Support Centre

Spain: AEPD publishes report on the scope of the right to access medical history records

The legal cabinet of the Spanish data protection authority ('AEPD') published, on 22 February 2021, a report on the scope of the right to access medical records, as a response to a consultation. In particular, the report highlights that, according to Article 12(5) of the Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights ('LOPDGDD'), the laws are applicable to certain processing activities, which establish a special regime that affects the exercise of the rights provided under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').

In this regard, the report states that the right to access to medical history is regulated under Article 18 of Law 41/2002, of 14 November, regulating patient autonomy and rights and obligations regarding clinical information and documentation ('the Law'), and, therefore, this provision should be followed. Specifically, the report notes that Article 15 of the Law establishes a 'minimum content' that can be accessed by a basic regulator of patient autonomy and of rights and obligations in the field of information and clinical documentation, which may be expanded by other regulatory provisions, such as Section 3 of Law 3/2005, of July 8, on health information and patient autonomy. As a result, the report concludes that the right to access medical records does not include information about who has accessed said records.

You can read the report, only available in Spanish, here.