A Patient Requests Their Medical Records - Step-by-Step Procedure

Aneta, the owner of a physiotherapy practice, got a call on Monday morning from a former patient: she needed a copy of her treatment record because she was starting therapy with a different specialist and wanted her visit history on hand. The receptionist, unsure exactly how to handle it, asked the patient to explain "what she actually needed it for." The patient felt interrogated, and the matter landed on the owner's desk with a question -- did anyone actually need to ask that at all?

No, they didn't -- and that's the first thing worth remembering from this article. A patient's right to their medical records is one of the most firmly established rights in the healthcare system, and a physiotherapy practice has exactly the same obligations in this area as a clinic or a hospital. Below is the full procedure: who can submit a request, in what form, within what deadline, how much it costs, and which mistakes to avoid. If you're looking for information on how to keep a log of such disclosures, see the article on the register of medical records disclosures.

Who has the right to request the records

The right to medical records belongs first and foremost to the patient themselves. But the circle of people entitled to request them is broader:

• The patient -- always, without restriction and without giving a reason.
• The patient's legal representative -- e.g. a child's parent, or the guardian of an incapacitated person.
• A person authorised by the patient -- based on written authorisation, ideally submitted at the first visit and kept in the patient's file.
• Close relatives -- after the patient's death, provided the patient did not object during their lifetime and the person requesting falls within the statutory list of close relatives.

The key rule to remember at the front desk: the practice has no right to demand that the patient justify why they need the records. This is one of the most common violations that happens in practice -- and a topic we'll return to in the section on mistakes.

Forms of disclosing the records

The Act on Patients' Rights and the Patient Ombudsman provides for several equally valid forms of disclosure. The patient chooses the form, and the practice must provide it, as long as it is technically possible.

Access on site

The simplest form -- the patient reviews the records at the practice, in the presence of staff, without taking the original away. A good option when the patient just wants to check a specific entry.

Copy, transcript, or extract

• Copy -- a reproduction of the original (e.g. a scan or photocopy).
• Transcript -- a complete, verbatim rewriting of the contents of the records.
• Extract -- a summary or selected portions of the records, relevant to the purpose for which the patient is requesting them.

Printout

If the records are kept in electronic form (EDM), the practice may issue them as a printout. For more on keeping electronic records, see the article on medical records in physiotherapy.

Electronic data carrier

The records may be handed over on a disc, USB drive, or other data carrier -- in practice, increasingly replaced by secure electronic transfer (e.g. encrypted email or a patient portal).

ICT system (e-health, Patient's Internet Account)

If the practice uses Electronic Medical Records connected to the P1 system, part of the records may be directly available to the patient through their Patient's Internet Account -- with no request required.

Form of disclosure	When to use it	Practical notes
Access on site	Patient wants to check a specific entry	No taking the original away, staff present
Copy / transcript / extract	Patient needs a document for further treatment	The most common form at a physiotherapy practice
Printout from EDM	Records kept electronically	Requires a working system and access permissions
Data carrier / email	Patient prefers a digital version	Make sure encryption and a secure channel are used
Patient's Internet Account / e-health system	Records connected to P1	Patient can access them independently

Structure of the patient's request

A request for medical records has no single, mandated template -- each practice can prepare its own form, as long as it includes the necessary elements. A well-constructed request should include:

1. The requester's details -- name, surname, national ID number (or date of birth), contact details of the patient or the authorised person.
2. The basis of entitlement -- whether the request comes from the patient themselves, a legal representative, an authorised person (with the authorisation attached), or a close relative of a deceased patient.
3. The requested form of disclosure -- access, copy, transcript, extract, printout, electronic carrier.
4. The scope of the records -- the entire treatment history or a selected period / type of documents (e.g. only records from the most recent course of therapy).
5. The method of collection -- in person, through an authorised person, by regular mail, or electronically.
6. The date and signature of the requester.

It's worth having a ready-made paper or electronic form available at reception -- it shortens handling time and reduces the risk that one of the necessary elements gets missed during a phone call. The request and its handling are also worth logging according to the rules described in the article on the register of disclosures, so the practice has a full audit trail in case of an inspection.

Deadlines for fulfilling requests

The law does not set a fixed number of days -- it states that records must be disclosed "without undue delay." That's a flexible formula, but it doesn't mean anything goes. In practice, it's generally accepted that:

• Access on site should be possible practically right away or within a few working days, depending on staff availability.
• A copy, transcript, or extract -- the recommended turnaround is a few working days for simple cases, up to a maximum of 30 days for a heavy workload (e.g. a very extensive treatment history).
• The longer fulfilment takes, the greater the risk that the patient will file a complaint with the Patient Ombudsman -- so it's better to set an internal standard at the practice, e.g. 7 working days, and stick to it.

A good practice is to state the estimated turnaround time directly on the request form, so the patient knows what to expect and the practice has a clear reference point.

Fees for medical records

The rules on charging are governed by Article 28 of the Act on Patients' Rights and the Patient Ombudsman, and the maximum rates are calculated as a percentage of the average monthly salary in the enterprise sector, published by the Central Statistical Office (GUS) and updated quarterly. Approximate maximum rates:

• One page of a copy or printout -- up to 0.00007 of the average salary.
• One page of a transcript or extract -- up to 0.0002 of the average salary.
• Records on an electronic carrier -- up to 0.0004 of the average salary (regardless of the number of pages).

Since the average salary changes every quarter, it's worth checking the exact amounts regularly -- the simplest approach is to do it once a quarter and update the practice's price list.

When the first copy is free of charge

This is the most important rule that practices most often forget: under Article 27a(1) of the Act, the first disclosure of medical records at the request of the patient or their legal representative is free of charge, regardless of the form (access, copy, transcript, extract, electronic carrier). Only subsequent disclosures of the same records may be subject to a fee under the maximum rates described above.

In practice, this means that if a patient asks for a copy of their record for the first time, the practice cannot charge for it -- even if its regulations include a price list. Only the second and subsequent requests for the same records may be chargeable.

When disclosure can be refused

Refusing to disclose records is the exception, not the rule, and it must have a specific basis:

• The requester lacks standing -- the person is not the patient, not a legal representative, not an authorised person, and does not fall within the list of close relatives in the case of a deceased patient.
• Doubts about identity -- the practice has the right to ask for identification before releasing records, especially at in-person collection.
• Missing or expired authorisation -- e.g. the authorisation was withdrawn by the patient.
• The patient's objection expressed during their lifetime -- in the context of disclosing records to close relatives after the patient's death.

A refusal should be documented in writing, stating the specific grounds -- this protects the practice in the event of a complaint.

[SP] Example -- Solo practice: After the incident with her former patient, Aneta makes one change: a ready-made request form is available at reception and online, and the receptionist has clear instructions -- never ask a patient "what for," just ask them to fill out the form and verify their identity. She sends the copy of the record within 5 working days, and the first one is always free.

[GR] Example -- Group practice: At a practice with several therapists, requests for records land with different people -- at reception, with the treating therapist, sometimes by email to the owner. To avoid chaos and missed deadlines, they introduce a single point of contact for handling requests and a shared disclosure register, where each entry records the date of the request, the form, the turnaround time, and the recipient's signature.

The most common mistakes when handling requests

• Demanding a justification from the patient -- asking "what do you need these records for" is not permitted; the patient does not have to explain the reason.
• Overcharging -- charging for the first copy or applying rates higher than the statutory maximums.
• Turnaround times that are too long -- without a clearly set internal deadline, delays and complaints happen by accident.
• No register of disclosures -- without a log, it's hard to demonstrate during a KIF inspection when, to whom, and in what form the records were released. We cover the full rules for keeping such a register in a separate article on the register of medical records disclosures.
• Releasing records without verifying identity -- especially when collected by a third party without checking the authorisation.
• No procedure for long-term storage -- archival records from years ago can be harder to retrieve if the practice hasn't organised them according to the rules described in the article on archiving medical records.

Frequently asked questions

Does a patient have to give a reason for wanting their medical records?

No. A patient's right to access their own medical records does not depend on stating a purpose or justification. A practice has no right to refuse or delay releasing the records for lack of such an explanation, and demanding one from the patient is a common and unnecessary mistake in practice.

Is the first copy of medical records always free of charge?

Yes, under Article 27a(1) of the Act on Patients' Rights, the first disclosure of records at the request of the patient or their legal representative is free of charge, regardless of the chosen form. A fee can only be charged for a subsequent disclosure of the same records, according to the maximum rates set out in the Act.

How much time does a practice have to release medical records?

The law does not set a fixed number of days, only stating that records should be disclosed without undue delay. In practice, an internal standard is recommended, e.g. a few working days for simple cases and up to a maximum of 30 days for very extensive records, so as to avoid complaints to the Patient Ombudsman.

When can a practice refuse to release medical records?

Refusal is permitted only in specific situations, such as the requester lacking a legal basis, doubts about their identity, missing or expired authorisation, or the patient's objection expressed during their lifetime in the context of disclosing records to close relatives after their death. A refusal should always be in writing, stating the grounds.

CTA: Want a ready-made procedure for handling records requests, form templates, and rules for keeping a disclosure register, all in one place? The TARCZA package organises the entire medical records workflow at a physiotherapy practice. See FizjoReady packages →

Related articles:
- Register of medical records disclosures -- how to keep one
- Archiving medical records in physiotherapy
- Medical records in physiotherapy -- what the patient file must include