Spain's Law 41/2002 on patient autonomy: a guide for clinics

Spain's Law 41/2002 on patient autonomy regulates the rights and obligations of patients, professionals and healthcare centres, public and private, in clinical information and documentation. For a private clinic it matters in three areas: how to inform the patient, how to obtain their consent and how to keep, retain and give access to the medical record.

Who it applies to and which principles it sets

It applies to healthcare centres and services, public and private, and to their professionals. Law 41/2002, the basic law regulating patient autonomy, aims to regulate the rights and obligations of patients, users and professionals, as well as of public and private healthcare centres and services, in matters of patient autonomy and clinical information and documentation.

For the law, a healthcare centre is the organised set of professionals, facilities and technical means that carries out activities and provides services to care for the health of patients and users. If your centre does not provide healthcare services, which parts affect you is a question for your adviser.

The law opens with some basic principles worth keeping in mind day to day:

• The dignity of the person, respect for the autonomy of their will and for their privacy guide all activity involving clinical information and documentation.
• Every action in the field of healthcare requires, as a general rule, the prior consent of patients or users.
• Every professional involved in care is obliged not only to the correct provision of their techniques, but to fulfilling the duties of information and clinical documentation.
• Anyone who produces or has access to clinical information and documentation is obliged to keep the due confidentiality.

It is a basic law: the State and the autonomous communities adopt, within their powers, the measures needed for it to be effective. Your autonomous community may have its own rules developing it, so confirm with your adviser which ones apply to your clinic.

Part 1: informing the patient

The patient has the right to know, in connection with any action concerning their health, all the information available about it, except in the cases the law exempts, and also to have their wish not to be informed respected. Articles 4 and 5 of the law set out how:

• What and how. The information, which as a general rule is given verbally with a note made in the medical record, comprises, as a minimum, the purpose and nature of each intervention, its risks and its consequences. It will be truthful and communicated in a way that is understandable and suited to the patient's needs.
• Who informs. The responsible doctor guarantees the right to information, and the professionals who treat the patient or apply a specific technique or procedure are also responsible for informing them.
• Whom. The holder of the right is the patient. People connected to them by family or de facto ties are also informed to the extent that the patient allows it, expressly or tacitly.

Alongside information comes privacy. Everyone has the right to have the confidentiality of their health data respected, and healthcare centres will adopt the appropriate measures to guarantee it. At reception that shows up in something as everyday as whom you give information to over the phone.

Part 2: consent

Every action concerning a patient's health requires their free and voluntary consent, once they have received the information and weighed up the options of their case. What matters most for a clinic fits into five rules:

1. Verbal as a general rule, and in writing for surgery, for invasive diagnostic and therapeutic procedures and, in general, for procedures involving risks or drawbacks with a notable and foreseeable negative impact on the patient's health.
2. A written form for each action, with sufficient information about the procedure and its risks, after the doctor gives the basic information set by the law. We expand on this in what an informed consent form must include.
3. Revocable: the patient may freely revoke their consent in writing at any time, and has the right to refuse treatment, except in the cases set by the law; their refusal will be recorded in writing.
4. With strictly defined exceptions: doctors may carry out the clinical interventions that are indispensable for the patient's health without their consent when there is a risk to public health for health reasons established by law, or an immediate serious risk to the patient's physical or mental integrity and it is not possible to obtain their authorisation.
5. By representation in some cases, such as a patient who is not able to make decisions in the opinion of the responsible doctor or a minor who is not able to understand the scope of the intervention. It does not apply to emancipated minors or those aged over 16, with the exceptions set by the law itself.

Part 3: the medical record

The medical record comprises the set of documents relating to each patient's care processes, with the identification of the doctors and other professionals who took part in them. The law devotes six articles to it, 14 to 19:

Topic	What the law says
Filing	Each centre will file its patients' medical records, on paper, audiovisual, computer-based or any other format, guaranteeing their security, their proper preservation and the retrieval of the information.
Content	It will include the information considered essential for a truthful and up-to-date knowledge of the patient's state of health.
Uses and access	Access is granted to the care professionals who diagnose or treat the patient; administrative and management staff, only to the data related to their own functions; and anyone who accesses it is bound by a duty of secrecy.
Retention	At least five years counted from the date of discharge of each care process. A professional who practises individually is responsible for the management and custody of the care documentation they generate.
Patient access	They have the right of access to the documentation in the medical record and to obtain a copy of the data in it, with reservations such as professionals' subjective notes.
Custody	The patient has the right to have centres establish a mechanism of active and diligent custody of medical records.

What the record must contain and how to keep it digitally is covered in electronic medical records; the time limits, in how long to keep the medical record, and access, in who can see the medical record.

Other duties that get forgotten

Besides these three areas, the law sets out rights and duties that go more unnoticed in a private clinic:

• Discharge report. Every patient, relative or person connected to them, where applicable, has the right to receive from the centre, once the care process has ended, a discharge report with the minimum contents set by the law.
• Certificates. Every patient or user has the right to be given certificates attesting to their state of health.
• Administrative documentation. Healthcare professionals have the duty to complete the protocols, records, reports, statistics and other care or administrative documentation related to the clinical processes in which they take part.

The law also has its own liability regime: infringements of its provisions fall under the penalty regime of the General Health Act (Ley General de Sanidad), without prejudice to any civil or criminal liability and any professional or statutory liability that may apply.

Checklist for your clinic

This list sums up the above as questions you can go through with your team and your adviser:

1. Does each practitioner know what information they must give and where it is recorded that they gave it?
2. Is it clear which relatives or companions can be informed about each patient?
3. Which of the clinic's treatments need written consent, and is there a document for each one?
4. How is a revocation or a refusal of treatment recorded, and where is it kept?
5. Who can see each part of the record, and is there a log of who consults it?
6. How long is each record kept, counting from what date and under which rule of your community?
7. How does the clinic respond when a patient asks for a copy of their record?

What Mi Clínica does and what the clinic decides

Complying with the law is a matter for the clinic and its professionals; the software does not certify compliance with any rule. What Mi Clínica does is give an orderly place to what the law asks to be documented:

• Record by specialty. A general record with allergies, medication, history and habits, and a tab per specialty with its progress notes.
• Consent forms signed on the tablet. The signed file cannot be modified, and if something needs to change a new version is made that keeps the previous one.
• Access trail. Who consults the medical record is logged, with user, date and time.
• Each clinic, isolated. No clinic can see another's data.

What patients are told, what is signed, who has access and how long it is kept is decided by the clinic with its adviser. A summary of how Mi Clínica works with documents is on its main page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Ley 41/2002, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica (texto consolidado). BOE.