Authorization for a Close Person to Access Medical Records - Template and Rules

An agitated man calls Beata's practice. He introduces himself as the son of a patient who just walked out of a treatment session, and asks how the therapy went and what's next in his mother's care. Wanting to help, the receptionist starts explaining the details. Only after hanging up does someone on the team ask: how do we actually know this is her son, and did the patient even authorize him for this?

This isn't a made-up scenario -- it's everyday reality at any practice where patients' families reach out on their behalf. The problem is that instinct says "help a close relative," while the law says something different: without the patient's explicit authorization, a practice has no right to disclose either health information or access to medical records. This article explains what a proper authorization looks like, how it differs from consent to share information, and what to do when a patient hasn't authorized anyone -- both while alive and after death.

Who has the right to access a patient's records and information

The foundation here is the Polish Act on Patient Rights and the Patient Rights Ombudsman. Under its Articles 9 and 26, by default the right to information about one's own health and the right to medical records belong exclusively to the patient. No one else -- not a spouse, not an adult child, not the parent of an adult patient -- has automatic access, no matter how close the family bond.

The only exception is when the patient explicitly and in writing designates a person or persons to whom such access is granted. That authorization must be kept in the practice's medical records -- without it, staff have no legal basis to disclose anything, even if the caller sounds credible and provides the patient's correct details. We cover how to maintain this kind of records more broadly in our guide to the patient record in physiotherapy.

The rule is easy to remember: no authorization on file = refuse to share information, regardless of who's asking or how upset they are.

Two different authorizations that are easy to confuse

This is one of the most common mistakes at practices -- treating "authorization for information" and "authorization for medical records" as a single document. They are two separate entitlements, governed by different provisions, and a patient can grant one without the other.

Authorization for health information

This covers the right to conversation -- receiving verbal or telephone information about the course of treatment, diagnosis, prognosis, or therapeutic recommendations. Under Article 9 of the Act, this authorization lets the therapist answer questions from the person the patient designated, but it does not give that person the right to view the record or receive copies of documents.

Authorization for medical records

This covers the right to view the records and to receive copies of them (Article 26 of the Act). A person authorized only for records can come to reception, ask to view the patient's file, or collect a printed copy -- but without an additional authorization for information, the therapist should not freely discuss the course of treatment with them beyond what the documents themselves state.

In practice, most patients want to grant both entitlements at once -- and a well-designed statement should let them tick that scope explicitly. But a practice must be ready for the situation where a patient checks only one box, and then must stick strictly to what was indicated.

Type of authorization	What it covers	Legal basis	What it does NOT cover
Health information	Phone/in-person conversation about treatment course, diagnosis, recommendations	Art. 9, Act on Patient Rights	Viewing records, receiving copies
Medical records	Viewing the patient record, receiving copies of records	Art. 26, Act on Patient Rights	Free discussion of health status beyond the document content
Both combined	Information + viewing + copies of records	Art. 9 and 26 combined	--
No authorization	Nothing -- refusal for third parties	--	Everything except the patient personally

Does an authorization from another facility apply at your practice

No. This is a mistake that regularly comes back in questions from patients and families: "but I already authorized her at her cardiologist's, doesn't that count?" It doesn't. Every healthcare provider collects its own authorizations -- there is no single universal document that carries over between facilities, even if it concerns the same patient and the same close person.

This follows directly from the fact that medical records and professional confidentiality are tied to the specific entity that maintains them. An authorization filed at a primary care clinic has no force at a physiotherapy practice, even when the patient is convinced they "already signed something like that somewhere." That's why the authorization form should be collected from every new patient at the first visit -- regardless of how many similar documents they've signed elsewhere.

When family calls and the patient hasn't authorized anyone

This is the scenario from the article's opening, and it's worth breaking down step by step, because phone pressure can be intense.

Basic rule: refuse. Practice staff are bound by professional confidentiality (medical confidentiality as defined for regulated healthcare professions), and disclosing information without a legal basis violates both the Act on Patient Rights and GDPR. It doesn't matter that the caller knows the patient's details, address, or phone number -- that's not proof they have a right to the information.

A practical refusal script worth keeping on hand for reception: *"I understand your concern, but due to professional confidentiality and medical data protection regulations, I can't share that information without the patient's authorization. I'd encourage the patient to authorize you herself at her next visit, or by phone after identity verification."*

Exception: life-threatening situations. The regulations allow a departure from professional confidentiality when maintaining it could pose a danger to the life or health of the patient or others, or when the patient poses a risk to themselves. At a physiotherapy practice such situations are rare, but they can occur -- for example, a sudden deterioration during treatment requiring immediate contact with the family to hand the patient over to medical care. This is an exception, not the rule, and should be applied cautiously, ideally with the practice owner involved.

Authorization after a patient's death

A patient's death doesn't end the question of records access -- quite the opposite, it's the moment when family questions come up most often, and the rules change.

The Act on Patient Rights grants the right to view a deceased patient's records to a close person as defined by the Act. The catalog of close persons includes: a spouse, a relative up to the second degree in the direct line, an in-law up to the second degree in the direct line, a legal representative, a person in a de facto cohabiting relationship, or a person the patient designated while alive.

The key condition: this right belongs to the close person unless the patient explicitly objected to it while alive. If the records contain a statement from the patient that they do not wish their records to be disclosed to a specific person (or to anyone) after death, that objection is binding, and the facility must honor it even against the closest family.

That's why good practice is to ask about this at the same time as collecting the standard authorization -- a checkbox along the lines of "I do / do not consent to my records being disclosed after my death" saves the practice a difficult conversation at the worst possible moment.

[SP] Example -- Solo practice: After the "patient's son" phone call incident, Beata makes one change -- every new patient signs a short statement at their first visit with two separate fields: authorization for information and authorization for records, each with space for a specific person's details. From then on, reception has a clear answer before it even picks up the phone.

[GR] Example -- Group practice: At a practice with several therapists and two receptionists, they introduce a rule that authorizations are stored in one shared location in the records system -- not in individual therapists' notes. That way, whoever is at reception, regardless of who saw the patient, can check within seconds whether a given person is entitled to information before answering a phone call.

What a proper statement looks like and when to collect it

The best time to collect an authorization is the first visit, alongside the rest of the intake documentation -- the patient record, treatment consent, and the GDPR information clause. Waiting until a crisis (a family phone call, a patient's condition worsening) means the document simply won't exist when it's needed most. For more on tying the whole intake documentation set into one coherent system, see our article on GDPR at a physiotherapy practice.

A proper authorization statement should include:

• Patient details -- first and last name, national ID number or date of birth, sufficient to uniquely identify the person the records concern.
• Details of the authorized person -- first and last name, degree of kinship or relationship, optionally a phone number to help verify identity when they make contact.
• Scope of authorization -- separate checkboxes: health information, medical records (viewing and/or copies), or both combined.
• A provision covering access after death -- whether the authorization also extends to the period after the patient's death, and whether the patient names other people for that purpose.
• Date and legible patient signature -- without a signature, the document has no legal force.
• A note on the right to revoke -- a clear statement that the patient can withdraw the authorization at any time, in writing, with the withdrawal taking effect immediately upon submission.

It's also worth keeping a simple log at the practice of who accessed records under such an authorization and when -- this keeps things orderly in case of an inspection and helps avoid misunderstandings. We describe how to maintain this kind of log in our article on the register of medical records disclosures.

Revoking an authorization

A patient has the right to revoke an authorization at any time, without giving a reason. The revocation should be in writing (or at least noted in the records with a date and the patient's signature) and takes effect from the moment it is submitted -- it does not apply retroactively, but any contact from the previously authorized person after that date must be treated as if the authorization never existed. The practice should have a procedure for keeping such changes updated in the patient record promptly, so reception doesn't act on outdated information.

Frequently asked questions

Does a patient's spouse automatically have access to their medical records?

No. A marital relationship does not automatically grant the right to health information or medical records about a spouse. Access is only granted when the patient has personally designated the spouse as an authorized person in a written authorization -- specifying whether it covers information, records, or both entitlements.

Does an authorization signed at a GP practice also apply at a physiotherapy practice?

No. Every healthcare provider, including a physiotherapy practice, collects its own authorizations regardless of what the patient signed at another facility. There is no single universal document that carries over between different providers, so the authorization form needs to be collected from each patient separately, ideally at the first visit.

What should we do when a caller claims to be a patient's close relative but there's no authorization on file?

You must refuse to share information, citing professional confidentiality and medical data protection regulations. The exception is a situation where the patient's life or health is at risk, when the regulations allow a departure from confidentiality. Outside that exception, the only solution is to ask the patient to submit a formal authorization.

Does family have the right to view records after a patient's death if no authorization was left?

Yes, if the person requesting access falls within the statutory catalog of close persons (spouse, relative or in-law up to the second degree in the direct line, legal representative, person in a de facto cohabiting relationship). This right does not apply, however, if the patient explicitly objected while alive to their records being disclosed after death.

CTA: Proper intake documentation -- consents, authorizations, disclosure logs -- is one of the foundations of a safe physiotherapy practice. The TARCZA package organizes your practice's compliance documentation from the ground up. See FizjoReady packages →

Related articles:
- The patient record in physiotherapy -- how to keep it properly
- GDPR at a physiotherapy practice -- the complete guide
- Register of medical records disclosures -- how and why to keep one