A patient (also known as a "client") has the right to inspect the data in his medical record. However, the question of how far this right to inspect extends has often been the subject of debate. For example, which data from the file may a patient inspect and which may not? And is it sufficient for the healthcare provider to provide the patient with an overview of certain data, or should he also provide the patient with copies of certain documents? Recently, the Court of Justice of the European Union ("CJEU") issued a ruling clarifying the scope of the right of access to medical records.
The right to inspect medical records follows from the Medical Treatment Agreement Act ("Wgbo"). In principle, a patient has the right to inspect and copy his complete medical file pursuant to Article 7:456 of the Dutch Civil Code. However, the healthcare provider may not provide data from the file if this conflicts with another person's right to privacy.
Not all documents and information held by a healthcare provider cover the medical record. The Wgbo imposes requirements on the content of the medical record: the medical record must contain the data on the patient's health and the treatment performed on the patient, in so far as this is necessary for the proper provision of care to the patient. Personal work notes of the healthcare provider, notes on any incidents, correspondence with the liability insurer and financial information are not part of the medical record.
A patient's right of inspection of his medical data also follows from the AVG. In principle, this right of inspection is broader than the right of inspection under the Wgbo. Indeed, pursuant to Article 15 AVG, a healthcare provider must provide a copy of all personal data processed about the patient if a patient requests it - even when those data are not part of the medical record. In the Netherlands, however, it is not common practice to actually provide copies of documents when requesting access, usually an overview of the personal data processed suffices. Whether that is also considered sufficient in the context of a request for access to the medical file was unclear for a long time. The CJEU therefore recently ruled on the question of what information a healthcare provider must provide in order to comply with a patient's request for inspection.
In this case, a patient suspects that his dentist made errors in his treatment. He is considering holding his dentist liable for this and therefore requests the dentist to inspect his file. Information about possible errors may not fall within the scope of the medical file under the Wgbo, but may have to be provided under the AVG when invoking the right of inspection. The patient in question requests the production of a copy of all medical documents concerning him. The German court thereby questions the scope of the right under Article 15(3) AVG to obtain a "copy" of personal data processed in the context of a medical record and refers this question to the CJEU.
The European Court refers to its earlier judgment of May 4, 2023 (Österreichische Datenschutzbehörde and CRIF, C-487/21, EU:C:2023:369) in which the concepts of "personal data" and "copy" are interpreted broadly. The right of inspection under Article 15 AVG should give the data subject the opportunity to ascertain that the personal data concerning him or her are being processed correctly and lawfully. The copy that the data subject obtains must enable him to effectively exercise his rights under the AVG. The copy must therefore include a faithful and comprehensible reproduction of the personal data processed concerning the data subject. In some cases, this may mean that the controller must also provide the data subject with a copy of extracts from documents or even complete documents.
In the present case, the CJEU builds on this earlier judgment and in particular clarifies what this means in the context of the right of access to a medical record. Because of the sensitive nature of health data, the Court emphasizes the importance of ensuring that access to a medical record is as complete and accurate as possible, as well as comprehensible. Data subjects have the right to access their personal data concerning their health, such as the data in their medical records, which contain information on, for example, diagnoses, examination results, assessments by treating physicians and treatment and interventions performed, according to recital 63 of the AVG. Because this health data generally includes many technical data or images, providing a simple summary or compilation of that data has the risk of omitting or misrepresenting certain relevant data or, in any case, making it more difficult to verify and understand its accuracy and completeness. The Court therefore held that a patient has the right to receive at least an (integral) copy of the data in his medical record.
The Court's judgment makes it clear that the right to a copy when requesting access to the medical file under Article 15 AVG must be interpreted broadly. In principle, providing an overview of data from the medical file will not suffice. In any case, the healthcare provider will have to provide the patient with a one-to-one copy of the personal data listed in recital 63 of the AVG.
Although the right of inspection of a medical file in the Netherlands is also included in specific national (healthcare) legislation (including the Wgbo), the European Court seems to assume in its recent judgment that this right of inspection must be interpreted in the light of the broad right of inspection that follows from Article 15 of the AVG. This does not necessarily mean that the right of access to a medical record is broadened. After all, certain data, such as personal work notes of the care provider and financial information, remain excluded from the medical record. A patient then - secuant to the Wgbo - also does not have the right to inspect that data.
Because a patient already has the right to inspect and copy his complete medical record under the Wgbo, the ECJ ruling will probably entail little change for Dutch practice. However, the healthcare provider will have to keep in mind that it is not sufficient for him to provide a summary, but that in certain cases he must provide one-on-one copies of medical data in order to comply with a patient's request for inspection.
