HRIPA and deceased persons: DSC v United Protestant Association

DSC v United Protestant Association [2020] NSWCATAD 315 considered whether a son could access the medical records of his mother held by the residential aged care facility where she resided prior to her death.

HRIPA gives individuals the right to access their health records from NSW health service providers, public sector agencies and private sector organisations that hold health records. HRIPA allows an ‘authorised representative’ to act on behalf of another individual. However, HRIPA does not expressly state whether this concept applies to a person seeking access to the health records of a deceased person. The term ‘authorised representative’ is not defined in a way which would naturally encompass an executor or administrator of a deceased estate.

NCAT ultimately decided that, although the term ‘individual’ in the definition of ‘personal information’ in HRIPA encompasses a deceased person (for 30 years after their death), the term ‘individual’ usually only refers to a ‘living person’. Persuasive in NCAT’s decision was the fact that NSW legislation often actively distinguishes between living persons and deceased persons and that drafting practice supports the ordinary interpretation of the word ‘individual’ as referring to a ‘presently-living’ person. NCAT did not conclusively resolve the matter, finding only that the question of whether HRIPA applies to requests for access to records of a deceased person ‘remains in doubt’. NCAT’s reasoning strongly suggests that the access provisions do not apply to health information of a deceased person.

In effect, this finding narrows a potential point of difference between HRIPA and the Commonwealth Privacy Act 1988 (the Privacy Act). The Privacy Act is clear that it does not apply to deceased persons.

In response to the case, the NSW Information and Privacy Commission has issued updated guidance confirming its view that the right to access information cannot be exercised on behalf of a deceased individual. The updated guidance makes clear that health service providers may disclose health information about a deceased person on compassionate grounds under HPP 11. However, it is important to remember that HPP 11 is permissive and does not establish a right to access information about a deceased person on compassionate grounds.

To read more articles from this edition of The Prescription, please click here.