Access to the health and care records of deceased people

This guidance is relevant to you if you are seeking access to the records of someone who has died; for example, a family member.

You can contact the health and care organisation that cared for the person to request this. That organisation will carefully consider the request before reaching a decision.

Access will usually be granted where the request comes from a personal representative of the deceased who holds a role set out in law. This is usually the person who holds the probate documentation (such as the Grant of Probate or Letters of Administration) or is named as executor in the deceased’s will.

If you are not the personal representative of the deceased but you have a claim arising out of the death of the deceased, you may have the right to see the health records of the deceased where they are relevant to your claim. However, because the duty of confidentiality extends after someone has died, an NHS organisation will not always grant access. Staff will need to take into account, for example, any wishes the individual expressed before they died.

The situation is different for access to social care records. If you are not the personal representative of the deceased, you will need to obtain the written permission of the personal representative to gain access to the deceased’s social care record. Alternatively, you could gain access via a court order.

To make a request to access the records of someone who has died, you may need to provide the following:

• information that identifies the deceased, such as their name and date of birth or NHS number
• documentation demonstrating that you are the personal representative or you have permission from the personal representative
• information that identifies who you are (including photographic ID)
• information outlining what your request is for; for example, exactly which records you are requesting and the reason you are requesting them (if applicable).

You should receive a response within 40 days.

When a patient or service user dies, you may be asked for a copy of, or access to, their record. A family member, for example, might ask to see the record.

These requests will need to be considered carefully. However, it is usually possible to agree to such requests in the appropriate circumstances.

In NHS organisations there will usually be someone who is responsible for dealing with access requests. You should inform the relevant individual or team as quickly as possible of the request, or let the requester know who to contact, depending on your local policy. For requests to access health records, your organisation needs to respond to the request within a set time limit.

There is no equivalent right of access to social care records, so you should check with senior staff whether access should be granted (see ‘Information governance professionals’ below for further information).

The Caldicott Guardian should also be informed in cases of uncertainty so that they can make recommendations about whether information should be disclosed.

You may need to provide information to support those dealing with the request. For example, you may be asked:

• if you are aware of any wishes (written or verbal) of the deceased individual relating to their information being shared
• if there is anything in the record which would either cause distress to the family or benefit them to know
• if there is any third party information in the record; for example, information about other family members
• if there is anything in the record which if disclosed might cause harm to another person
• to explain any clinical abbreviations or terminology in the record, to help the person who has asked for a copy of the record understand it

You should then provide those dealing with the request with the required information or record so that they can facilitate access to the requester.

If you are a health and care professional who is responsible for making a decision about access, refer to ‘Information governance professionals’ below. The British Medical Association (BMA), General Medical Council (GMC) and Medical Defence Union (MDU) have provided further guidance for doctors on requests to access records.

Requests to access records following an individual’s death can be complex. It is important to consider each request on a case-by-case basis.

Requests may be made using the wrong terminology or legislation, such as asking for access under UK GDPR (General Data Protection Regulation) or the Freedom of Information Act 2000 (FOIA), or may not mention any legislation. In these situations, you should contact the requester to advise them about the correct process to apply for access, and support them to follow this. You should not refuse the request outright because the requester has used the wrong legislation or access route. For organisations subject to the FOIA, if a request is made but there is no legal right of access, you may need to issue a refusal notice, citing the appropriate exemptions under the FOIA.

Types of requests

Coroners

Coroners (or their offices) have a legal right to access the records of a deceased individual to support their inquests. You must provide the information requested by the coroner.

Medical examiners

Medical examiners may request the records of deceased people for independent scrutiny. There is a legal basis for healthcare organisations to share relevant confidential patient information with medical examiners. This is covered by a section 251 approval following an application to the Confidentiality Advisory Group by NHS England.

In due course it will become a legal requirement for health and care organisations to provide medical examiners with relevant information. We will update this guidance when this change happens.

The Care Quality Commission (CQC)

The CQC has a legal right to access the records of deceased people, where required in the course of its investigations. The CQC Code on Confidential Patient Information provides further information.

Personal representatives

A personal representative of the estate of the deceased (a person holding the Grant of Probate or Letters of Administration) can request access to a health record under the Access to Health Records Act (AHRA) 1990. For example, a personal representative may need information about the deceased’s care in a nursing home.

If the request for access to the health record is made by a personal representative, then information can only be withheld or redacted from the records if the AHRA permits it. Information can be withheld if:

• the deceased expressly indicated they did not want parts of their record to be disclosed
• the record, if disclosed, would be likely to cause serious harm to another person
• the record of the deceased refers to another individual (who is not a treating healthcare professional)
• the record contains information provided by the patient, or resulting from an examination or treatment, which you have reason to believe the patient would have felt particularly sensitive about and would not have expected to be disclosed.

The AHRA does not apply to record entries made before 1 November 1991 when the Act came into force. This means that if access was granted to the record of a person born before 1 November 1991, only the entries made after 1 November 1991 are legally required to be shared, unless it is necessary to see the earlier entries to understand the later ones. However, you may decide to share records from before 1 November 1991 in line with the guidance set out above.

The AHRA only applies to records made by or on behalf of a healthcare professional in relation to the care and treatment of the individual. This includes such records made by social care workers who are registered with the Health and Care Professions Council. Outside this, there is no equivalent provision granting a right of access to social care records. However, we recommend as a matter of good practice that a personal representative be granted access to the social care records of a deceased service user on the same basis, and subject to the same restrictions, as would arise under the AHRA.

People who have a claim arising from the death of the deceased

Someone who has a claim arising from the death of the deceased can also request access to the health records of the deceased under the AHRA. If they do not have the authorisation of the personal representative, you should request evidence of the nature and basis for their claim, and you should only disclose information which is relevant to the claim. If the information is relevant to the claim, it can only be withheld on the grounds permitted under the AHRA, as set out in ‘Personal representatives’ above.

No equivalent right of access to social care records is given to those who have a claim arising out of the death of the deceased. Such individuals can only access the social care records with the authorisation of the personal representative, or by obtaining a court order.

The police

The police may request records of deceased people as part of their investigations. You may consult your information governance (IG) team or a senior member of staff regarding disclosure to ensure there is a legal basis for any disclosure and that the information shared is relevant to and necessary for the stated purpose. In most cases, to make a disclosure you will need to be satisfied that the public interest served by disclosure outweighs the public interest served by protecting the confidentiality of the individual and the public interest served by providing a confidential service to the wider public. You can refuse a request from the police if you are not satisfied that disclosure is relevant or necessary for the stated purpose. The NHS IG portal has detailed guidance about disclosures to the police.

Researchers

Where confidential information about a deceased person is required for a purpose beyond individual care, such as research, service evaluation or national clinical audit, the requester should obtain approval from the Health Research Authority, under section 251 of the NHS Act 2006.

You are not obliged to provide information; however, we would encourage you to support research where there are appropriate approvals in place. You should also consider, and usually honour, any wishes the individual expressed before they died. Consent given before death is assumed to extend beyond death. Third party information must be removed (see ‘Third party information’ below).

Sharing information with family members or individuals close to the deceased

There are times when it is appropriate to share information with a family member or an individual close to the deceased. However, this would be outside the remit of AHRA, which would be in the form of a formal written request to access the record.

While the UK GDPR does not apply, the common law duty of confidentiality still applies to the health and care records of the deceased. You will therefore need to carefully consider the circumstances. If the patient had authorised the sharing of information in their lifetime (for example, to enable someone to pursue a complaint on their behalf), then that sharing should continue. Sharing general information about a patient’s death with those close to the patient where there is no reason to believe that the patient would have objected to such disclosure will be permissible. Where it is difficult to reach a decision, contact your Caldicott Guardian.

You should also take into account the likelihood of the disclosure causing unnecessary harm or distress to the family; for example, a hereditary condition which is communicated without the involvement of an appropriate health and care professional but where sharing would be in the best interests of family members. In cases such as these, speak to an appropriate health and care professional about how best to communicate the information.

You will also need to consider the likelihood of information sharing being of benefit to the family of the deceased; for example, sharing certain information could reduce the emotional or mental harm experienced by grieving relatives. For example, where a person died of COVID-19 and their relatives were unable to visit them because of the infection control measures in place; or where a parent asks for information about the circumstances and causes of their child's death.

Important issues when considering a request

The wishes of the deceased individual

If a patient or service user expresses any wishes or intentions about who can or cannot access their records after their death, you should ensure this is documented in the record.

The wishes of the deceased individual should normally be respected. However, in some cases, you may establish grounds to disclose the information to the requester, against the stated wishes of the deceased (see ‘Public interest disclosures’ below).

Where there are no documented wishes of the deceased, the views of the staff who cared for the patient or service user will be important, as a wish may have been verbally communicated to them.

You should be willing to facilitate the sharing of information with a person who was closely involved in the care and treatment of the deceased, where there is no indication that the deceased would have objected to the information being shared with that person. If the request is to provide access to the record under AHRA, permission from the personal representative must also be sought. The health and care team should be involved where necessary. The Caldicott Guardian should also be involved in these decisions if there is uncertainty.

A record should be kept of disclosure decisions and the reasons why they were made. This may be needed at a future date and you may be asked to justify the decision; for example, if the will is contested at court months after the person died.

Public interest disclosures

The Public Interest Test sets a necessary high bar for disclosure of information, as this may allow a disclosure against the wishes of the deceased. There may be a public interest justification for the disclosure of information in a record:

• When protecting a person from serious harm; for example, disclosing information about a communicable disease so that an individual can seek appropriate care and support.
• Where the public interest served by the disclosure outweighs both (i) the public interest served by protecting the deceased person’s privacy and (ii) the public interest served by maintaining public trust in the confidentiality of services provided by the health and care system. An example is where concerns have arisen about clinical practice that may have contributed to the death of the patient or service user.

Care must be taken when making disclosures in the public interest and these decisions should be made on a case-by-case basis in consultation with your IG team, Caldicott Guardian or relevant senior member of staff. Disclosures made for trivial or minor reasons may undermine public trust in the confidential nature of health and care services. This could adversely affect a person’s health or care because they may not seek care and support as they do not trust services to keep their information confidential.

Further information on public interest disclosures can be found from the Department of Health and Social Care and on the General Medical Council website.

Third party information

UK GDPR only applies to living people. Disclosure of information about a deceased person does not therefore breach data protection legislation. It may, however, apply to any information about third parties within the record. You will therefore need to screen the record and consider withholding information that identifies a third party or might otherwise put another person at risk of serious harm.

Any third party information in the record, such as information about other family members, must therefore be withheld unless there is a legal reason to disclose it. Examples include being ordered to disclose it by a court or there is a public interest justification for this to be disclosed to the requester. Information about registered health and care professionals providing care should not be redacted.

Disclosing relevant information to the requester

Where disclosure of the record or information in the record is approved, you should generally only disclose what is relevant and necessary to satisfy the request or claim.

Requests from personal representatives are however different due to case law. A personal representative can request all the records, and these should be provided subject to the removal of any exempt information (see 'Personal representatives' above).

Practical issues when responding to a request

Time limit for responding to a request

The time you have to respond to a request for health records will depend on when the record was last amended.

If no entries, additions or amendments have been made to the record in the 40 calendar days prior to the date of application, you have 21 calendar days from the date of receiving the request to either grant or refuse the request to access the deceased person’s record.

If entries, additions or amendments have been made to the record in the 40 calendar days prior to the date of application, you have 40 calendar days from the date of receiving the request to either grant or refuse the request to access the deceased person’s record.

If the request is for social care records, there is no set timeframe in which you need to respond. However, it would be good practice for social care organisations to respond within the time scales set out above.

Requesting identification from those requesting access

Anyone requesting access must have their identity or credentials verified, such as evidence of their identity and that they have the Grant of Probate or are a named executor. However, you should avoid putting unreasonable or additional burden on bereaved individuals who have made access requests. For example, rather than requesting a solicitor’s letter, you should request identity or other documents (such as a driving licence or passport) that are likely to be readily available at little or no cost to the requester.

In some cases, health or care staff may be able to confirm the identity of a requester who does not have the required documentation. For example, a family member or close individual may be well-known to staff in palliative care settings, or the deceased and their family may have had regular contact with the health and care system due to a chronic condition or substantial care needs.

If a solicitor is acting on a requester’s behalf, it is the solicitor’s professional responsibility to verify that the requester is the legitimate personal representative of the deceased, or has a legitimate claim. You can accept the solicitor’s statement that they have done the necessary checks, provided that they submit it to you in writing by letter or email.

The process for disclosure should also be as straightforward as possible, recognising that the person requesting access to the record could be a bereaved relative.

Records held in multiple locations

Organisations should consider whether any of the record is stored in another location; for example, if part of the record is held in a paper archive. As controllers, it is up to organisations how to best manage this, which may include adding a note on the electronic health and care record stating where paper records are held and the dates they cover. Requests for records should be taken to extend to all relevant information in the health or social care record, however this is held.

Procedures to follow for GP records

The holder of the record is responsible for responding to access requests. For GP records, this is the patient’s last registered GP.

Previously, GP records were printed and transferred to Primary Care Support England (PCSE), who responded to access requests. From 1 August 2022, GPs are no longer required to print off digitised records and send them to PCSE after the death of an individual. They must simply store the record for the required 10 year retention period.

Where a GP practice receives a request for the health record of a deceased individual held by PCSE, they should make a request for the records if they do not already hold a copy. PCSE will send a scanned copy of the record to the GP practice. Where practices have closed down, or where the individual was deregistered, PCSE will respond to requests directly.

The only time when GP practices will be required to print digitised records is when their practice is due to close, in which case they should print any records of patients who have died from 1 August 2022 to the date of the practice closure. GP practices will be informed once this requirement has ceased.