Should a health service provider retain health information about an individual who has died?

View printable version of this page

Question: Should a health service provider retain health information about an individual who has died?

Answer: The Privacy Act 1988 does not create privacy obligations in relation to the handling of health information of deceased individuals.

Whether a health service provider should destroy or retain that health information may depend on a number of other factors including the existence of State or Territory laws requiring the retention of the information for a definite period after the individual has died. Also institutional and professional bodies may have codes of conduct or practice relating to the handling of a deceased individual’s health information.