Do the Caldicott principles apply after a patient dies?

Part of the guide What is a Caldicott guardian, and who needs one?

Do the Caldicott principles apply to the deceased?

Yes, the Caldicott principles apply to the deceased, according to the UK Caldicott Guardian Council. The council says the Data Protection Act and UK GDPR apply only to living people. It says the principles also apply to records and information about people who have died. This is the council's guidance.

The General Medical Council's guidance to doctors points the same way. It says the duty of confidentiality persists after a patient has died. This is the council's guidance to doctors, not law.

The published principles point the same way. They cover health and social care data where people can be identified and would expect it to be kept private. Principle 6 asks everyone handling confidential information to comply with statute and the common law.

The Information Commissioner's Office says the duty of confidence can apply even after the person it was owed to dies.

So the principles still guide what you do with a dead person's records. Use the minimum information needed. Give access only to people who need to know.

The National Data Guardian published the current principles on 8 December 2020, and they apply to England.

Does UK GDPR apply to someone who has died?

No, UK GDPR does not apply to someone who has died. Under UK data protection law, personal data is information about living people. So a person cannot make a subject access request for information about someone who has died.

Where medical records are needed on behalf of a person who has died, other laws apply instead.

Data protection law can still matter. A dead person's record may also hold information about a living person, such as a family member. The ICO says the rules on personal information can still be relevant to that part.

Who can see a dead patient's health records?

Health records of someone who has died can be seen under the Access to Health Records Act 1990. The UK Caldicott Guardian Council says the Act gives certain people formal rights of access. The General Medical Council says there are circumstances in which doctors must disclose relevant information about a patient who has died.

Under the Act, an application goes to the holder of the record. Once the patient has died, the patient's personal representative can apply. So can anyone who may have a claim arising out of the death.

A medical examiner acting under section 20 of the Coroners and Justice Act 2009 can also apply. Where a will names an executor, the executor will normally be the personal representative.

Access has limits, even for the personal representative. When a personal representative or someone with a claim applies, some parts are held back. The record holder does not give access to any part it thinks is not relevant to a claim arising out of the death.

The General Medical Council shows this in a case study. A GP was asked for a dead patient's records for a claim. She was concerned that sending the whole record would disclose confidential information irrelevant to the purpose. She sent the records about the patient's final illness, which was all she believed to be relevant to the claim.

The Act does not reach every record. Parts made before it came into force are held back.

Northern Ireland has its own route. The General Medical Council names the Access to Health Records (Northern Ireland) Order 1993. It says the Order gives access to a dead patient's personal representative and anyone with a claim arising out of the death.

What about social care records after a death?

Social care records sit outside the Act. The UK Caldicott Guardian Council says no comparable law gives access to the social care records of someone who has died. It says the Caldicott principles may still be applied.

These requests are common. The Information Commissioner's Office says the most common requests about people who have died are for their medical or social care records. These requests often come from relatives.

Records outside the Act can still be confidential, because the duty of confidence can apply after death. In its freedom of information guidance, the ICO says it is enough that the person would have expected the information to be kept private.

If the person had said they were content for the information to be made public, that can be taken into account. The ICO's confidentiality exemption does not cover the facts usually recorded in a death certificate.

What should you share with a bereaved family?

Share what is appropriate. After a bereavement, loved ones may need information to help them grieve. The UK Caldicott Guardian Council says Caldicott Guardians should make sure appropriate information is not unnecessarily withheld.

The council also says a Caldicott Guardian may decide that information should not be shared, even where the law allows it. The guardian advises on the ethical as well as the legal side, following the Caldicott principles.

The council says there may be differing legal opinion on how the law applies in individual cases. The Caldicott principles advise involving a Caldicott Guardian where a novel or difficult judgment is needed.

Write the decision down. The council says guardians should record the advice they give, the decisions they make and the reasons behind them. A guardian should be able to justify a decision.

What should a care or health provider do with a request?

A care or health provider should first work out which rules apply to the request. A request from a relative is not a subject access request. For medical records, check whether the person asking has a right of access under the Access to Health Records Act 1990.

You have 21 days to give access if every part of the record was made in the 40 days before the application. In any other case you have 40 days.

If you need more information to deal with the application, ask for it within 14 days. No fee can be charged for giving access.

If the applicant asks, you supply a copy. Where terms in the record cannot be understood without explanation, you explain them.

What to do

1. Do not treat a relative's request as a subject access request, because UK data protection law does not cover people who have died.
2. Apply the Caldicott principles to the records of people who have died, as the UK Caldicott Guardian Council advises, and keep them confidential.
3. Check who is asking for medical records: the personal representative, a medical examiner, or someone with a claim arising out of the death.
4. Hold back parts that would cause serious harm, identify another person, or are not relevant to a claim.
5. Reply within 21 or 40 days, depending on when the record was made, and charge no fee.
6. Involve your Caldicott Guardian for a novel or difficult decision, and record the advice, the decision and the reasons.

Common questions

Can a relative make a subject access request for a dead parent's records?

No. A subject access request cannot be made for information about someone who has died. Where medical records are needed, other laws apply instead.

Can a family see a dead relative's social care records?

There is no comparable law to the Access to Health Records Act 1990 for social care records, the UK Caldicott Guardian Council says. It says guardians should make sure appropriate information is not unnecessarily withheld from loved ones after a bereavement.

Can you charge for access to a dead patient's records?

No. Under the Access to Health Records Act 1990, no fee can be charged for giving access.

What applies in Northern Ireland?

Northern Ireland has its own route. The General Medical Council says the Access to Health Records (Northern Ireland) Order 1993 gives access to a dead patient's personal representative and anyone with a claim arising out of the death.

Where next

• Regulated sectors
• DSAR: what to do when a subject access request arrives
• Do you need a data protection officer? UK GDPR sets three tests
• What are the UK GDPR principles? All seven, in plain English
• Who is a data controller, and who is a processor?

This is an independent editorial guide, not legal advice.