Access health information of deceased persons

Not all Australian jurisdictions expressly recognize the right of access to health information after death. We analyze how NSW, ACT and Victorian jurisdictions manage access to deceased health information.

Maddocks regularly advises governments, health service providers and others with medical information on their confidentiality obligations, including rights to access medical information. Did you know that these obligations vary depending on the Australian jurisdiction in which you are located? Interestingly, not all jurisdictions expressly recognize that the right of access to health information continues after death. Here is a brief overview of the Commonwealth, NSW, Victorian and ACT jurisdictions and how they manage access to health information.

Commonwealth jurisdictionnot

The Privacy Act 1988 (Cth) (Privacy Act) regulates the right of access to health information, in particular the Australian principle of confidentiality (APPLICATION) 12. The APP specifies how an organization should respond to a request for access and when access may be denied.

Neither the Cth Privacy Act nor APP 12 expressly refers to deceased persons. The Cth Privacy Act, however, defines “individual” as a “natural person”.[1]This is often taken to refer to a “living person”. Australia’s Information Commissioner’s Office has issued guidance on deceased persons, confirming that information about deceased persons is not considered “personal information”.[2]

That said, the guidelines also note that information about a deceased person may include information about a living person and may be “personal information” for the purposes of privacy law. The example given is where a deceased person had an inherited medical condition, which could indicate that descendants of the deceased person have an increased risk of that condition. Therefore, it is recommended that the privacy interests of family members be considered when handling information about deceased persons.[3]

The only situation where the Cth Privacy Act contemplates deceased individuals is when dealing with personal information in emergencies and disasters (see Part VIA). In this limited context, an individual is taken to also include a reference to an individual “who is not living”.

Jurisdiction NSW

The Medical Records and Privacy of Information Act 2002 (New South Wales)(New South Wales Health Privacy Act) also regulates the right of access to health information. Under this law, “personal information” is defined to exclude “information about a person who has been deceased for more than 30 years”.[4]Conversely, it follows that the information of deceased persons may be subject to this law, provided that they have been deceased for 30 years or less.

However, it appears that the right of access to health information can only be exercised by “living persons”, without extending to a deceased person or their authorized representatives. This was discussed in the NSW Civil and Administrative Tribunal of DSC v United Protestant Association [2020] NSWCATAD 315. Although it has not formally ruled on the issue, the Tribunal’s reasoning suggests that the access provisions do not apply to medical information of a deceased person.[5]

That said, health service providers routinely receive requests for access to a deceased person’s health information. Where the right of access does not apply to health information of the deceased person, disclosure under the Health Privacy Principle (PPH) 11 can be considered. For example, the disclosure may be made to an immediate family member[6] for humanitarian reasons.[7] This disclosure is discretionary and should be limited to the extent necessary for these humanitarian reasons. Similarly, the disclosure could be made when the information is genetic information[8] and the disclosure is to a genetic relative of the person and is deemed, on reasonable grounds, to be necessary to mitigate or prevent a serious threat to the life, health or safety of that relative, provided that the disclosure complies with the guidelines issued by the NSW Commissioner.[9]

Victorian jurisdiction

In Victoria, privacy laws are enshrined in the Privacy and Data Protection Act 2014 (Vic) (Privacy Law) and the Medical Records Act 2001 (Vic) (Vic Health Privacy Act). The Vic Privacy Act regulates the handling of personal information,[10] and the Vic Health Privacy Act specifically regulates the handling of health information.[11]

Although the Vic Privacy Act does not specifically address deceased persons, the Vic Health Privacy Act includes the following:

(1) This Act applies to a person who has been deceased for 30 years or less, so far as he is reasonably capable of doing so, in the same way as it applies to a person who is not deceased .

(2) Subject to subsection (3), if a person is deceased, any right or power conferred on persons by any provision of this Act may be exercised in respect of the deceased person, so long as the circumstances reasonably permit, by a legal representative of the deceased.

(3) A purported consent of a legal representative of a deceased person is void if, at the time of giving it, the legal representative knows or believes that the consent does not correspond to the wishes expressed, and not modified or withdrawn, by the person in his or her life.

Like the NSW Privacy Act, the Vic Health Privacy Act applies to people who have been deceased for 30 years or less. However, the Vic Health Privacy Act expressly recognizes that, if a person is deceased, their rights may be exercised by another person, namely a “legal representative of the deceased person”.

This means that the legal representative of a deceased person can request access to their medical information, provided that it is not incompatible with the wishes expressed by the person during their lifetime.

Jurisdiction of the ACT

In the ACT, the Australian Information Commissioner’s Office is responsible for administering the Cth Privacy Act on behalf of the ACT Government. Like the Cth Privacy Act, the Privacy of Information Act 2014 (Privacy Act) says nothing about deceased persons, but the guidelines issued by the commissioner regarding information about deceased persons will likely apply to the ACT Privacy Act.

However, the health information in the ACT is governed by the Medical Records (Confidentiality and Access) Act 1997 (LAW) (ACT Medical Records Act). Like the Vic Health Privacy Act, the ACT Health Records Act specifically addresses deceased persons as follows:

(1) The Privacy Principles apply to a deceased consumer, insofar as they are reasonably able to do so, in the same way as they apply to a consumer who is not deceased.

(2) Subject to subsection (3), where a consumer is deceased, any right or power conferred on consumers by a provision of this Act may be exercised in respect of the deceased consumer, insofar as the circumstances reasonably permit, by a legal representative of the deceased consumer.

(3) A purported consent of a legal representative of a deceased consumer is void if, at the time of giving it, the legal representative knows or believes that it conflicts with the wishes expressed, and not modified or withdrawn, by the consumer in his or her life.

Therefore, the ACT’s position on medical information is the same as the Victorian position, that the legal representative of a deceased may request access to their medical information, provided it is not inconsistent with their wishes, although this is not subject to the 30-year limitation that applies to Victoria.

For more information about your privacy obligations, please contact our Privacy Team.

[1]See Section 6(1) of the Cth Privacy Act.
[2]See at https://www.oaic.gov.au/privacy/guidance-and-advice/what-is-personal-information.
[3]See at https://www.oaic.gov.au/privac….
[4]See section 5(1) of the NSW Health Privacy Act.
[5]For a discussion of this case, see an article by Aaron Kloczko and Katherine McNaughton of Maddocks at https://www.maddocks.com.au/insights/hripa-and-deceased-persons-dsc-v-united -protestant- association.
[6]See NSW Health Privacy Act at Section 4.
[7]See NSW Health Privacy Act at HPP 11(g)
[8]See NSW Health Privacy Act at Section 6(d).
[9]See NSW Health Privacy Act at HPP 11(c1) and NSW Genetic Health Guidelines: use and disclosure of genetic information to a patient’s genetic related: Guidelines for organizations in NSW October 2014 published at https://www.ipc.nsw.gov .au/nsw….
[10]This is defined to exclude information of a type to which the Vic Health Privacy Act applies – see Section 3 definition of “personal information”.
[11]See Part 5 of the Vic Health Privacy Act. Remarks

Comments are closed.