Sharing Health Information with a Complainant When a Person Is Deceased or Lacks Capacity

Handling complaints lawfully and compassionately

Complaints about health or social care are often raised by relatives when the person who received the care is no longer able to complain themselves. This may be because the person has died, is unconscious, or otherwise lacks capacity due to illness or detention.

In these cases, our customers can be unsure how much health information they can lawfully share when responding to the complaint. The key point is this: a complaint does not automatically create a right of access to confidential health information, even where the patient cannot speak for themselves.

Deceased patients: confidentiality still applies

Data protection law no longer applies to deceased individuals. However, the common law duty of confidentiality continues after death.

The Access to Health Records Act 1990 does provide a route to information for the personal representative of the estate (such as an executor or administrator), and for individuals with a legal claim arising from the person’s death.

We cover those access routes in other blog entries. Here, we are specifically focusing on complaints handling, which is often a step or two before any formal legal action.

When responding to a complaint, there can be a temptation to provide extensive clinical detail in the hope of bringing the matter to a close. However, disclosure should be limited to what is necessary and proportionate to address the specific concerns raised. It is rarely appropriate to provide full medical records in response to a complaint unless there is a clear legal basis to do so.

Example

A daughter raises a complaint about her father’s care following his death, alleging delays in treatment. She is listed as Next of Kin but is not the executor of the estate.

In responding to the complaint, the organisation may confirm that it has reviewed the care provided, including the timing of assessments and follow-up actions, and that these were in line with relevant policies and best practice protocols. Where appropriate, the response may also explain in general terms how such decisions are made.

It would not usually be appropriate to provide a detailed chronology of the patient’s care, copies of the medical record, or unrelated clinical information unless this is strictly necessary to address the complaint or the requester can demonstrate a clear legal right of access.

Patients who lack capacity

Where a patient is alive but lacks capacity, for example, due to being in a coma or because of severe mental illness, organisations must act in the person’s best interests.

This does not mean that all information can be freely shared with relatives.

Before disclosing any health information, organisations should consider:

• Whether the disclosure is necessary to investigate or respond to the complaint

• Whether the relative is acting in the patient’s best interests

• Whether there is a less intrusive way to address the complaint

  
  

If a relative holds a Health and Welfare Lasting Power of Attorney or is a court-appointed deputy, this authority should be verified and respected. However, even legal authority does not justify excessive or irrelevant disclosure.

Mental Health Act detention

Being “sectioned” under the Mental Health Act does not remove a person’s right to confidentiality.

If a patient lacks capacity, the same best interests framework applies. If they retain capacity for decisions about information sharing, their wishes should be respected as far as possible.

Care should be taken not to assume that detention automatically permits disclosure to family members.

Next of Kin: a common misunderstanding

Health and care organisations often assume that being named as Next of Kin gives a relative legal rights to access health information. It does not. 

Next of Kin status is largely an administrative or practical designation, it helps staff know who to contact, not who can receive confidential information. This is true both during a person’s life and after death.

Being Next of Kin does not override confidentiality, does not confer consent, and does not create an automatic right to disclosure.

Decisions about sharing information must still be based on legal authority, best interests (where the person lacks capacity), or legitimate interest after death, and must always be limited to what is necessary.

What can usually be shared safely

Even where full disclosure is not appropriate, organisations can usually share:

• Information about processes, policies, and standards of care

• Apologies, learning points, and service improvements

• Clarification of decision-making at a general level

  
  

This allows complaints to be addressed meaningfully without breaching confidentiality.

Documenting the decision matters

In complaints involving deceased or incapacitated patients, how the decision was made is as important as the decision itself.

Records should show:

• Who requested the information

• What authority or interest they demonstrated

• What information was shared and why

• Why wider disclosure was not necessary

This protects both the patient’s confidentiality and the organisation if the decision is later challenged.

A careful balance

Relatives who complain are often distressed, grieving, or trying to make sense of complex events. Compassion and clarity are essential, but so is respecting the rights of the person who received the care.

A lawful response balances:

• Confidentiality

• Best interests

• Transparency and learning

  
  

Clear guidance, confident staff, and proportionate disclosure help ensure complaints are handled properly, without creating new legal or ethical risks.

Emma Kitcher, Privacy Nerd