As digitalisation advances and personal-data protection rules become more stringent, providing access to medical records has become a key issue for both medical facilities and patients. This article provides a comprehensive analysis of the rules governing disclosure of information about a patient’s health contained in their medical records. It explains which data are protected, who has a right of access, which forms and procedures the law permits, and which rules apply to fees and liability for unlawful disclosure.
1. Protection of health data – legal foundations
1.1. Special-category personal data in medical records
Medical records contain personal data classified as special-category data (often referred to as sensitive data).
· GDPR: Under Article 9(1) of the GDPR, the processing of data concerning health, genetic or biometric data, and data concerning a person’s sex life or sexual orientation is prohibited unless one of the exceptions in Article 9(2) of the GDPR applies.
· Constitutional protection of privacy: The restriction on processing sensitive data is also reflected in Article 51 of the Constitution of the Republic of Poland, which guarantees the protection of privacy.
1.2. Professional confidentiality
All data in medical records are additionally protected by duties of professional confidentiality binding doctors, nurses and midwives. These duties protect information disclosed by patients in the course of treatment and govern the circumstances in which it may be disclosed and used.
—
2. Entitlement to inspect medical records
2.1. The patient’s right
The patient has the primary right of access to their medical records. This right gives them access to information about their health and the healthcare services provided.
· Patient authorisation: A patient may authorise, orally or in writing, other people to inspect their records. This is particularly relevant to children – usually through their parents – and to people who cannot give consent themselves.
2.2. Other authorised bodies
In addition to the patient, those entitled to inspect medical records include:
· healthcare providers, where this is necessary to ensure continuity of care;
· public authorities such as the Polish Patient Rights Ombudsman, the National Health Fund (NFZ) and professional self-regulatory bodies;
· courts, public prosecutors and inspection bodies – in connection with criminal, civil or disciplinary proceedings;
· insurance providers – with the patient’s consent, for the purpose of verifying their health.
An authorisation given by a patient to inspect their medical records does not lapse upon their death. This allows people close to the deceased to obtain access in accordance with the relevant legislation.
—
3. Form and procedure for providing medical records
3.1. Direct and electronic access
Medical records may be made available:
· on site – at the facility where care is provided, allowing the patient or an authorised person to take notes or photographs;
· in writing – by providing an extract, certified copy, copy or printout;
· electronically – using electronic communications, for example by email or through Poland’s online patient account (IKP), which provides swift and convenient access to documents.
3.2. Digital reproduction (scan)
Modern solutions also allow records to be provided as a digital scan that accurately reproduces the original. This format is
particularly useful for documents that need to be supplied quickly while preserving the integrity and authenticity of the data.
3.3. The ‘without undue delay’ principle
The law requires medical records to be provided without undue delay. This is crucial to continuity of care and protection of the patient’s health. Delays caused by inadequate organisation within a healthcare provider may expose the patient to harm, so the obligation is enforced strictly.
—
4. Charges for providing medical records
4.1. Free first copy
Under the GDPR, a patient is entitled to a free first copy of their personal data, including their medical records.
· First copy free of charge – this ensures that patients do not incur costs when accessing their personal data.
4.2. Setting charges for subsequent copies
A healthcare provider may charge for each subsequent copy, certified copy or printout of medical records, but the charge must not exceed the statutory limits.
· Fee limits are set as a percentage of average earnings, ensuring consistency and protecting patients against excessive costs.
· The charge for electronic records is the same as for a conventional photocopy, subject to the first copy being free.
4.3. Special cases
Special rules apply where records are disclosed for:
· pension purposes – social-insurance authorities are entitled to access them free of charge;
· court and prosecution purposes – disclosure to law-enforcement authorities and courts takes place in accordance with the applicable legislation.
—
5. Practical aspects of providing medical records
5.1. Registers and records
Healthcare providers must keep a register of medical records supplied. The register should include:
· the patient’s details;
· the method of disclosure, such as a copy, printout or electronic transfer;
· the scope of the information disclosed;
· the details of the person who supplied the records and the date on which the records were supplied.
5.2. Procedures and safeguards
Appropriate procedures are essential to ensure:
· data confidentiality – technical and organisational safeguards protecting against unauthorised access;
· the integrity of the records – systems that allow information to be archived and provided quickly while protecting them against alteration.
5.3. Training and informing patients
Staff at medical facilities should receive regular training on the rules governing access to medical records. Patients should also be informed about their rights, how to obtain their records and any applicable charges.
—
6. Liability for unlawful disclosure of medical records
6.1. Administrative penalties
A breach of the rules governing access to medical records, particularly the processing of special-category data, may result in administrative penalties under the GDPR and Poland’s personal-data protection legislation.
· Financial penalties – imposed by the President of the Polish Personal Data Protection Office (UODO) through an administrative decision, these may amount to tens of thousands of zlotys.
6.2. Criminal liability
Unlawful disclosure of medical data may also lead to criminal liability, including a fine, restriction of liberty and, where the statutory conditions are met, imprisonment for up to 3 years.
6.3. Procedure for reporting breaches
Healthcare providers must document and report personal-data breaches within 72 hours of becoming aware of them. The electronic reporting system enables incidents to be notified and addressed promptly.
Summary
In Poland, access to medical records is closely regulated by the GDPR and the legislation on patients’ rights. The key considerations are:
· protecting sensitive personal data and maintaining professional confidentiality;
· defining precisely who is entitled to inspect records;
· providing flexible means of access, both conventional and electronic;
· setting charges within the statutory limits;
· maintaining precise procedures that protect records against unauthorised access.
Implementing these principles correctly not only protects patients’ rights but also reduces the risk of administrative and criminal penalties. If you need detailed advice or legal support with the processing and disclosure of medical records, our law firm can assist you throughout. Please contact us to discuss your needs.
