Fact Sheet - Access to a deceased person’s health information

Read the fact sheet below or download it here Fact Sheet - Access to a deceased person’s health information, updated December 2020

This fact sheet clarifies who can access a deceased person’s health information in NSW.

When a person dies, privacy laws continue to protect their health information for 30 years after the date of death. Yet there are circumstances where family members and other interested parties may wish to access information about a deceased person from government agencies and health care providers.

In NSW, the relevant laws include the:

• Privacy and Personal Information Protection Act 1998 (PPIP Act)
• Health Records and Information Privacy Act 2002 (HRIP Act)
• Government Information (Public Access) Act 2009 (GIPA Act).

In relation to health information, NSW Health’s Privacy Manual for Health Information and private health providers’ own internal policies may also provide relevant guidance when considering the requirements of the HRIP Act.

What is health information?

Health information is a specific type of ‘personal information’ which may include information about your physical or mental health or disability. It includes:

personal information you provide to any health organisation
a health service already provided to you
a health service that is going to be provided to you
a health service you have asked to be provided to you
some personal information for organ donation
some genetic information about you, your relatives or your descendants.

Who can access health information?

You have a right to access your own health information under Health Privacy Principle (HPP) 7 of the HRIP Act. The IPC has published a fact sheet on accessing your health information in NSW.

These rights apply to individuals or people authorised to act on their behalf. The right to access information cannot be exercised on an individual’s behalf after they have passed away. However, organisations may have their own policies about when access to information about a deceased person should be provided.

Seeking disclosure of a deceased person’s health information

HPP 11 limits the disclosure of health information but provides for circumstances where an organisation can disclose an individual’s health information even without the individual’s consent. Most relevantly to deceased people, a health service provider could determine that disclosure is reasonably necessary where:

there is a serious and imminent threat to the health or welfare of the individual or another person or a serious threat to public health or safety
the information is genetic information and its disclosure could lessen or prevent a serious threat to the life, health or safety of a genetic relative of the individual; or
the information is sought by an immediate family member of the individual for compassionate reasons and the disclosure is limited to the extent reasonable for those compassionate reasons.

The IPC has published guidelines for organisations in NSW on the use and disclosure of genetic information to a patient’s genetic relatives.

It is important to note that the circumstances described in HPP 11 do not create a right of access to a deceased person’s health information for close relatives or other interested parties. Whether disclosure will be made, and the extent of any disclosure, is a discretionary decision to be determined by health service providers on a case-by-case basis.

Where a disclosure is made on compassionate grounds under HPP 11, the information provided will be limited to information that constitutes health information as defined in the HRIP Act. The disclosure would not extend to personal information about an individual more generally.

The HRIP Act does not specify what constitute ‘compassionate reasons’. Where information is disclosed for compassionate reasons, there is also nothing in the HRIP Act that requires this information to be in any particular format.

Although NSW Health’s Privacy Manual for Health Information contains some guidance on compassionate reasons for disclosure, this is guidance only and its intended audience is limited to the NSW public health system.

A decision to disclose health information for compassionate reasons should take into account any wishes expressed by the individual prior to their death (for example, through an Advanced Care Directive, or documented in the health record). Health care providers should keep a record of who requested access to the medical record, the relationship of the requestor to the individual, the grounds for disclosure, the information that was provided and the date this occurred.

Making a complaint

If you are not satisfied with a decision made by a NSW public sector agency regarding the disclosure of health information, you can lodge an application for an internal review by the agency. The agency is required to complete its review within 60 days and will consult with the Privacy Commissioner NSW (IPC). You may also complain directly to the Information and Privacy Commission. If you are unhappy with the outcome of an internal review, you can apply to the NSW Civil and Administrative Tribunal (NCAT) for a review of the conduct or decision complained about.

If your complaint relates to a decision on the disclosure of health information made by a private sector person or organisation, you can complain to the Information and Privacy Commission. NCAT can also hold an inquiry into a complaint about a private sector person but only if you have first complained to the Privacy Commissioner and a report has been prepared.

Further details on making a complaint is available on the Information and Privacy Commission website.

The GIPA Act

If the information you are seeking is held by a NSW public sector agency, you can also apply for access to health information under the GIPA Act. Information on how to apply for access to information from a public sector agency is available on the Information and Privacy Commission website.

While there is a general presumption in favour of disclosure in the GIPA Act, there are relevant public interest considerations against disclosure that an agency will need to consider when assessing an application for personal information. A key consideration when access is sought to a deceased person’s records will be whether disclosure of information would contravene an information protection principle under the PPIP Act or a health privacy principle under the HRIP Act.

To assist agencies to manage applications for personal information made under the GIPA Act, the Information Commissioner has published relevant guidelines, including:

For more information

Contact the Information and Privacy Commission NSW (IPC):

Freecall: 1800 472 679
Email: ipcinfo@ipc.nsw.gov.au
Website: www.ipc.nsw.gov.au

NOTE: The information in this fact sheet is to be used as a guide only.
Legal advice should be sought in relation to individual circumstances.