Requests involving incapacity or death

Overview

The NPC explained the exercise of data-subject rights by lawful heirs and assigns after death or incapacity. The Data Privacy Act does not itself rank relatives in a hierarchy for receiving medical information.

Practice implications

Parao Law practice guidance

For physicians

Confirm the patient’s capacity and the requester’s identity and authority before disclosure. Record what was requested, the basis for release and what was disclosed. Refer competing family claims for review instead of assuming that the first relative to ask is entitled to the records.

For lawyers

Examine the relevant authorization, guardianship or succession basis together with privacy and ethical duties. Distinguish a relative’s relationship to the patient from legal authority to exercise access rights. Document the basis for any limitation or refusal.