CHW173-Accessing Records of a Deceased Person Policy
{{org_field_logo}}
{{org_field_name}}
Registration Number: {{org_field_registration_no}}
Accessing Records of a Deceased Person Policy
1. Purpose
The purpose of this policy is to ensure that requests for access to records relating to a deceased person who received care and support from {{org_field_name}} are handled lawfully, securely, sensitively and consistently.
This policy distinguishes between health records to which the Access to Health Records Act 1990 applies and other care and support records held by the service. The Access to Health Records Act 1990 applies only to qualifying health records made by or on behalf of a health professional in connection with the care of the individual and does not provide a general right of access to all records held by a care home.
The service will maintain, retain, secure and make records available in accordance with the Regulation and Inspection of Social Care (Wales) Act 2016 and the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017, as amended, including the requirements relating to records under Regulation 59 and the requirements for effective systems for keeping records under Regulation 78.
Although UK data protection legislation does not apply to personal data relating solely to a deceased person, information relating to identifiable living individuals contained within the deceased person’s records remains subject to applicable data protection legislation. The confidentiality of information concerning the deceased will continue to be respected after death and information will only be disclosed where there is an applicable legal right, legal obligation, statutory power or other lawful justification for disclosure.
2. Scope
This policy applies to all staff at {{org_field_name}} involved in the handling, storing, and disclosing of personal records. It also applies to any third party—such as family members, legal representatives, solicitors, coroners, and statutory bodies—requesting access to the records of a person who has died while receiving care at the service. It provides guidance to the Registered Manager, Data Protection Officer, and any staff member handling such enquiries.
3. Related Policies
This policy should be read in conjunction with:
CHW04 – Good Governance
CHW13 – Safeguarding Adults from Abuse and Improper Treatment Policy
CHW14 – Receiving and Acting on Complaints Policy
CHW34 – Confidentiality and Data Protection (GDPR) – Service User Policy
CHW35 – Duty of Candour Policy
CHW38 – End of Life and Palliative Care Policy
4. Policy Statement and Legal Framework
{{org_field_name}} will protect the confidentiality, integrity and security of records relating to a deceased person and will disclose information only where there is lawful authority to do so.
The Access to Health Records Act 1990 provides specified persons with a right to apply for access to the health records of a deceased person. For the purposes of that Act, a health record is a record containing information relating to the physical or mental health of an identifiable individual which has been made by or on behalf of a health professional in connection with the care of that individual. The Act does not create a general right for relatives, next of kin or other persons to obtain all care home records following an individual’s death.
Other records held by the service, including care and support records which do not constitute health records for the purposes of the Access to Health Records Act 1990, will only be disclosed where there is an applicable legal right, legal obligation, statutory power, court order or other lawful justification for disclosure having regard to the continuing duty of confidentiality owed in relation to the deceased.
The UK General Data Protection Regulation and Data Protection Act 2018 do not apply to information relating solely to a deceased person. However, where a deceased person’s record contains personal data relating to an identifiable living person, that information remains subject to applicable data protection legislation and must be considered before disclosure.
The service will also comply with the Regulation and Inspection of Social Care (Wales) Act 2016 and the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017, as amended. Records will be maintained securely, accurately and for the periods required by Regulation 59, and effective systems will be maintained for the accuracy, completeness, security and management of records in accordance with Regulation 78.
5. Retention and Secure Storage of Records
Records relating to deceased individuals will be retained and stored in accordance with Regulation 59 of the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017, as amended.
The service will:
- retain records relating to an adult for at least three years from the date of the last entry;
- retain records relating to a child for at least 15 years from the date of the last entry, unless the records are required to be delivered to the placing authority in accordance with Regulation 59;
- ensure that all records are stored securely and protected against unauthorised access, alteration, loss, destruction or disclosure;
- make arrangements for records to continue to be kept securely if the service closes;
- ensure that records required under Schedule 2 to the Regulations, including the record of the death of an individual, are maintained; and
- make records available to Care Inspectorate Wales when lawfully requested.
Where another applicable legal requirement requires a particular record to be retained for a longer period, the longer applicable retention period will be followed.
Paper records will be stored in secure facilities with access restricted to authorised personnel. Electronic records will be held on secure systems using appropriate access controls. Where electronic systems permit records to be added to or amended, individual user access and an appropriate audit trail will be maintained so that entries and amendments can be attributed to the relevant person.
The Registered Manager and Responsible Individual will ensure that effective systems are in place for the accurate, complete and secure keeping of records in accordance with Regulations 59 and 78. The Data Protection Officer will provide advice on data protection and information governance requirements where records also contain information relating to identifiable living individuals.
6. Who Can Request Access to Records
Requests for records relating to a deceased individual may be received from a range of persons or organisations. Receipt of a request does not, by itself, establish a right to disclosure. The Registered Manager must establish the requester’s identity, authority and legal basis for obtaining the information before any disclosure is made.
Requests under the Access to Health Records Act 1990
Where the records requested constitute health records within the meaning of the Access to Health Records Act 1990, an application may be made by:
- the deceased person’s personal representative, meaning the executor or administrator of the deceased person’s estate; or
- a person who may have a claim arising out of the deceased person’s death.
A solicitor or other authorised representative may make the application on behalf of an entitled person where satisfactory evidence of that authority is provided.
Where an applicant relies upon a claim arising out of the deceased person’s death, the service will obtain sufficient information to establish the nature of the claim and the applicant’s entitlement. Disclosure will be restricted to information relevant to that claim.
Being a relative, family member or next of kin does not, by itself, provide a statutory right of access to a deceased person’s health records.
A lasting or enduring power of attorney ceases to provide authority when the donor dies and must not be accepted as authority for access to records following the donor’s death.
Requests for other care and support records
Where records do not fall within the definition of a health record under the Access to Health Records Act 1990, there is no automatic right of access merely because the requester is a personal representative, relative or next of kin. Any proposed disclosure must be considered individually and must have an applicable lawful basis or authority, taking account of the continuing confidentiality of the deceased person’s information and the rights of any identifiable living persons.
Requests from public or statutory bodies
Records may also be provided where disclosure is lawfully required or authorised, including in response to:
- a court order;
- a lawful request from a coroner or medical examiner;
- a lawful requirement or request from Care Inspectorate Wales;
- a request from the police or another statutory body where there is an applicable statutory power, legal obligation or other lawful justification for disclosure; or
- another legal requirement requiring the service to provide the information.
The requester must provide sufficient evidence of identity and, where applicable, evidence of their authority or entitlement. This may include a grant of probate, letters of administration, evidence relating to a claim arising from the death, written authority from the personal representative, a court order, statutory notice or other documentation demonstrating lawful authority.
No information will be disclosed until the Registered Manager is satisfied that the requester’s identity and authority have been established.
7. Request Process and Timescales
Requests for access to records relating to a deceased person must be directed to the Registered Manager at {{org_field_registered_manager_email}}. Any member of staff who receives such a request must forward it promptly to the Registered Manager and must not disclose records or information directly to the requester.
The following process will apply:
- the request will be recorded on receipt;
- the identity of the requester will be verified;
- the requester will be asked to provide sufficient evidence of their authority or legal entitlement to obtain the information;
- the service will identify the records requested and determine whether any or all of them constitute health records for the purposes of the Access to Health Records Act 1990;
- the Registered Manager will determine, with advice from the Data Protection Officer or appropriate legal or professional adviser where necessary, whether disclosure is lawful;
- the records will be reviewed before disclosure to identify information which must or may not lawfully be disclosed;
- where disclosure is authorised, the records or relevant extracts will be provided securely; and
- a record will be maintained of the request, the evidence considered, the decision made, the information disclosed or withheld, the date of disclosure and the person authorising the decision.
Statutory timescales for applications under the Access to Health Records Act 1990
Where a valid application is made under the Access to Health Records Act 1990:
- if all of the record or part of the record covered by the application was made within the 40 days immediately preceding the date of the application, access must be provided within 21 days beginning with the date of the application; and
- in any other case, access must be provided within 40 days beginning with the date of the application.
Where the application does not contain sufficient information to identify the deceased person or to establish that the applicant is entitled to make the application, the service may request such further information as is reasonably required. Where that further information is requested within 14 days of the application, the applicable statutory period will run from the date on which the necessary further information is supplied.
These statutory 21-day and 40-day periods apply to qualifying applications under the Access to Health Records Act 1990 and must not automatically be applied to requests for other types of care and support records.
Where access is granted, records will be supplied or made available securely and only the information which the requester is legally entitled to receive will be disclosed.
8. Grounds for Withholding or Redacting Information
Before any health record is disclosed under the Access to Health Records Act 1990, the record must be reviewed to determine whether access to all or part of the information is prohibited or restricted by the Act.
Access will not be provided to information where the Access to Health Records Act 1990 requires that information to be withheld. This includes, where applicable:
- information which, in the opinion of the holder of the record, would be likely to cause serious harm to the physical or mental health of an individual;
- information relating to, or provided by, an identifiable person other than the deceased, unless the statutory conditions permitting disclosure are satisfied;
- information provided by the deceased in the expectation that it would not be disclosed to the particular applicant;
- information obtained as the result of an examination or investigation to which the deceased consented in the expectation that the information would not be disclosed to the particular applicant;
- information to which access is prohibited because the deceased recorded a wish that access should not be given following their death in the circumstances covered by the Act; and
- where the applicant’s entitlement arises because they may have a claim arising from the deceased person’s death, information which is not relevant to that claim.
Information made before the commencement date applicable under the Access to Health Records Act 1990 will also be considered in accordance with the restrictions contained in that Act.
Where a record includes information about an identifiable living individual, the service will also consider the data protection rights of that person before disclosure.
Where the request concerns care or support records which are not health records for the purposes of the Access to Health Records Act 1990, disclosure will only take place where there is lawful authority to disclose the information and after consideration of confidentiality, the deceased person’s known wishes, the rights of living third parties and any applicable statutory restriction.
Where only part of a record may lawfully be disclosed, the information which must not be provided will be redacted or otherwise withheld and the remainder will be disclosed where lawful.
Any decision to refuse or restrict access must be documented, including the legal or other basis relied upon. The requester will be informed of the decision and provided with an appropriate explanation, unless providing particular information about the reason itself would result in an unlawful disclosure.
{{org_field_name}} will comply with any lawful requirement to provide records to Care Inspectorate Wales, a court, coroner, medical examiner or other statutory body acting within its legal powers.
9. Safeguarding and Sensitive Cases
In cases involving safeguarding investigations, abuse allegations, or criminal matters, we liaise closely with the relevant safeguarding authority, police, or legal representatives. Any requests for records relating to such investigations are handled under strict supervision and legal guidance. The Safeguarding Lead, {{org_field_safeguarding_lead_name}}, is consulted in all such cases.
10. Staff Responsibilities and Training
Staff whose duties involve the creation, handling, storage, retrieval or disclosure of records must receive appropriate training and instruction in confidentiality, information governance, secure record keeping and the procedures relevant to their role.
Only staff authorised by {{org_field_name}} may retrieve, review, copy or disclose archived records relating to a deceased person.
Any member of staff who receives a request for information or records relating to a deceased person must refer the request promptly to the Registered Manager and must not confirm, disclose, copy, discuss or otherwise provide information from the record unless specifically authorised to do so.
The Registered Manager is responsible for ensuring that the identity and authority of the requester have been established, that the applicable legal framework has been identified and that the record has been appropriately reviewed before disclosure.
The Data Protection Officer will provide advice where records contain personal data relating to living individuals or where there is uncertainty concerning data protection or information governance requirements.
Complex, disputed or legally uncertain requests must be referred for appropriate legal or specialist advice before disclosure.
11. Auditing and Quality Assurance
The Registered Manager will ensure that requests for access to records relating to deceased individuals are recorded so that the service can demonstrate that requests have been handled lawfully, securely and consistently.
Records relating to requests will include, as applicable:
- the date the request was received;
- the identity of the requester;
- evidence used to establish the requester’s authority or entitlement;
- the records requested;
- the legal basis considered;
- any advice obtained;
- the decision to disclose, partially disclose or withhold information;
- details of any redactions made;
- the date and method of disclosure; and
- the person who authorised the decision.
The Responsible Individual must ensure that effective systems are in place for the keeping of records, including systems for ensuring the accuracy and completeness of records required under Regulation 59.
Records management arrangements will be monitored as part of the service’s governance and quality assurance systems. Any identified deficiencies in record security, accuracy, completeness, retention or disclosure will be addressed promptly and action taken to reduce the risk of recurrence.
12. Policy Review
This policy will be reviewed annually or sooner in response to changes in legislation, guidance from CIW or the Information Commissioner’s Office, or following a request or incident relating to access to deceased individuals’ records. Updates are communicated to all relevant staff and included in training programmes.
Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.