Floods assistance: support for members impacted by the floods >>

Medical records of deceased patients

Medical records of deceased patients

After a patient dies, your duty of confidentially continues and you have ongoing obligations to manage their medical records, including your duty not to reveal confidential information about a patient without proper legal authority.

PracticesFactsheetsMedical records
13 / 08 / 2019

Quick guide:

1.  Keep the medical records of your deceased patient secure and for at least seven years from the date of the last entry in their record.
2.  The executor or administrator of the deceased patient’s estate has a right to access their medical records and is the correct person to provide authority for another person to access the records.
3.  There are circumstances, such as compassionate grounds, where you may be in a position to disclose limited health information of your deceased patient to people who are not the executor or administrator.

After a patient dies, your duty of confidentially continues and you have ongoing obligations to manage their medical records. For the most part, you should manage the medical records of patients who have died in the same way as if they were alive. There are also specific laws you should be aware of, including your duty not to reveal confidential information about a patient after their death without proper legal authority.

Storing and retaining records

The medical records of a deceased patient should be stored in the same manner and with the same protections as when the patient was alive, including keeping the records secure and maintaining confidentiality.

This means that whatever the form or type of medical record you hold for a patient, you must protect it from unauthorised access, disclosure or modification. Measures must also be in place to prevent damage, loss or theft of these medical records.

Public sector hospitals and facilities have specific policies to manage and retain the records of deceased patients. If you work in this sector, you should check for any specific requirements in the organisation where you work.

How long do I have to retain the medical records of deceased patients?

We recommend that you retain the complete medical record of an adult patient for at least seven years from the “date of last entry” in the record or the date of their “last health service”. The last entry for a deceased patient might be the date you note the patient’s death in their medical record or receive their death certificate. A request from a third party for the deceased patient’s records could also be the last entry. You would keep the entire medical record for seven years from the date of that last entry.

New South Wales, Victoria and the Australian Capital Territory have specific legislation relating to medical records and health information. In these jurisdictions the legislation requires doctors to retain records for the time specified above. For doctors practising in states and territories without specific legislation, we recommend using the NSW, Victoria and ACT requirements as a guide and keeping records for the same minimum period.

What if your patient is aged under 18 years when they die?

We recommend that you retain the medical record of a patient who was under the age of 18 at the time of the last entry, until that patient would have turned 25 years old. This also applies to patients who die before they turn 18 years old.

NSW, Victoria and ACT legislation specifically states that records must be kept until that patient would have turned 25 years old. We recommend that doctors in all states and territories follow this law.

Who can access a deceased patient’s medical records?

The duty of confidentiality that you owe to your patients is paramount and survives their death. Before you disclose their medical records you must ensure that the person seeking access is authorised to do so.

In most cases, the person authorised to access the deceased patient’s medical records is the executor or administrator of the deceased patient’s estate. An executor of the patient’s estate is named in their Will, while an administrator is appointed by the court where a person does not have a Will. The executor or administrator is also the correct person to provide authority for another person (e.g. insurer, lawyer) to access the records.

Do not assume the patient’s next of kin, substitute decision maker or guardian will be the executor or administrator. Those who are not the executor or administrator have no legal standing to access a deceased patient’s records. There are some exceptions to this rule for records kept by public hospitals, but these exceptions are specific to each state and territory. Enquiries or requests for records held by a public hospital should be made to that hospital’s records department.  

If there is a dispute about who is the executor, for example, if there are two versions of a patient’s Will, you should ask for a copy of or to sight the grant of probate, which is a legal document issued by the court to state who is the executor or administrator.

Requests for records from the coroner

The coroner has a legal right to access a patient’s records. A request from the coroner may be made by the police officer investigating the patient’s death and you may also be asked to write a report about the care you provided to the patient before their death. If you receive a request from the coroner to provide a report you should notify Avant as soon as possible and before you submit the report.

Check the identity and authority of the person requesting the records

Before giving a person access to the medical records of your deceased patient, you must be satisfied of the identity of the person and their authority to access the records. Legislation in NSW, Victoria and the ACT requires you to take reasonable steps to acquire proof of identity of the person seeking the records. As there is no equivalent legislation in other states and territories, Avant recommends that all doctors adopt this practice. You should sight and, where possible, make a copy of the person’s identification and attach it to the patient’s record along with a copy of the Will (at least the page that names the executor), the grant of probate (if relevant) and details about the request.

What form should the request be in?

A request for the deceased person’s medical records should include certain information. Requests should be in writing and include:

  • the name of the person making the request;
  • the address of the person making the request; and
  • how they want to receive the records (for example, a printed copy or just to sight it).

NSW, Victoria and ACT legislation requires this and we recommend all doctors, regardless of the state or territory they practise in, follow these requirements. The request should also specify the part of the medical record which the person would like to access. If this is unclear, you should ask the person, to ensure you are not handing over the entire medical record when it is not needed or being requested. You should file the request in the patient’s medical record.

Relatives requesting records

Relatives of your deceased patient may want to understand the circumstances when a family member dies and may request access to the medical records. Doctors may be able to disclose information to an immediate family member of a deceased patient for compassionate reasons. Disclosure should be limited to what is reasonably necessary for those reasons. For example, if a child of a deceased patient requests health information to understand and seek closure after their parent’s death, you may consider providing limited information.

In NSW, Victoria and the ACT, legislation specifically permits disclosure in these circumstances. In other states and territories, where legislation regarding this issue does not exist, doctors may be guided by the Medical Board of Australia which states that good medical practice includes the ability and willingness to explain the circumstance of the death of a patient to their family and carers. This would include the disclosure of some health information. However, this request should be considered carefully against your legal obligations to maintain patient privacy and keep records securely.

When shouldn’t I disclose information?

Despite the limited circumstances above, you should not disclose health information or grant access to a deceased patient’s medical records if you know that the patient would have specifically objected to that disclosure. If a patient made this objection known while they were alive, you should note it in their medical record and the circumstances surrounding the request.

You are not required to disclose health information about your deceased patient if that access would pose a serious threat to the life or health of any other person. You are also not required to provide access if providing that access would unreasonably impact another person’s privacy. If you have concerns that disclosing information may put you in the situations above you should contact Avant for further advice.

Additional resources

You can find additional resources, including articles, podcasts and webinars, in the Avant Learning Centre under Documentation and Medical Records: avant.org.au/avant-learning-centre

For more information or immediate advice, call our Medico-legal Advisory Service on 1800 128 268, 24/7 in emergencies.

Download factsheet

Download PDF