As patients, we have the right to obtain, free of charge, a copy of all our medical records

A German citizen asked his dentist for a copy of his medical records free of charge. He was dissatisfied with the treatment he had received and was considering lodging a complaint. There was no agreement as to whether the patient was entitled to be provided with a copy of his medical records free of charge. The case went to court and reached the German Supreme Court, which referred several questions to the Court of Justice of the European Union (CJEU) for a preliminary ruling. In short, it asked for a ruling on whether the German rules, which allow the doctor to charge for a first copy of the medical record, are in line with the General Data Protection Regulation (GDPR).

First copy, free and complete

The CJEU considers that the GDPR (articles 12.5 and 15.3) recognizes the patient’s right to obtain a first copy of his or her medical records without, in principle, incurring costs. According to the GDPR, the data controller (i.e. the dentist) may charge a reasonable fee when the patient has already obtained a first copy of his / her data free of charge and requests another copy. Furthermore, the CJEU clarifies that the patient is not obliged to indicate the reasons of their requests, and that the right of access covers any information contained in the medical records, such as diagnoses, examination results, doctors’ assessments and any treatments or interventions carried out.

However, the CJEU specifies that national legislation requiring the patient to cover the costs incurred by the doctor for generating such a copy, even if it is a first copy, would also be in line with GDPR. This limitation of the patient’s right must be necessary and proportionate to safeguard the objectives of protecting public health and the freedom to conduct business of doctors. If patients need to cover these costs, these should not be high in practice, considering the common use of electronic medical records nowadays.

What about Spain?

In Spain, Law 41/2002, on patient autonomy, recognizes the patient’s right of access to the documentation of their medical records, in principle without any limitations other than (i) respect for the confidentiality of the data of third parties that may also be contained in the medical records, and (ii) the elimination of subjective annotations by doctors if they so request. Law 41/2002 also acknowledges the right to obtain a copy of the medical record. Regarding whether they should be free of charge for the patient, current Spanish Law on Data Privacy (Organic Law 3/2018) indicates that said copies will be free of charge in the terms established by the GDPR, specifically articles 12.5 and 15.3, which are precisely those now interpreted by the CJEU. In other words, the first copy requested must be free of charge for the patient, but not necessarily further copies.

In the Guide for patients and healthcare users, published in 2019, the Spanish Data Protection Agency maintains the same criteria as the CJEU, stating that it is not possible to charge patients for providing them with a copy of their medical records, unless they request more than one copy, or the requests are very repetitive.