Choosing EDM Software for Your Practice
EDM software for a physiotherapy practice: selection criteria from the law, questions for the vendor and the data processing agreement.
You are choosing software to keep your records, and every vendor promises "full compliance with the regulations". The question is what that compliance is supposed to mean. The law does not publish a list of approved programs. It does set out requirements the system must meet. From them you can build your own list of questions and test an offer without relying on an advertising slogan.
This article is about choosing software for electronic medical records (EDM, elektroniczna dokumentacja medyczna) for a small practice. We do not compare brands and we do not quote market prices. What EDM is and how the P1 platform works is explained in our article on EDM in physiotherapy. Here you get a buying checklist.
In brief
- The rule in the medical records regulation is electronic form (§ 1(1)). Paper is the exception.
- The software must meet the requirements of § 1(6): integrity, change history, identification of the author of an entry, and printing and export of all data.
- Providers pass medical event data to the SIM system (Article 11(3) of the Act on the Health Care Information System). The software should support this.
- A vendor that stores patient data is usually a processor. You need a data processing agreement (Article 28 GDPR).
- The most important question before you buy: how do you leave the system and take your data with you.
Does a physiotherapy practice have to keep EDM
The answer depends on what you mean by EDM, because the act and the regulation use two different concepts.
The Act on the Health Care Information System (ustawa o systemie informacji w ochronie zdrowia, SIOZ) says in Article 11(1) that providers (usługodawcy) must keep electronic medical records. A provider is a healthcare provider under Article 5(41) of the Act on Healthcare Services Financed from Public Funds. In the wording we read, this covers entities carrying out medical activity and persons with the right to provide services who do so as a business. A typical physiotherapy practice fits this definition. We did not analyze borderline cases.
The definition of EDM in Article 2(6) of that Act is narrow. It lists specific documents, for example prescriptions and referrals, signed with a qualified signature, a trusted signature or a personal signature. It is not the whole of your patient records.
The regulation covers all medical records. Its § 1(1) says that records are kept in electronic form, and subsection 2 allows paper where a provision of the regulation says so or where organizational and technical conditions make electronic form impossible. More on this split in the text on the medical records regulation.
Since when it applies
We did not find a single date of "mandatory EDM" for practices. There are deadlines for different elements:
| Element | Deadline | Source |
|---|---|---|
| Records under the previous regulation | until 31 December 2020 | § 72(1) of the regulation |
| Paper prescriptions | until 7 January 2020 | Article 56(2) of the SIOZ Act |
| Passing medical event data to SIM | from 1 July 2021 | Article 56(2a) of the SIOZ Act |
Criteria for choosing EDM software
Start with the requirements the law sets for the IT system in which you keep your records (§ 1(6) of the regulation). Turn them into questions for the vendor:
| Requirement in the law | Question for the vendor |
|---|---|
| Integrity of content and metadata, changes only under documented procedures | Can an entry be changed after saving without a trace? What does the change history look like? |
| Identification of the person who prepared the document or made the entry, and of the scope of changes | Does every entry have an author and a record of what was changed? |
| Information on the time the document and entry were made | Is the time recorded automatically? |
| Access only for authorized persons | What roles and permissions can be assigned? Is there individual login? |
| Ability to print | Does the printout meet the requirements of § 70(2) (confirmation of conformity)? |
| Export of all data in standards and formats that allow it to be restored in another system | In what format, how fast and at what fee can I export everything? |
On top of that come the security requirements of § 1(5): risk estimation, documented procedures, software updates and long-term storage plans, including migration to new formats. Ask how the vendor updates the system and what happens to your data when a format changes.
Signing and communication with the platform
The regulation lists the ways records can be signed: a qualified electronic signature, a trusted signature, a personal signature, or a mechanism confirming origin and integrity from the system provided by ZUS (the Social Insurance Institution) (§ 4(3)). Internal records can also be signed with the system's internal mechanisms (§ 4(4)). Ask which of these routes the software supports.
The SIOZ Act requires medical event data to be passed to SIM, the Medical Information System (Article 11(3)). The P1 platform issues the certificates with which the provider's system authenticates (Article 2(3) and (3a)). So check whether the vendor knows this process and sets it up with you. Official information is on the Centre for e-Health website, and the text of the Act is in the Journal of Laws.
Costs and licences: what to look at
No market prices, because they change quickly and differ between offers. Instead, ask about how fees are built:
- whether you pay per practice, per user or per number of visits,
- what is in the subscription and what costs extra (P1 integration, backups, support),
- whether the price rises when you add a second physiotherapist or a receptionist,
- how much data export and ending the contract cost,
- how long the contract runs and what the notice period is.
The vendor as a processor
If patient data sits on the vendor's servers, the vendor processes it on your behalf. Processing then takes place under an agreement containing the elements of Article 28(3) GDPR. These include: processing only on your instruction, the security measures of Article 32, rules on the use of subprocessors, help with patients' rights, and deletion or return of data after the services end, as you decide.
The Act on Patient Rights adds two safeguards. Performance of a processing agreement cannot disrupt the provision of services, in particular access to data without undue delay (Article 24(5)). The vendor is also bound by confidentiality of patient information, including after the patient's death (Article 24(6)). How to structure the agreement is covered in the article on the data processing agreement.
Questions for the vendor before you buy
Print this and tick it off during the meeting:
- Where is the data physically located (country, data centre) and who has access to it?
- Do you get a draft data processing agreement before you sign the commercial contract?
- Is the list of subprocessors public, and are changes announced in advance?
- How are backups made and how fast can data be restored?
- What happens to the system in a failure, and how do you work at the practice meanwhile?
- Can I export all data in a format suitable for another system?
- What happens to the data after the contract ends, and when will it be deleted or returned?
- Are updates related to changes in the law included in the price?
Point 5 has a basis in the law. When the P1 system fails, the provider enters the data in SIM without delay after the failure ends, no later than within 3 days of its removal, and days off are not counted toward the deadline (Article 11(5a)-(5b) of the SIOZ Act). Your own software failure is handled by the procedure in the article on working on paper during an EDM failure. We cover the security of your working environment in the text on IT security at a physiotherapy practice.
Migrating from paper
You have binders and want to move them into the software? The SIOZ Act allows digitization (Article 13b). It consists of creating a digital copy and signing it with a qualified electronic signature, a trusted signature, a personal signature or an advanced electronic seal, by a person authorized to confirm conformity with the original. A document after digitization is equivalent to the original.
When you digitize, you must tell the patient about it and about the option to collect the paper copy within a period of not less than one year from the information. Only if the records are not collected despite that information may you destroy the paper in a way that prevents the patient from being identified. The retention period for records is, as a rule, 20 years from the end of the calendar year of the last entry (Article 29 of the Act on Patient Rights), so do not throw anything away in advance. Details are in the article on archiving medical records.
Frequently asked questions
Does EDM software need a certificate or ministry approval?
In the provisions we read, we did not find a list of approved programs or a requirement for a product certificate. There are requirements for the system (§ 1(6) of the regulation) and the obligation to communicate with SIM. P1 certificates are used to authenticate the provider's system on the platform, not to assess the software.
Is Word or scanned records in a folder enough?
A text file in a folder will usually not provide the change history, the identification of the author of an entry or the access control required by § 1(6). We did not check whether anyone has challenged such a solution. Assess it against the list of requirements in this article.
Is the software vendor a processor?
If it stores patient data or has access to it on your behalf, yes. You then need an agreement that meets Article 28(3) GDPR. In borderline cases, for example where the software runs only locally, ask a lawyer.
Can I change software during my business?
Yes, but you carry over the whole of your records, which as a rule must be kept for 20 years. That is why exporting data in a format that allows it to be restored in another system is one of the requirements of § 1(6) of the regulation. Check it before you sign the contract, not after.
How much does EDM software cost?
We do not quote prices, because they change and depend on the licence model. Compare offers against the same criteria: what is in the subscription, how much export costs and what happens when the contract ends.
Legal status as of: 2 November 2026
Legal basis: Act of 28 April 2011 on the Health Care Information System (consolidated text Journal of Laws 2026 item 1304), Article 2(3), (3a), (6) and (15), Article 7(1), Article 11(1), (3), (5a)-(5b), Article 13b, Article 56(2) and (2a); Act of 27 August 2004 on Healthcare Services Financed from Public Funds (consolidated text Journal of Laws 2025 item 1461), Article 5(41); Minister of Health regulation of 6 April 2020 on the types, scope and templates of medical records (consolidated text Journal of Laws 2026 item 1391), §§ 1, 4, 70 and 72; Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman (consolidated text Journal of Laws 2024 item 581, as amended by Journal of Laws 2026 items 26 and 791), Article 24(5)-(6) and Article 29; Regulation (EU) 2016/679 (GDPR), Articles 28 and 32. We did not check: later changes to the definition of a healthcare provider, the regulation on types of EDM issued under Article 13a of the SIOZ Act, the technical standards and formats published in the Public Information Bulletin, the rules on handing over records after ceasing activity (Article 30a of the Act on Patient Rights) or specific offers on the market.
Last reviewed: 2 November 2026
The PREMIUM package contains instructions and a template for a data processing agreement, a register of processing activities, authorizations to process data and a breach procedure, that is, documents you will need whichever software you choose. We do not sell or recommend any software. See FizjoReady packages
Related articles:
- EDM in physiotherapy
- Data processing agreement at a physiotherapy practice
- Medical records regulation in physiotherapy
- EDM failure: working on paper
- Free Physiotherapy Software: The Limits
- Practice Software: 10 Vendor Questions