Access to Health Care Records After Death: Title and subTitle BreakBalancing Confidentiality With Appropriate Disclosure

The concept of confidentiality in the patient-physician relationship has existed for millennia and is enshrined in both ancient and modern¹ codes of ethics. Although most ethical codes stipulate that the duty to maintain confidentiality extends beyond death, there is rarely any such provision in statutory law. This may lead to uncertainty about how to treat information given in confidence to health professionals during life when access to that information is requested after death. Confidentiality is never an absolute and is usually qualified by the need to protect society or third parties. Confidentiality may be assumed to be good in itself or defended on grounds of autonomy or utilitarianism—if patients cannot trust their physicians, the relationship becomes unworkable.

As society changes and technology evolves, the situation after death becomes more complex, with jurists and ethicists proposing a variety of positions. One extreme of legal opinion is the view that in the absence of specific law, the rights of individuals lapse at the time of their death.² Conversely, the US Supreme Court has affirmed the principle of privileged information after death for the attorney-client relationship. Ethicists also range from asserting that the dead have no rights, giving precedence to the rights of access of family (an increasingly complex entity) to confidential information over that of the public,³ to the opposite viewpoint that if a physician were to disclose confidential information, this would result in a reluctance of the patient to share such information in the first place, undermining a physician's ability to treat patients or protect third parties.⁴

Even if confidentiality is not maintained absolutely after death, further problems arise from defining the degree of disclosure and establishing who has right of access to this information. A number of high-profile cases over the last decade have provided insights into the deliberations of the courts and those involved with the workings of freedom of information legislation. In essence, these cases have generally supported some form of disclosure and may represent a threat to the concept of patient-physician confidentiality, both in life and after death. However, the Final Privacy Rule in the United States,⁵ a regulation arising from the Health Insurance Portability and Accountability Act of 1996, removed an original proposal of a 2-year limit on privacy after death in favor of restricting access to persons authorized under law to act on behalf of the decedent's estate for as long as the institution holds the data.

Can disclosure of information after death cause harm? There are several possible areas of concern including the patient's own expectations, the protection of others who contribute to the medical record, and the preservation of societal expectations of confidentiality. Although certain ethicists may argue that the dead have no interests to protect,⁶ some individuals' fear of disclosure of information posthumously may be as great as contemporaneous disclosure. Such fears affect patient behavior and candor,⁷ which may result in suboptimal care during life. Individuals frequently withhold information from loved ones to protect them, and there is no reason to assume that this should be different after a person's death. An expectation among the living that their private medical information may be released after death may inhibit the patient-clinician relationship. In one survey, 1 in 8 US residents reported that they have avoided seeking medical advice citing concerns around confidentiality in general.⁸

A patient's medical record may hold sensitive information, not only about that patient but often also about other family members. For instance, in dementia there may be witness histories and the investigation of suspected elder abuse, which affects 3% to 5% of older persons,⁹ often requires the collection of sensitive data from family members and others. During life, such information is passed between patient, family member, and physician within a protective circle of confidentiality but such information might not be freely volunteered if there are concerns that there might be open disclosure after death. The US Supreme Court has explicitly recognized this concern in its opinion on the Vincent Foster case.¹⁰ Within the public arena, for instance, an individual's right to privacy may be steadily eroded after death “in the public interest” and for which the media often assumes a right to know. For example, Carl Jung publicly declined to answer questions regarding his deceased colleague Sigmund Freud (they had analyzed one another's dreams).¹¹

However, increasingly there are situations in which relatives may wish to obtain access to medical records after a patient's death; these may include concerns about adequacy of care, the possibility of inherited disease,¹² or testamentary capacity—the competence of a patient to execute a will at the time it was signed. This raises 2 distinct issues, the first of which is finding the appropriate balance between confidentiality and the valid concerns of relatives and regulatory bodies. The lesser, but important, concern is that of storage and maintenance of such records, particularly by private practitioners (whose practice may close at the time of the clinicians' death or retirement) or private institutions (that may close without a clear successor). Some preliminary guidelines exist for the closing of a facility.¹³

Testamentary capacity—the capacity to execute a will—is probably the most straightforward situation because information in medical records will usually be revealed through legal discovery or court order. This exception to the rule of confidentiality is considered acceptable on the grounds that it furthers the deceased's interests, and the release of the files is not completely public but is governed by court protocol.¹⁴

The situation is less clear for concerns about the quality of care or the possibility of genetic susceptibility to disease. Here the deceased's interests are less clearly to the fore. For instance, Dimond¹⁵ notes that family and relatives may have rights over the medical records of the deceased in the United Kingdom. Annas³ seems to assume automatic access for the family (but not the media) to the medical records in a high-profile case. Lucassen et al¹² consider that access to records should not be necessarily contingent on consent from relatives but should be made available to assist in the diagnosis of genetic disorders of other relatives. This latter argument is made on the grounds that informing a relative of genetic risk is a justifiable breach of confidentiality.

In parallel, freedom of information legislation in many countries increasingly governs access to personal information. Although such laws typically specify that confidentiality should be respected,¹⁶ there is considerable erosion of this principle to allow access after death to certain categories of people with specific interests in the health records of the deceased.^{17 - 18} These include administrators of the estate, a person on whom a function is conferred by law, and sometimes the spouse or next of kin (to include unmarried cohabitants). In an Irish case, the health authorities mounted a robust (albeit unsuccessful) resistance to release of such medical records under the Freedom of Information Act to the next of kin.^{16 ,19} The health authorities argued for restricted access, via a court order, on the basis that it was reasonable to assume that privacy rights continue to be respected after death and that once records are made available under Freedom of Information legislation, there is no restriction on how they may be used. The health authorities also stated concerns over public perceptions of reduced confidentiality. Notwithstanding these objections, the Information Commissioner upheld the rights of next of kin to access records, on the basis that under Irish law the family member in question was a next of kin and that the Freedom of Information Act explicitly provides for release of such information, notwithstanding the need for confidentiality. Furthermore, the commissioner (with reference to the family physician but not the specialist physician treating the patient) made a judgment that the material in the medical records was “relatively routine.”¹⁹

These scenarios do not seem to consider the possibility of controlled release of information in a clinically useful manner, rather than the potential for medical files to be stored on a bookshelf after death, open for all to inspect. The key issue is whether the need is really for the full medical records or for an expert review of the likelihood of genetic risk or of inadequate care. This might most usefully form part of a bereavement care program following death, ideally involving the patient's personal physician involved with the terminal phase of the patient's health care. It is clear that families often have unmet information needs after death,²⁰ and adult services might usefully take a lead from pediatric services on this important but neglected component of palliative care.²¹

Support might also be offered from expert clinicians independent of the health care institution and individuals in question. This latter course would both meet the information need while conserving other areas of medical confidentiality and could be supported by facilitating a second opinion if requested. It would also help to provide a more useful context for the interpretation of genetic information or care issues for those unfamiliar with medical records. This solution may be considered a balance between the rights of the deceased to privacy (by avoiding indiscriminate release of their health care records) and of the living to access information pertinent to their own health and peace of mind (by providing a clinically informed response to their concerns). Defining those who should have access is also more complex than first might appear. For example, almost 1 in 5 older Irish individuals report having at least 1 member of their family with whom they do not wish clinical information to be shared.²² There is increasing awareness that traditional definitions of next of kin may not adequately reflect the hierarchy of choice in shared decision making by patients.²³ Also, next of kin have no automatic access to the health care records of living adults. This supports the argument that the onus should lie with those seeking such information after death to establish their relationship to the deceased person and a reasonable basis for receiving such information.

To prevent erosion of the right to confidentiality after death,¹² it is important that physicians and other health care workers strive to ensure that this confidentiality is preserved to the maximum degree possible. Critics of this approach may argue that confidentiality is a powerful instrument that may be abused too easily.²⁴ However, conceding to the most vocal complainant is dangerous because it leads to easily forgetting the wishes of the least vocal, ie, the decedent. Research is necessary to examine expectations on continuing confidentiality after death, ideally among those who are approaching death, for they are likely to have the most important perspective on this issue.