Doctors may question if they are permitted to release medical records or other confidential information provided by a patient who subsequently dies. This involves a balance between the duty of confidentially owed to the (deceased) patient, and the needs of the person, often a family member, requesting information about the deceased’s treatment/management.

Duty of confidentiality

As a starting point, medical practitioners owe patients a common law duty of confidentiality. This duty prevents doctors from disclosing, without the consent of the patient, any communications or information obtained in a professional capacity, unless such disclosure is required by law or it serves a public interest.

Medical Council guidance

In the UK there is explicit guidance for medical practitioners that the duty of confidentiality survives a patient’s death. The General Medical Council’s Guidance on Confidentiality (2009) provides expressly that: “Your duty of confidentiality continues after a patient has died.”

However, whilst the Code of Professional Conduct issued by the Medical Council of Hong Kong (January 2009) provides general guidelines on doctors’ responsibility to obtain consent of patients before disclosing medical information to a third party, there is no specific information about whether this applies to a deceased patient. In cases where a patient’s consent is lacking, doctors are required to weigh carefully the arguments for and against disclosure and be prepared to justify the reason. The Code of Conduct recommends doctors seek advice from an experienced colleague, a medical defence society, a professional association or an ethics committee in case of doubt.

Doctors are also reminded to be aware of the Personal Data (Privacy) Ordinance (Cap 486) (the Privacy Ordinance). The Privacy Ordinance however, covers only “personal data” relating to directly or indirectly to a living individual. Thus medical records or information relating to a deceased patient are not protected, nor subject to the requirements or exemptions provided in the Privacy Ordinance.

Tips for doctors

The extent to which confidential information may be disclosed after a patient’s death will depend on the circumstances of each individual case.

If consent from the deceased’s personal representative can NOT be obtained and the situation does NOT fall within any of the statutory exemptions, the doctor will need to conduct a balancing exercise between i) the duty of confidentiality and ii) the overriding public interest which displaces a deceased patient’s (or estate’s) right to have the confidential information protected. The following questions can be used to facilitate carrying out this balancing exercise and to assist in determining whether, what, and how much information you should disclose in relation to a deceased patient’s information.

  • Did the deceased patient request the information be kept confidential after death?
  • Is the one who is making the request the personal representative of the deceased patient (or their legal representatives) or another unrelated third party?
  • What is the intended use of the requested medical records/information?
  • Is the disclosure necessary in preventing other person(s) from serious harm or injury or to prevent, detect or prosecute serious crime?
  • Has the request extended to medical records/information which is not necessary or not directly relevant to the intended use?
  • Would the disclosure cause any harm or distress to the deceased patient’s family or other party?
  • Would the requested medical records/information contain any third party information?
  • Are the requested medical records/information already disclosed in the public?

To conclude, doctors should always balance the benefits and potential damage or harm from disclosure before releasing any patient confidential information and, if in doubt, seek advice from a colleague or defence organisation.