Authorization to Access Medical Records
Template for authorizing access to medical records and health information in Poland: form fields, withdrawal, family without authorization, access after death.
An agitated man calls Beata's practice. He introduces himself as the son of a patient who just walked out of a treatment session, and asks how the therapy went and what is next in his mother's care. Wanting to help, the receptionist starts explaining the details. Only after hanging up does someone on the team ask: how do we know this is really her son, and did the patient authorize him at all?
This is everyday reality at any practice where families contact the practice on a patient's behalf. Instinct says "help a close relative", but the law says something different: the practice gives health information and medical records to the patient, the patient's statutory representative, or a person the patient has designated. Below we explain what the authorization looks like, how it differs from consent to share information, how to collect it, and what to do when the patient has not designated anyone, including after the patient's death.
Short answer
There are two separate entitlements: the patient's consent to share information about their health with another person (Article 9(3) of the Polish Act on Patient Rights and the Patient Rights Ombudsman) and an authorization to access medical records (Article 26(1)). Statements made in any way other than through the Internet Patient Account go into the patient's internal individual records. Without them the safe practice is not to give information or records to third parties, including family.
Who has the right to information and records
The foundation is the Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman. The right to accessible information about health status, diagnosis, treatment methods, consequences and prognosis belongs to the patient (including a minor aged 16 or over) or the patient's statutory representative, and the patient or the representative may consent to that information being given to other persons (Article 9(2) and (3)). The practice makes medical records available to the patient or the statutory representative, or to a person authorized by the patient (Article 26(1)).
Outside that circle no one has automatic access: not a spouse, not an adult child, not the parent of an adult patient. Persons practising a medical profession must keep information related to the patient confidential, especially information about the patient's health (Articles 13 and 14(1)). The practical rule is simple: no patient statement on file means refusing a third party, however credible the caller sounds. We cover the patient's own file in our guide to the patient record in physiotherapy and the set of first-visit documents in documents for a patient's first visit.
Two entitlements that are easy to confuse
Treating "authorization for information" and "authorization for records" as one document is a common mistake. The Act regulates them in separate provisions, and a patient can grant one without the other.
Consent to share information about health
This covers a conversation: oral or telephone information about health status, diagnosis, proposed and possible treatment methods, foreseeable consequences of using or not using them, treatment results and prognosis (Article 9(2) and (3)). The designated person may ask the therapist about the course of treatment, but this gives no right to inspect the file or collect copies.
Authorization for access to medical records
This covers access to medical records (Article 26(1)). Article 27(1) lists the ways records are made available: inspection at the place where services are provided, an extract, transcript, copy or printout, electronic communication, and an electronic data carrier. The Act does not split the authorization into "inspection" and "copy", so it is wise to tick the scope on the form so that the patient's intention is clear. A person authorized only for records is not thereby entitled to a free conversation about treatment beyond what the documents show, unless the patient also gave consent under Article 9(3).
| Entitlement | What it covers | Basis in the Act | What it does not cover by itself |
|---|---|---|---|
| Consent to share information | Talking about health status, diagnosis, treatment, prognosis | Art. 9(2) and (3) | Access to records |
| Authorization for records | Access to records in the ways listed in Art. 27(1) | Art. 26(1) | Consent to talk about health |
| Both | Information and access to records | Art. 9(3) and Art. 26(1) | -- |
| Neither | As a rule a third party gets neither information nor records (exceptions: Art. 14(2)) | Art. 13, 14 and 26 | -- |
Template of the patient's statement
The Act does not prescribe a template. The Minister of Health's regulation on the types, scope and templates of medical records only requires that the patient's statement consenting to the sharing of information (naming the person and giving contact details) and the authorization to access records, if made in any way other than through the Internet Patient Account, be placed in the internal individual records (§ 8(1)). Before the patient makes the statements the practice informs the patient that they can be made through the Internet Patient Account and what that means (§ 8(2)). The fields below are a proposal that fits those requirements.
| Form field | What to enter or tick | Why |
|---|---|---|
| Patient details | Name, PESEL (or date of birth and document type if there is no PESEL) | Unambiguous link to the file |
| Designated person | Name, relationship, phone | § 8(1) requires the name and contact details for the consent to share information |
| Scope: information | Yes / no | Consent under Art. 9(3) |
| Scope: records | Inspection, transcript or copy, electronic form | Authorization under Art. 26(1) and the ways in Art. 27(1) |
| Access after death | Whether the patient objects to disclosure of the records after death (generally or to named persons) | A patient's objection made in life excludes access by close persons (Art. 26(2)), subject to the court route in (2b) |
| Date and patient's signature | Legible signature, date | Evidence the statement was made |
| Withdrawal | Note that the statement can be withdrawn at any time | Transparency toward the patient |
Sample wording (adapt it to your practice)
I, [patient's name], PESEL [number], declare as follows.
☐ I consent to information about my health being given (Article 9(3) of the Act on Patient Rights and the Patient Rights Ombudsman) to: [name, relationship, phone].
☐ I authorize access to my medical records (Article 26(1) of that Act) for: [name, relationship, phone]. Scope: ☐ inspection ☐ transcript or copy ☐ electronic transfer.
☐ I object to disclosure of my records after my death: ☐ to anyone ☐ to: [specify].
I know I can withdraw this statement at any time. Date and patient's signature: [ ].
Authorization for a close person
The Act defines a close person: a spouse, a relative up to the second degree or an in-law up to the second degree in the direct line, a statutory representative, a person living in a de facto cohabiting relationship, or a person designated by the patient (Article 3(1)(2)). While the patient is alive, belonging to that circle is not enough to obtain records, and information about health depends on the patient's consent (Article 9(3) and Article 26(1)). An authorization for "my husband" or "my daughter" is simply a statement in which the patient names those persons.
Does an authorization from another provider apply at your practice
The provisions we rely on do not provide for a statement being carried over between providers: the statement is to be placed in the internal individual records kept by the given provider (§ 8(1) of the regulation). Consent given to a family doctor is therefore not in your file. It is worth offering the form to every new patient at the first visit.
When family calls and the patient has designated no one
The basic rule is refusal. Persons practising a medical profession are bound by confidentiality, and the Act provides a limited list of exceptions (Article 14(2)): where separate statutes so provide, where keeping confidentiality may endanger the life or health of the patient or other persons, where the patient or the statutory representative consents, and where necessary information must be passed to other medical professionals taking part in providing the services. Disclosure may go only as far as necessary (Article 14(2b)). The fact that a caller knows the patient's details, address or phone number is not an exception.
One caveat: the Act on the Physiotherapist Profession also obliges a physiotherapist to give information to the patient or the statutory representative, or to a close person or de facto carer, but only as far as necessary for the services the physiotherapist provides (Article 9(2)), and to keep information related to the patient confidential (point 3). We do not settle how far that duty reaches towards a close person when the patient has decided nothing; we leave that point for a lawyer to verify. It is safest to rely on the patient's statement.
A practical script for reception: *"I understand your concern, but under professional confidentiality I cannot give information about a patient without the patient's consent. Please ask the patient to name you at her next visit."*
Life-threatening situations are rare in a physiotherapy practice, and the exception in Article 14(2)(2) should be applied carefully and preferably with the person running the practice.
Access to records after the patient's death
After the patient's death, medical records are made available to a person authorized by the patient in life or to the person who was the patient's statutory representative at the time of death. They are also made available to a close person, unless another close person objects or the patient objected in life (Article 26(2)). The objection is attached to the patient's records (Article 14(4)).
The Act also provides a court route. In a dispute between close persons the court grants consent in non-contentious proceedings, on the application of a close person or a medical professional, who may also apply when there are justified doubts whether the applicant is a close person (Article 26(2a)). Where the patient objected in life, the court may, on a close person's application, consent and set the scope if this is necessary to claim compensation or redress for the patient's death or to protect the life or health of a close person (Article 26(2b)). The court examines, among other things, the participants' interests, the real bond with the patient, the deceased's will and the circumstances of the objection (Article 26(2c)).
That is why it is good practice to ask about this when collecting the standard statement: a field on objection after death spares difficult conversations at the worst moment.
[SP] Example -- Solo practice: After the phone incident, Beata introduces one change: every new patient gets a statement at the first visit with separate fields for consent to information and for authorization to records. Reception has a clear answer before it picks up the phone.
[GR] Example -- Group practice: In a practice with several therapists and two receptionists, patients' statements go into the patient file, not into individual therapists' notes. Each person at reception checks in one place whether a given person has been designated before answering a call.
When to collect statements and how to log disclosures
The best moment is the first visit, together with the patient record, treatment consent and the GDPR information notice. For a coherent set of documents see our article on GDPR at a physiotherapy practice.
The practice must also keep a log of disclosed records. Article 27(4) of the Act lists what it contains: the patient's name, the manner and scope of disclosure, the name of any person other than the patient to whom the records were disclosed, the name and signature of the person who disclosed them, and the date. We describe it in the article on the register of medical records disclosures, and a patient's request for copies in a request for access to medical records.
Withdrawing the authorization
The Acts do not set a form for withdrawal, but because the statement is kept in the records, it is best to record the withdrawal the same way: in writing, with the date and the patient's signature. From the moment of withdrawal, any contact from the previously designated person must be treated as if that person had never been designated. Reception should work from the current data in the file, not from its own notes.
Frequently asked questions
Does a patient's spouse have automatic access to the patient's medical records?
Not while the patient is alive. A spouse is a close person under the Act (Article 3(1)(2)), but receives records only if the patient authorized access (Article 26(1)), and information about health when the patient consented (Article 9(3)). Exceptions to professional confidentiality are listed in Article 14(2).
Does an authorization signed at a family doctor also work at a physiotherapy practice?
The provisions do not provide for carrying a statement over between providers: the patient's statement is to be placed in the records kept by the given provider (§ 8 of the regulation on medical records). Collect your own statement, preferably at the first visit.
Does an authorization to inspect records also cover collecting copies?
The Act speaks of an authorization for access to records (Article 26(1)) and separately lists the ways records are made available: inspection, transcript, copy or printout, electronic route, data carrier (Article 27(1)). It does not split the authorization into inspection and copy, so write the scope the patient wants to grant on the form.
What should we do if someone claiming to be a patient's relative calls and there is no statement on file?
Refuse to give information, citing professional confidentiality. The exceptions are listed in Article 14(2) of the Act, for example where keeping confidentiality may endanger the life or health of the patient or other persons, and they cover only the necessary scope of information. In other cases ask the patient to make a statement.
Does family have the right to see the records after the patient's death if no authorization was left?
Yes, a close person may obtain access unless another close person objects or the patient objected in life (Article 26(2)). In a dispute between close persons, or where the patient objected, the court decides (Article 26(2a) and (2b)), and the practice may apply to the court when it doubts who is a close person.
Legal status as of: 28 October 2026
Legal basis: Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman (consolidated text Journal of Laws 2024 item 581, as amended by Journal of Laws 2026 items 26 and 791), Articles 3(1)(2), 9(2)-(3), 13-14 and 26-27; Act on the Physiotherapist Profession (consolidated text Journal of Laws 2026 item 584), Article 9; Regulation of the Minister of Health of 6 April 2020 on the types, scope and templates of medical records and the manner of processing them (consolidated text Journal of Laws 2026 item 1391), § 8. We did not check case law, Patient Rights Ombudsman guidance or the rules on the Internet Patient Account beyond what follows from § 8. The reach of Article 9(2) of the Act on the Physiotherapist Profession towards a close person without the patient's statement: for a lawyer to verify.
Last reviewed: 28 October 2026
A patient's intake documentation (record, therapy plan, treatment log, treatment consent) is the foundation of a safe practice. The TARCZA package organizes it from the ground up. See the TARCZA package or compare all packages.
Related articles:
- Documents for a patient's first visit -- the full set
- The patient record in physiotherapy
- GDPR at a physiotherapy practice -- the complete guide
- Register of medical records disclosures