Patient confidentiality obligations do not simply extinguish when a patient dies. Most privacy protections continue after death. Records can be released to specific authorised parties – including the executor of the estate, a coroner, or a court – but not automatically to family members, even a spouse or adult child. Always verify legal authority before releasing anything.

One of the most consistently misunderstood areas of medico-legal practice is what happens to a patient’s confidentiality after they die. Many doctors — and many grieving families — assume that death removes all privacy protections and that family members are automatically entitled to access the deceased’s medical records. 

This is incorrect. Australian privacy law and professional obligations continue to protect patient information after death. Releasing records to the wrong person, or without proper authority, can expose a practitioner to Privacy Act complaints, AHPRA notifications, and significant distress to both families and practitioners. 

This guide explains the legal framework, who can access records after death, and the specific scenarios you are most likely to encounter. 

Does the Privacy Act Apply After Death? 

First, other obligations continue. The Medical Board’s Good Medical Practice code requires practitioners to maintain confidentiality of information obtained in the therapeutic relationship — and this obligation does not automatically end at death. AHPRA can take regulatory action against practitioners who make inappropriate disclosures about deceased patients. 

Second, state and territory health privacy laws may apply differently. In NSW, for example, the Health Records and Information Privacy Act 2002 contains provisions that continue to govern access to health records after death. 

The Practical Position Even where the Privacy Act technically no longer applies, a doctor’s professional confidentiality obligations continue after death. The OAIC and Medical Board both take the view that health information about deceased patients should be handled with the same care and discretion as information about living patients — unless there is a specific, legitimate reason to release it. 

Who Can Legitimately Access a Deceased Patient’s Records? 

Access is legitimate in the following circumstances: 

1. The Executor or Administrator of the Estate 

The person appointed as executor (under a will) or administrator (where there is no will) of the deceased’s estate has legal authority to access the deceased’s personal information, including medical records, for the purposes of administering the estate. They should be able to produce evidence of their appointment — a grant of probate or letters of administration. 

2. A Coroner or Coronial Court 

A coroner investigating a reportable death has statutory powers to compel production of records. This authority overrides confidentiality obligations. You are legally required to comply. 

3. A Court or Tribunal with Relevant Jurisdiction 

Courts can order disclosure of a deceased patient’s records in the context of legal proceedings — estate disputes, negligence claims, criminal proceedings, or family law matters. A valid court order provides authority to release. 

4. The Patient’s Insurer (Where a Claim Is Being Made) 

Where an insurance claim is being made against the deceased’s estate — for example, a life insurance or disability claim — the insurer may be entitled to access certain records. This typically requires the patient to have authorised disclosure as part of their insurance agreement, or a lawful basis under the terms of the claim. 

5. With Prior Written Authorisation from the Deceased 

If the patient, while alive and competent, signed a written authority permitting a specific person to access their records after death, that authority may be relied upon. Ensure the authority is clear, current, and signed. 

Who Does NOT Have Automatic Authority A spouse or partner does not automatically have authority to access a deceased patient’s records — even after many years of marriage. Adult children do not have automatic authority. Parents do not have automatic authority for adult children. These family members may have deep emotional reasons for seeking records, but emotional connection does not create legal authority. Always verify before releasing. 

High-Risk Patients: When You Must Be Even More Careful 

Some patient groups require extra care before termination is finalised. These include: 

  • Patients with serious mental illness, including those at risk of self-harm or suicide 
  • Patients on complex medication regimens — including S8 medications, insulin, anticoagulants — where abrupt cessation is dangerous 
  • Patients with terminal illness or palliative care needs 
  • Patients in the middle of an acute episode of illness 

Patients who are elderly, cognitively impaired, or socially isolated with limited capacity to self-advocate 

Common Scenarios and How to Handle Them 

Scenario 1: Grieving Spouse Requesting Records 

 Clinical Scenario Mrs Okonkwo contacts her late husband’s GP, Dr Farrelly, two weeks after his death from a heart attack. She is distressed and asks for copies of all his medical records. She explains she wants to understand what happened and whether it could have been prevented. What Dr Farrelly should do: Express sympathy. Explain that he is not able to release records without confirming legal authority. Ask whether Mrs Okonkwo has been appointed executor of the estate and, if so, request a copy of the grant of probate. If she is the executor, he can then release records to her in that capacity. If not, he should explain the position and suggest she seek legal advice about her options. 

 Scenario 2: Adult Child Seeking Parent’s Records 

Clinical Scenario An adult daughter contacts a geriatrician asking for her late mother’s records. She explains that her mother recently changed her will and the family believes she lacked capacity when she did so. The daughter thinks the records might show signs of cognitive decline. What the geriatrician should do: This is a legitimate reason to seek records — but the daughter must demonstrate authority. If she is the executor or administrator of the estate, she may have authority. If the dispute is before a court or tribunal, a court order can compel production. If neither applies, the geriatrician should decline and refer the family to a solicitor. The records may be very relevant to the will dispute — which is why process matters. 

Scenario 3: Lawyer Requesting Records on Behalf of the Family 

A lawyer’s letter requesting records on behalf of a deceased patient’s family is not itself sufficient authority. The lawyer must demonstrate they are acting for the executor or administrator of the estate, or that a court order requires production. Ask for confirmation of their client’s authority before releasing anything. 

Scenario 4: Coroner Requesting Records 

You must comply. Notify your medico-legal insurer, do not alter records, and respond within the stated timeframe. See our full guide: Responding to a Coroner’s Request. 

Sensitive Information: Additional Protections 

Some categories of health information warrant additional care even after death: 

  • Mental health records — state mental health legislation (e.g., the Mental Health Act 2007 (NSW)) may impose additional protections on psychiatric records 
  • Substance use records — treatment records from AOD services may have additional protections 
  • Records containing information about third parties — if the deceased patient’s records contain information about living third parties (family members, partners), those individuals’ privacy rights continue and should be considered before release 

Redaction May Be Required: Even when you have authority to release a deceased patient’s records, you may need to redact information about living third parties whose privacy rights continue. Review records carefully before release and consider whether any information about other people should be withheld or redacted. 

Doctors are frequently asked to complete death certificates for patients who die in their care or shortly after a consultation. The obligation to complete a death certificate arises where you have attended the deceased during their last illness and can certify the cause of death. 

  • Only a registered medical practitioner can complete a Medical Certificate of Cause of Death (MCCD) 
  • A certificate must reflect your honest clinical opinion about the cause of death — do not complete one at the request of family if you do not have the clinical basis to do so 
  • If you are uncertain whether a death is reportable, contact the coroner’s office for guidance before completing the certificate 

Frequently Asked Questions 

Q: A deceased patient’s family is threatening to sue if I don’t release the records immediately. What do I do? 

A threat of legal action does not create legal authority to release records. Contact your medico-legal insurer immediately. If the family has legitimate grounds to seek records, they can establish authority through the appropriate legal process. Do not release records under threat. 

Q: The patient’s next of kin told me before death that they wanted all records shared with them after they died. Is that sufficient? 

Verbal instructions from a living patient are not reliable authority for post-death disclosure. For a patient’s wishes to be legally operative after death, they should be in writing, signed, and ideally witnessed. Refer the family to the probate process and verify executor status. 

Q: I received a request from a law firm saying they are investigating whether to bring a claim against me. They want the patient’s records. What do I do? 

Stop — contact your medico-legal insurer before doing anything. This is one of the most sensitive situations in medico-legal practice. What you release, and how, can materially affect your legal position. Never respond to this type of request without legal guidance. 

Q: Can I share information from a deceased patient’s records with their treating specialists for educational purposes? 

With appropriate de-identification, patient information can be used for legitimate educational purposes. However, disclosure of identifiable information — even of a deceased patient — for educational purposes without explicit prior consent is problematic. If in doubt, de-identify thoroughly or seek ethics approval. 

This publication is general in nature and is not comprehensive or constitutes legal or medical advice. You should seek legal, medical or other professional advice before relying on any content, and practice proper clinical decision making with regard to individual circumstances. Persons implementing any recommendations contained in this publication must exercise their own independent skill or judgment or seek appropriate professional advice relevant to their own particular practice. Compliance with any recommendations will not in any way guarantee discharge of the duty of care owed to patients and others coming into contact with the health professional or practice. Tego Insurance Pty Ltd is not responsible to you or anyone else for any loss suffered in connection with the use of this information.

All content on this page has been written in a generic way, and has not been presented with any knowledge of your personal objectives or financial needs.