The Patient Health Interview - What Data You May Collect and What You May Not
PESEL, conditions, medications, occupation - which data in a health questionnaire is legally required, which is clinically justified and which violates the GDPR data minimization principle.
The health questionnaire before a first visit is one of a physiotherapist's most important tools: a well-taken interview lets you plan therapy safely and catch contraindications. It is also the document where overreach is easiest. Forms circulating online ask about everything: marital status, a spouse's workplace, the medical history of the whole family. And every field is personal data you are responsible for - mostly health data, a special category. The rule is simple: you collect what is needed for safe, effective therapy and for keeping records, nothing more. The full set of documents collected at the start is covered in the article on first-visit documents - here we zoom in on the questionnaire itself.
This article explains which data is legally required, which is clinically justified and which is excess that violates the minimization principle - plus how to design an interview form that holds up at an inspection.
Two layers of the interview - administrative and clinical data
A first-visit form serves two functions at once, and it is worth separating them mentally (and ideally on paper too).
Data required for the medical records
The regulation on the types and scope of medical records defines what the records must contain to identify the patient: surname and first name, date of birth, sex, home address, PESEL number (or, if there is none, the type and number of an identity document), and for a minor also the details of the legal representative. You collect this data not "because it may come in handy" but because the medical records regulations require it.
An important note here: PESEL in medical records is a legal obligation, not overzealousness. Patients sometimes refuse to give it, citing the GDPR - calmly explain that the basis is a legal provision, and without identifying the patient the records cannot be kept properly.
Clinical data - the interview proper
The second layer is the information needed to assess the patient and plan therapy safely:
- Reason for the visit - complaints, their nature, duration, circumstances of onset.
- Past injuries, surgeries and conditions relevant to therapy - e.g. cardiovascular disease, osteoporosis, diabetes, cancer, epilepsy.
- Contraindications to treatments - a pacemaker, metal implants, pregnancy, inflammation, skin lesions - crucial for physical therapy modalities.
- Medications - to the extent relevant, e.g. anticoagulants before manual techniques.
- Previous treatment and rehabilitation - what helped, what did not, physician records, a referral.
- Activity and load - the nature of work (sedentary, physical), sport, ergonomics - to the extent it affects the patient's problem.
This list is not closed - the scope of the interview is set by clinical knowledge, not by law. The GDPR only requires that you can justify why you ask each thing you ask.
The minimization principle in practice - a decision table
| Data item | Collect? | Justification |
|---|---|---|
| Name, date of birth, sex, address, PESEL | Yes - mandatory | Required by the medical records regulations |
| Phone, email | Yes - with the patient's knowledge | Contact about visits; useful, though not mandatory |
| Complaints, injuries, conditions, medications, contraindications | Yes - where relevant | Safety and therapy planning |
| Nature of work, physical activity | Yes - if related | Assessing loads and causes of complaints |
| Occupation and employer name | Carefully | Nature of work yes; company name usually unnecessary |
| Marital status, number of children | As a rule, no | No link to therapy in a typical case |
| Family members' diseases | Only exceptionally | Only when clinically relevant to the specific problem |
| Religion, views, orientation | No | No basis; special-category data unrelated to therapy |
| ID card number "for contact purposes" | No | An identity document only when there is no PESEL |
| Images (posture/body photos) | With separate consent | A diagnostic purpose is possible, but requires an informed decision |
A simple test for every field on the form: "what will the patient's answer change in the therapy?". If nothing - the field is unnecessary and only increases your risk.
The form's format - paper, tablet, online form
The content is half the topic; the other half is the document's flow.
- Paper - simplest, but needs discipline: the questionnaire goes straight into the patient file, not left on the reception counter. The rules are described in the clean desk policy article.
- A tablet or EMR system - convenient and instantly in the records; make sure the system provider has a data processing agreement with you.
- An online form before the visit - saves time, but you are sending the patient a link to a form collecting health data, so: encrypted connection, a form provider under a processing agreement, and no free general-purpose survey tools that store responses outside your control.
Whatever the format, the patient should receive information about the processing when the data is collected - most conveniently in layers, with the full text available on site or on your website. What that information must contain is described in the article on the GDPR privacy notice.
Does the patient have to sign a consent to processing the interview data?
This is one of the most common misunderstandings. For processing health data to provide care you do not collect GDPR consent - the basis is the healthcare purpose combined with the patient rights and medical records regulations. A consent "to the processing of personal data in order to perform the service" is not just unnecessary but misleading: it suggests the patient could withdraw it and you would stop keeping records - which is legally impossible.
Separate consents make sense only where they genuinely are the processing basis: marketing, use of images, commercial communications. And you collect those separately, never in one signature with the interview. Also do not confuse data-processing consent with consent to the treatment - a completely different legal institution.
Example: Ewa inherited from the practice's previous owner an interview form with fields for marital status, occupation and workplace, "family diseases", and a consent to processing data "for all purposes related to the practice's activity". During a GDPR cleanup the form went through a simple audit: marital status and workplace were dropped (a question about the nature of work stayed), family diseases became a targeted question asked verbally only when clinically relevant, and the blanket consent was replaced by a privacy notice plus a separate, voluntary marketing checkbox. The form shrank by half, and patients stopped asking why the practice needed all that data.
The questionnaire and the patient file - where the form ends
The health interview is not a standalone artifact - its result goes into the medical records and becomes part of the patient file. In practice this means three things:
- The questionnaire is part of the records - you store it as long and as securely as the rest of the medical records.
- You update the interview - health changes; in subsequent therapy cycles you note relevant changes (new medications, new diagnoses) instead of relying on a two-year-old questionnaire.
- Questionnaire data carries the same patient rights - access, copies, release on request.
Frequently asked questions
Can a physiotherapy practice require the PESEL number?
Yes - in medical records patient identification includes the PESEL number, and in its absence the type and number of an identity document. This is an obligation under the medical records regulations, not excessive data collection. It is worth being able to explain this to a patient worried about sharing the number.
Does the patient have to sign a consent to processing the health questionnaire data?
No. The basis for processing health data to provide care is the healthcare and medical records legislation, not consent. The patient receives a privacy notice, and separate consents are collected only for additional purposes such as marketing or use of images - always separately, never bundled with the interview.
What must not be asked in a health questionnaire?
Data unrelated to therapy: marital status, the employer's name, family situation, religion or relatives' data "just in case". The test is simple: if the answer changes nothing in planning safe therapy and is not required by the records regulations, the field violates the minimization principle and should disappear from the form.
Can I send the patient a health questionnaire to fill in online before the visit?
Yes, provided security is maintained: an encrypted connection, a tool from a provider with whom you have a data processing agreement, and responses stored under your control. Avoid free, general-purpose survey tools where patients' health data lands on servers outside your oversight and outside the practice's records.
CTA: Want a ready-made, compliant health interview form together with the patient file and GDPR notices? The FizjoReady TARCZA package contains the complete set of first-visit documentation templates tailored to a physiotherapy practice. See FizjoReady packages →
Related articles:
- First patient visit documents - the complete set you must collect
- How to properly keep a patient file in physiotherapy
- The patient privacy notice - what it must contain and where to place it
- Patient consent to physiotherapy treatment - template