a professional duty of candour (see paragraphs 100 and 101)
g. when it is necessary to support the reporting or investigation of adverse incidents, or complaints, for local clinical audit, or for clinical outcome review programmes.
138. Archived records relating to deceased patients remain subject to a duty of confidentiality, although the potential for disclosing information about, or causing distress to, surviving relatives or damaging the public's trust will diminish over time.
Responding to a request for information about the circumstances surrounding death
Usually, if an individual who is known to the deceased is requesting information in relation to the circumstances surrounding the death, it will be appropriate to rely on the above GMC guidance.
However, when records are requested for purposes other than understanding the circumstances surrounding the death, it would be prudent to consider the steps below.
Responding to a request for disclosure of the medical records: eight-step process
Paragraphs 134-138 of the GMC's guidance on confidentiality apply to disclosure of information after the death of a patient. Taken together with the relevant legislation, they can be distilled into a series of steps to follow when you receive a request for disclosure of the medical records.
The steps apply when:
- a third party asks for disclosure of medical records, and
- the practice is unsure about the nature of the request and/or identity of the third party.
The eight steps
- You should make it clear to the applicant/complainant that while you have no wish to be obstructive, you must consider your duty of confidentiality to the patient, which is ongoing after death.
- Ask the applicant/complainant to specify what information they are requesting, why they require the medical records and for what purpose these will be used. Also ask them to confirm whether or not they are the personal representative of the deceased patient's estate (preferably in writing). It should help you understand why the medical records are being sought, which ones may be relevant to the request, and whether they can be disclosed.
If the Lloyd George records are being requested by the personal representative, or the applicant can make a case for why they may be relevant to a claim, changes to GP contracts from 1 April 2022 mean that it will be the practice's responsibility to seek these from PCSE.
- You may want to seek the personal representative's views on the application for disclosure; for example, in a will dispute case. If this is the case, you should ask the applicant/complainant if they are the personal representative of the patient's estate - and if not, for the name and contact details of the personal representative, if known to them.
- If the personal representative is known and the applicant/complainant is happy for them to be contacted, move to step 7.
- If the applicant/complainant does not know the identity of the personal representative, proceed to step 8.
- If the applicant/complainant objects to you making the personal representative aware of their application/complaint, you should ask for their reasons and explain that it may hinder your ability to respond to the request. Once the reasons are provided, move to step 8.
- You should write to the personal representative, making them aware of the application/complaint and seeking their views on the requested disclosure. If the personal representative opposes disclosure, ask them to explain their reasons.
- Once you have all the necessary information from the applicant/complainant and the personal representative (where appropriate), you should review it alongside the relevant parts of the patient's records. You should also take into account paragraphs 134 and 135 of the GMC's guidance on confidentiality, and form a view on whether the requested disclosure is a) required by the legislation, or b) reasonable under all the circumstances.
You should bear in mind that the consent of the personal representative is not a requirement for disclosure and it is not always necessary to approach them to seek their views. You may provide information to individuals other than personal representatives where the criteria for disclosure under the Access to Health Records Act 1990 are met.
This can be a complex and confusing process. It can sometimes be very difficult to discern what is being requested and why.
Any members who have concerns about a request being made under the above legislation - for example, where a third party believes they may have a clinical negligence claim arising out of the patient's death - should contact the MDU for individual advice and assistance.
This page was correct at publication on 30/01/2024. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.