Fact Sheet - Access to a deceased person’s health information
Read the fact sheet below or download it here Fact Sheet - Access to a deceased person’s health information, updated June 2023
This fact sheet clarifies who can access a deceased person’s health information in NSW.
When a person dies, privacy laws continue to protect their health information for 30 years after the date of death. Yet there are circumstances where family members and other interested parties may wish to access information about a deceased person from government agencies and health care providers.
In NSW, the relevant laws include the:
- Privacy and Personal Information Protection Act 1998 (PPIP Act)
- Health Records and Information Privacy Act 2002 (HRIP Act)
- Government Information (Public Access) Act 2009 (GIPA Act).
In relation to health information, NSW Health’s Privacy Manual for Health Information and private health providers’ own internal policies may also provide relevant guidance when considering the requirements of the HRIP Act.
What is health information?
Health information is a specific type of ‘personal information’ which may include information about your physical or mental health or disability. It includes details of:
- personal information you provide to any health organisation
- a health service already provided to you
- a health service that is going to be provided to you
- a health service you have asked to be provided to you
- information relating to organ or blood donation
- some genetic information about you, your relatives or your descendants.
Who can access your health information?
In your lifetime, you have a right to access your own health information under Health Privacy Principle (HPP) 7 of the HRIP Act. The IPC has published a fact sheet on accessing your health information in NSW.
If you require the assistance of an authorised representative such as a guardian, then the HRIP Act authorises your representative to access your health information on your behalf.[1]
After you have passed away neither your relatives nor the executor of your will has a right under the HRIP Act to access your health information.
Likewise, after your death, a person who was your authorised representative while you were alive also does not have the right to access your health information. However, organisations may have their own policies about when access to information about a deceased person should be provided.
Disclosure of a deceased person’s health information
HPP 11 limits the disclosure of health information to the purpose for which the information was collected from you. However, HPP 11 also provides for circumstances where an organisation can disclose an individual’s health information without the individual’s consent. In relation to the health information of a deceased person, disclosure is permitted by a health service provider where:
- there is a serious and imminent threat to the health or welfare of the individual or another person or a serious threat to public health or safety
- the information is genetic information and its disclosure could lessen or prevent a serious threat to the life, health or safety of a genetic relative of the individual; or
- the information is sought by an immediate family member of the individual, there are compassionate reasons for its release and the disclosure is limited to the extent reasonable for those compassionate reasons.
The IPC has published guidelines for organisations in NSW on the use and disclosure of genetic information to a patient’s genetic relatives.
The ‘compassionate reasons’ exemption for immediate family members of a deceased person is located in the Health Records and Information Privacy Regulation 2022 (NSW)[2] under HPP 11(1)(l).[3]
It is important to note that the compassionate reasons exemption does not create an alternative entitlement or right of access to a deceased person’s health information for close relatives or other interested parties. Rather, it provides a lawful reason for when information may be disclosed for a “secondary purpose”. Whether disclosure will be made, and the extent of any disclosure, is a discretionary decision to be determined by health service providers on a case-by-case basis.
Where a disclosure is made on compassionate grounds, the information provided will be limited to information that constitutes health information as defined in the HRIP Act. The disclosure would not extend to personal information about an individual more generally.
The HRIP Act does not specify what constitutes ‘compassionate reasons’. Where information is disclosed for compassionate reasons, there is also nothing in the HRIP Act that requires this information to be in any particular format.
Although NSW Health’s Privacy Manual for Health Information contains some guidance on compassionate reasons for disclosure, this is guidance only and its intended audience is limited to the NSW public health system.[4]
A decision to disclose health information for compassionate reasons should take into account any wishes expressed by the individual prior to their death (for example, through an Advanced Care Directive, or documented in the health record). Health care providers should keep a record of who requested access to the medical record, the relationship of the requestor to the individual, the grounds for disclosure, the information that was provided and the date this occurred.
Making a complaint
If you are not satisfied with a decision made by a NSW public sector agency regarding access to or the disclosure of health information, you can lodge an application for an internal review by the agency. The agency is required to complete its review within 60 days and will consult with the Privacy Commissioner NSW (IPC). You may also complain directly to the Information and Privacy Commission. If you are unhappy with the outcome of an internal review, you can apply to the NSW Civil and Administrative Tribunal (NCAT) for a review of the conduct or decision complained about.
If your complaint relates to a decision about the disclosure of health information made by a private sector person or organisation, you can complain to the Information and Privacy Commission. NCAT can also hold an inquiry into a complaint about a private sector person but only if you have first complained to the Privacy Commissioner and a report has been prepared.
Further details on making a complaint is available on the Information and Privacy Commission website.
The GIPA Act
Access to the personal or health information of a deceased relative, if held by a NSW public sector agency, can be applied for under the GIPA Act. Information on how to apply for access to information held by a public sector agency is available on the Information and Privacy Commission website.
While there is a general presumption in favour of disclosure in the GIPA Act, there are public interest considerations against disclosure that an agency will need to consider when assessing an application for access to personal information about another person. A key consideration when access is sought to a deceased person’s records will be whether disclosure of the information would contravene an information protection principle under the PPIP Act or a health privacy principle under the HRIP Act.
To assist agencies to manage applications for personal information made under the GIPA Act, the Information Commissioner has published guidelines, including:
For more information
Contact the Information and Privacy Commission NSW (IPC):
Freecall: 1800 472 679
Email: ipcinfo@ipc.nsw.gov.au
Website: www.ipc.nsw.gov.au
NOTE: The information in this fact sheet is to be used as a guide only. Legal advice should be sought in relation to individual circumstances.
