Patient reports and test results: where to store them

Where to store a patient's reports has a short answer: the reports and tests a patient brings or sends, such as another specialist's report, a blood test or an X-ray, are kept inside their medical record, in the clinic's system. Not in the reception email inbox, in a chat or on the phone of whoever is treating them: there nobody else can find them and nobody controls who sees them.

Why they are part of the medical record

A report or test that the professional takes into account when treating the patient is clinical documentation, and its place is the medical record. Law 41/2002, on patient autonomy (Spain), defines clinical documentation as the medium of any type or kind that contains a set of data and information of a care-related nature. It makes no difference whether it is a sheet of paper, a PDF or an image.

The same law says the medical record comprises the set of documents relating to each patient's care processes, with the aim of achieving the greatest possible integration of each patient's clinical documentation, at least within each centre. Integrating is exactly the opposite of having the blood test in an email and the progress note in the software.

Among the minimum content of the record, the law includes reports of complementary examinations. Which external documents are incorporated, and what is noted about them, is for the professional to decide: the law speaks of the data that, in medical judgement, allow a truthful and up-to-date knowledge of the patient's state of health. We go through the full minimum content in electronic medical record.

The problem with loose reports

A report that stays outside the record fails in three ways at once, and all three have to do with the clinic's obligations:

• Nobody else can find it. Law 41/2002 asks each centre to establish the methods that make the medical record of each patient accessible at all times to the professionals who treat them. If the MRI is on a physiotherapist's WhatsApp, her colleague on the afternoon shift cannot see it.
• Nobody controls who sees it. The GDPR requires data to be processed in a way that ensures appropriate security, including protection against unauthorised or unlawful processing and against loss. A forwarded email or a phone with no lock does not give that guarantee.
• Nobody holds custody of it. The law gives patients the right to have centres establish an active and diligent custody mechanism for medical records. A file on a personal phone goes away with its owner.

A routine for whatever arrives from outside

What works is for everything that arrives to follow the same path, whoever receives it. A five-step proposal, which you will need to adapt to your clinic:

1. One clinic channel for receiving. An email address or a number belonging to the clinic, not each professional's personal one.
2. Identify the patient before saving anything, so the report does not end up on the record of another person with the same name.
3. Add it to their record the same day.
4. Delete the loose copies: the email attachment, the download on the computer, the photo on the phone.
5. Decide what to do with the paper. If the patient brings the original, you can give it back after adding it; the law allows clinical documentation to be kept though not necessarily in the original medium, and leaves it to the autonomous communities (regions) to make provisions for archiving and protecting records: check whether yours sets anything on this.

And one precaution that works the other way: when a patient phones to ask about a test result. The AEPD (the Spanish Data Protection Agency) warns, in its guide for patients, that giving that information by telephone risks handing it to a third party and, for security reasons, should be avoided unless there is a protocol for identifying the caller.

Who can see them and how long they are kept

A report added to the record follows the rules of the record: it is seen by those who treat the patient and is kept along with it. Law 41/2002 gives access to the record to the care professionals of the centre who carry out the patient's diagnosis or treatment, and limits administrative and management staff to the data related to their own functions. The detail, role by role, is in who can see the medical record.

As for time, the law requires clinical documentation to be kept for at least five years counted from the date of discharge from each care process, and your autonomous community may have its own rules. We explain it in how long to keep the medical record.

How they are attached in Mi Clínica

In Mi Clínica, what is attached to the patient's record is images. Each specialty in the record has its own files section with a “+ Añadir foto” (+ Add photo) button, which opens the tablet or phone camera, or the file picker on a computer. This is how it works:

• Images, not documents. The picker accepts images. It suits a photo of an injury, of an X-ray film or of a paper report that the patient brings to the appointment; a PDF report cannot be attached to the record from the application.
• Private to the clinic. The image is saved on the patient's record as a clinical photograph, private to the clinic, and only someone with clinical access can view or upload it. Even if you attach it from a specialty, it is saved as a follow-up photo of the patient and you will find it in the “Fotos” (Photos) tab of the record.
• Size. Each file can be up to 25 MB; anything larger is rejected.
• With a trail. Who views the patient's photographs is noted, just as who views the medical record is logged.

If you also want to use a patient's photos outside the consulting room, that is a different purpose with its own consent: we cover it in before-and-after patient photos. The rest of the features are on the Mi Clínica page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Ley 41/2002, básica reguladora de la autonomía del paciente (texto consolidado). BOE.
• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Guía para pacientes y usuarios de la Sanidad. AEPD.