Practical guide

The patient asks for a copy of her record: deadlines, method, retention

This guide is for whoever receives a request for a copy of the record, in person or by certified email, from a patient or her lawyer. You find the deadlines the texts give, what to hand over and what can be said today about retention for a private practice.

The deadlines: seven days or one month

Law 24 of 2017, article 4, paragraph 2, says that the medical management of the facility, public or private, provides the available health documentation “within seven days of the submission of the request”, preferably in electronic format, and any additions within thirty days. The rule speaks of facilities: whether it also applies to a doctor working alone in her own practice, the text does not say. Under the GDPR (articles 12 and 15) the answer to an access request comes without undue delay and at the latest within one month, extendable by two months if the request is complex, and the extension must be communicated with the reasons within the first month. The GDPR applies to the practice as data controller.

What you hand over

Article 15 GDPR gives the patient confirmation that data are being processed, access to the data and some information: purposes, categories of data, recipients, the envisaged retention period or the criteria used to determine it, the right to lodge a complaint with the Garante. Paragraph 3 provides for “a copy of the personal data undergoing processing”, in a commonly used electronic format if the request is made electronically. Pre-operative photographs are part of it: for the Garante they are health data (decision of 20 June 2024). The code of medical ethics, article 25, asks to make clinical documentation available to the patient, her legal representative or the doctors and institutions she names in writing. The copy must not adversely affect the rights and freedoms of others (article 15, paragraph 4).

How you reply, and what happens if you are late

Communications on the exercise of rights are free of charge, unless requests are manifestly unfounded or excessive (article 12, paragraph 5); for further copies you may charge a reasonable fee (article 15, paragraph 3). If you have reasonable doubts about the identity of the person writing, you may ask for the information needed to confirm it (article 12, paragraph 6). If you do not intend to provide the copy, you must state the reasons within one month and say that the patient may lodge a complaint with the Garante or go to court (article 12, paragraph 4). Silence costs: on 20 June 2024 the Garante fined a surgeon 4,000 euros who had answered a patient's request for her pre-operative photographs 302 days after the request and only after the Garante's invitation, and whose privacy notice did not say how long the data would be kept.

How long you keep it

For a private medical practice, the official sources we read contain no rule that sets a number of years. Such an absence does not prove that the rule does not exist: check with your Ordine and a lawyer. In its decision of 20 June 2024 the Garante says what to do when retention times for health documents are not set by a rule: the controller determines them, for a period no longer than needed for the purposes, and states the period or the criteria in the privacy notice. A formula like “only for the time necessary for the purposes for which they are collected” was judged insufficient, with an order to complete the notice within forty days. How many years to write is your choice, to be justified: the limitation periods of the civil code (ten years, article 2946; five for a tort, article 2947, depending on the relationship with the patient) or the ten years of retroactivity and run-off of the insurance policy (Law 24 of 2017, article 11) are criteria you may cite, not a duty to retain.

If the request comes from a lawyer

A request for a copy of the record is not yet a claim for damages. Ministerial Decree 232 of 2023 defines a “claim” as the written request for compensation made for the first time by third parties, and expressly lists among the facts that are not one “the request for the clinical record”. The thirty days to notify the insurer instead start from the claim for damages (article 5, paragraph 3): if the lawyer's letter also contains that, what counts is the day it arrived. Your policy may impose further obligations: read it.

With Fibonacci

In Fibonacci the patient's file can be exported as a document with personal details, history, treatments, prescriptions, tests, consents and the access log. Photographs are exported separately, decrypted at the moment of delivery, because an encrypted file cannot be opened. In the patient area the patient can review on her own the signed consents, treatments, prescriptions and the documents you have made visible; photos are not there. The reply to the request remains yours: the controller is the practice, the software provides the tools.

To print

The checklist

Note the day the request arrives and who made it.
Verify the identity of the person writing; if the doubt is reasonable, ask for the information needed to confirm it.
Aim to deliver within seven days; under the GDPR the limit is one month.
If you need more time, write to the patient within the first month with the reasons: the maximum extension is two months.
Hand over the complete copy: record, consents, tests and photographs.
If the request is electronic, use a commonly used electronic format.
If you refuse, write the reasons within one month and mention the right to complain to the Garante.
Note the delivery date and what you handed over.
Check that your privacy notice says how long you keep the data, or by which criteria you decide.
If the letter also claims damages, notify the insurer within thirty days.

Sources

This guide explains what the cited laws and literature say. It is not legal advice or a clinical opinion on a case: for those you need your lawyer or a colleague.

Other guides