Can a deceased person’s medical record be accessed in Spain?

Blog published on legaltoday.com by Lluís Ignasi Clusellas Plana.

The purpose of this commentary is to provide a brief overview of access to personal data contained in the medical records of deceased patients in Spain.

The issue can be framed as a question: Do I have the right to obtain from the relevant medical center a copy of the medical record of a deceased patient?

The general principle established in Article 7 of Law 41/2002, of 14 November, the basic Spanish law regulating patient autonomy and rights and obligations regarding clinical information and documentation (hereinafter, Law 41/2002), and in Article 5 of Law 21/2000 of the Parliament of Catalonia, of 29 December, on patient autonomy and rights to information and clinical documentation (hereinafter, Law 21/2000 – where applicable), is that every person has the right to have the confidentiality of data relating to their health respected, and therefore no third party may access such data unless prior authorization is obtained under the law.

The aforementioned authorization provided for by law can be found in Article 18 of Law 41/2002, which expressly authorizes access to the medical record of a deceased patient to any person linked to them for family or de facto reasons, unless the deceased had expressly prohibited it, the aforementioned provision expressly establishing that, in any case, access by a third party to the medical record motivated by a risk to their health shall be limited to the relevant data.

There are, therefore, three aspects to be taken into account:

1. Absence of an express prohibition by the deceased.
2. Proof of the family relationship or de facto connection.
3. Purpose of access to the deceased’s medical record.

1.- Express prohibition by the deceased

This constitutes an essential requirement that every entity must strictly respect, such that if the deceased had expressly prohibited access to their medical record, the entity may not disclose it to any third party, whether a relative (of any degree) or not.

The existence or absence of such prohibition may be proven by any means admissible in law, although, for evidentiary purposes, it is preferable that it be recorded in writing.

An express prohibition constitutes an impediment to access to the medical record of the deceased patient.

2.- Family relationship or de facto relationship

In the absence of the aforementioned express prohibition, it is necessary to verify compliance with the following requirement: the existence of a family or de facto relationship with the deceased person.

In the case of direct descendants, it is sufficient and necessary to prove such relationship, without the need to additionally prove their status as heirs.

As regards the proof of the family relationship, neither the laws governing access to medical records nor the case law establish which documents are required to prove such relationship, with the Data Protection Agency referring in some cases to the submission of the deceased’s open will, in the case of heirs.

For the purposes of verifying the existence of a family or de facto link between the applicant and the deceased, I understand that the mere submission of a document signed by the applicant or even a National Identity Document or a certified copy thereof should be considered insufficient. It is necessary, in my view, to provide a copy of the Family Record Book, a certificate from the Civil Registry, or any other suitable means that allows the family link between the deceased and the applicant to be established. What must be proven is not only identity, but the family relationship.

In cases of access to the Medical Record by a non-family heir of the deceased, or by an heir not linked to the deceased by de facto reasons, I understand that they have the right to know the content of the Medical Record, insofar as they succeed the deceased in all their rights and obligations (Article 661 of the Civil Code). However, being an heir does not constitute a sufficient condition to obtain such access; the other two requirements must also be met and, in any case, the limitations set out below must be respected. Thus, the mere fact of being an heir does not ipso iure entitle one to obtain the Medical Record.

Special reference must be made to de facto relationships with the deceased. In such cases, care must be taken to ensure that the alleged relationship (whatever it may be) is clearly proven, and access to the Medical Record must be denied in the absence of such proof. The range of situations may be extensive and requires a case-by-case analysis, which goes far beyond the scope of this text, although it may be established as a general principle that a de facto partner may have access to the data in question.

It should be noted that failure to meet the requirement of proving the relationship constitutes a ground preventing the requested access to the medical record of the deceased patient.

3.- Purpose of access to the Medical Record

This is the last of the three requirements set out by law.

Article 18.4 of Law 41/2002 establishes that, in any case, access by a third party to the medical record motivated by a risk to their health shall be limited to the relevant data.

Based on the aforementioned legal provision, I understand that it is necessary for anyone who, being entitled to do so, requests access to the medical record of a deceased patient to state the purpose of such access, since if it is motivated by a risk to their health, access will be limited only to the relevant data in the medical record and not to the entirety of it.

In other words, the Law does not protect curiosity and is careful to safeguard the privacy of the deceased, such that, in any case, the applicant must clearly state the purpose of the access, with the custodian of the health data deciding, in light of the stated purpose, the access and its scope.

As in the previous cases, if the purpose is not indicated, access must be denied.

Restrictions on access

To conclude these brief comments on a matter that is undoubtedly full of nuances, it should be borne in mind that, without prejudice to what has been set out so far, the following are excluded from access to the medical record of the deceased, pursuant to Articles 18.4 of Law 41/2002 and 13 of Law 21/2000:

• Information that affects the privacy of the deceased.
• Subjective notes made by the professionals involved in the care process.
• Data that may be detrimental to third parties.

In any case, in subsequent articles we will have the opportunity to explore in greater depth some of the aspects discussed and others related to them.