We need test results from a previous hospitalization, we want to consult another doctor or we want to know exactly what information has been entered in our medical record. Can the hospital refuse to give us a copy? Do we need to explain why we are asking for it? And what do we do if we don't get a response?
In Cyprus, the patient's access to his medical record is a guaranteed right. The legislation provides that the patient can be informed about the data kept about his health and receive copies or extracts of the relevant records.
This right is not limited to information displayed electronically through the GHS.
What does the medical record include?
The medical record collects information about the patient's state of health and the services provided.
Depending on the case, it may include medical history, diagnoses, laboratory results, imaging tests, medical opinions, hospitalization details, surgeries, and medication.
The patient may request specific documents or a copy of the file concerning him.
It is not necessary to limit it to one discharge, since more information is needed.
Where do we submit the request?
The first step is to contact the hospital or healthcare professional who keeps the record.
In hospitals we can request information from the competent medical records department or the administration.
In order to have a clear record, it is preferable for the request to be made in writing.
In it, we indicate our identification details, the documents we request and, if known, the dates of hospitalization or examination.
We may also ask them to let us know how we will receive the copies.
The provider may ask for confirmation of our identity to ensure that sensitive medical data is not handed over to an unauthorized person.
Do we need to explain why we are asking for our file?
As a rule, no.
The right to access our personal data does not depend on whether we intend to change a doctor, seek a second opinion, or simply keep a copy of our record.
In fact, Cypriot law explicitly recognizes the right of the patient to request a second medical opinion and to be provided for this purpose with a copy of his medical record, including a medical report.
How long does the hospital have to respond?
Where the request is made within the framework of the right to access personal data, the deadlines provided for in the General Data Protection Regulation (GDPR) apply.
The controller must, as a general rule, reply without undue delay and no later than one month after receipt of the request.
In complex cases, the deadline may be extended by an additional two months, with the applicant being informed within the first month.
Do we have to pay?
Under the GDPR, the first copy of the personal data processed is, as a rule, provided free of charge.
A reasonable fee may be charged for additional copies, which corresponds to the administrative costs.
If the request concerns specific services in addition to providing a copy of existing data, different procedures may apply.
Can the hospital refuse?
The right of access is not absolute, but restrictions must be based on legislation.
The Patients' Rights Act provides for specific cases of restriction of access, including when the disclosure of information is likely to cause serious harm to the patient's health or reveal protected information of third parties.
This does not mean that a hospital can reject arbitrary requests.
If access is restricted, the patient can request to be informed of the legal basis of the decision.
What do we do if we don't get a response?
If the hospital does not respond to the request or we consider that our access has been unduly restricted, we can contact the data protection officer of the provider, where available.
We may also lodge a complaint with the Office of the Commissioner for Personal Data Protection, which is responsible for matters relating to the implementation of personal data protection legislation.
For issues related to the protection of patients' rights in general, the institution of the Patient Ombudsman also operates.
What we need to remember
The medical record contains particularly sensitive information about our health. The fact that records are kept by a hospital or doctor does not mean that the patient is deprived of the right to access them.
We may request copies of our medical data and use them, among other things, to obtain a second medical opinion.
