Are deceased people’s medical records are exempt from disclosure under the UK Freedom of Information Act? For much of the last two weeks, a debate has been raging on an e-mail discussion list of FOI practitioners about this topic.

The personal privacy exemption of FOIA (section 40) takes its definition of “personal data” from the Data Protection Act — which only covers living people.

Relatives of the deceased gained access to medical records under the Access to Health Records Act 1990, but it may be the case that the medical records of the deceased are now fair game to requests from the general public.

Another school of thought says that the common law duty of confidence could lead to an action for breach of confidence by a deceased person’s estate against an authority that releases such records. This would mean that section 41 exemption would apply. But the Department of Health says “health records relating to deceased people do not carry a common law duty of confidentiality”.

But maybe the Human Rights Act, which encorporates the European Convention on Human Rights’ privacy guarantee into UK law, might provide a reason to withhold a deceased person’s medical records. No doubt, an argument could be made about genetic information such a document might disclose about a dead person’s immediate family.

Medical professionals are taking no chances. The General Practitioner Committee of the British Medical Association is concerned about patient confidentiality implications of this and is working with the Information Commissioner and the Department for Constitutional Affairs to draft guidelines on how GPs and others in the NHS can use the existing FOIA exemptions to avoid releasing medical records of the deceased.

One such document already exists: Redcar & Cleveland Council’s guidance for dealing with requests about deceased people (PDF).

Hopefully, those guidelines will be narrowly crafted to medical records only. In lots of other areas, it seems to me that the privacy interest does not extend beyond death.

(None of this applies in Scotland, where the devolved FOI (Scotland) Act 2002 clearly exempts the medical records of the deceased from disclosure under Section 38(1)(d). In the rest of the UK, the matter is far from clear.)