Copy of the medical record: how to handle a patient's request

If a patient writes to ask for a copy of their medical record, the clinic has to provide it: Ley 41/2002 (Spain's patient autonomy law) gives them the right to obtain a copy of the data in their record, and the GDPR sets a general deadline of one month to respond. Before handing it over, check who is asking, review what can be withheld and keep a record of everything.

What right the patient has

The patient has the right to access their medical record and to take a copy, with some reservations. Article 18.1 of Ley 41/2002, the basic law regulating patient autonomy in Spain, says so (our translation; there is no official English text): “The patient has the right of access, subject to the reservations set out in paragraph 3 of this article, to the documentation in the medical record and to obtain a copy of the data contained in it”.

The same paragraph adds that healthcare centres will regulate the procedure that ensures these rights are respected. In other words, the clinic must have a procedure, and it is best to write it down before the first request arrives.

At the same time, a medical record is full of personal data, so the right of access under the GDPR also applies. Its article 15 obliges the controller to provide a copy of the personal data being processed, and that is where the deadline and cost rules we set out below come from. The LOPDGDD (Spain's Organic Law on Data Protection and Digital Rights) refers back to that article and adds some clarifications. Your autonomous community (Spanish region) may also have its own rules on medical records: check them.

Who can request it and how to check

The copy can be requested by the patient or by someone on their behalf, but in that case the representation must be proven. Ley 41/2002 puts it this way: the patient's right of access to the medical record may also be exercised through a duly proven representative. The LOPDGDD, for data protection rights, allows them to be exercised directly or through a legal or voluntary representative.

In practice, at reception:

• If the patient asks in person, identify them as you would when booking an appointment.
• If they ask by email or phone, and you have reasonable doubts about who they are, the GDPR allows you to ask for the additional information needed to confirm their identity. Ask only for what is necessary.
• If a third party asks, require the document proving the representation and keep it with the request.
• If the patient is under fourteen, the LOPDGDD provides that those with parental authority may exercise the rights of access on their behalf.

Access by relatives to the record of a deceased patient has its own rules, which we explain in who can see the medical record. In any doubtful case, consult your adviser before handing anything over.

What deadline applies to your reply

The general deadline is one month from receiving the request. Article 12.3 of the GDPR requires a reply within one month of receipt of the request, and allows it to be extended by a further two months where necessary, taking into account the complexity and number of requests. If you are going to use the extension, you must tell the patient within the first month, giving the reasons.

Four more rules to keep in mind:

Situation	What the rule says
Cost	Handling the right of access is free of charge for the patient, with exceptions: for any further copy they request, a reasonable fee based on administrative costs may be charged (GDPR, article 15.3), and if the request is manifestly unfounded or excessive, a reasonable fee may be charged or you may refuse to act (GDPR, article 12.5)
More expensive delivery method	If the patient chooses a different method from the one offered that entails a disproportionate cost, the request is considered excessive and they bear the excess costs (LOPDGDD, art. 13.4)
Request by email	The information shall be provided in a commonly used electronic form, unless the patient asks for another way (GDPR, art. 15.3)
Repeated requests	For the purposes of excessive requests, asking for access more than once in six months may be considered repetitive, unless there is a legitimate reason (LOPDGDD, art. 13.3)

If your autonomous community has its own rules on access to the medical record, apply what they say as well and, if in doubt, ask your adviser.

What can be withheld

Before handing over the copy it must be reviewed, because the law allows two things to be left out. Article 18.3 of Ley 41/2002 establishes that the right of access cannot be exercised to the detriment of third parties' right to confidentiality of data in the record that were provided in the patient's therapeutic interest, nor to the detriment of the right of the professionals who contributed to compiling it, who may invoke the reservation of their subjective notes against the right of access.

In day-to-day terms in a practice:

• Third-party data. What a relative confided in the patient's therapeutic interest, for example, is not handed over as a matter of course.
• Subjective notes. The professional may withhold their subjective notes. What counts as a subjective note is best decided with care and with your adviser, not on the spot.

If you decide not to deal with the request, the GDPR requires you to inform the patient without delay, and at the latest within one month, of the reasons and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

How to handle the request, step by step

A simple procedure, written down and known to the whole team, helps avoid improvising. A proposal for a small clinic:

1. Log the request with the date it arrives: the deadline runs from that day.
2. Check identity or representation, as explained above.
3. Define the scope. If you process a large amount of the patient's data and they do not specify what they mean, the LOPDGDD allows you to ask them, before providing the information, to specify the data or processing activities their request refers to.
4. Prepare the copy with someone who has access to the medical record, not at reception.
5. Review the reservations for third parties and subjective notes with the relevant professional.
6. Deliver it by the agreed method, in electronic format if they asked that way.
7. Keep a record of what was delivered, when, to whom and by what means.

What you hand over comes from your medical record, so the better organised it is, the less work this takes. What a record should contain is covered in electronic medical records.

How to keep an audit trail

Keeping an audit trail is not red tape: if a patient complains, the clinic has to be able to show that it replied. The LOPDGDD is blunt about it: the burden of proving compliance with the duty to respond to a request to exercise rights made by the data subject lies with the controller.

For each request, keep in one place the request with its date, the identity or representation check, the reply, what was delivered and when, and, if there were reservations or an extension, the reason.

Management software can also help keep track of who touches the record while the copy is being prepared. In Mi Clínica, permissions work by role: “Recepción” (Reception) handles the diary, patients, payments and administrative documents with nothing clinical, so it can take the request without seeing the record. And a record is kept of who views the medical record, with user, date and time, in the “Actividad” (Activity) tab of the patient's file, visible to those with clinical access. The rest of the features are on the Mi Clínica page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Ley 41/2002, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica (texto consolidado). BOE.
• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.