Legal Conditions of Patients’ Access to Medical Records in Poland

The flow of information contained in medical records can be controlled by implementing appropriate legal and technical procedures and the hospital is protected against costs associated with the loss or release of medical records to unauthor-ised persons. The aim of the article is to analyse the legislative and organisational regulations defining the scope of obligations of healthcare system entities to keep medical records, as well as the effectiveness of tools ensuring the protection of patients’ rights with regard to medical records produced as a result of health care services provided to them. An analysis of the legal state of affairs was carried out (October 2021) regarding the patient’s rights to medical records and access to them, an analysis of the personal and material scope of the right to medical records, including the right to patient privacy and confidentiality in terms of medical records. The analysis of the legal situation regarding medical records and the patient’s right to them concerned the applicable rules regarding access to records during the patient’s life and after death, also in the context of persons authorised by the patient. The results of the analysis dealt with the forms in which the records were made available to persons and entities authorised by the legislation, as well as the consequences of violating patient’s rights to medical records. The results of the analyses made it possible to formulate the following conclusions: the issue of the implementation of the right to documentation is very important and constitutes a fundamental right of the patient. The policy of ensuring access to medical records to authorised entities is an important element of the functioning of a healthcare entity. All participants in the system are obliged to exercise due diligence in respecting the rights and obligations imposed, to ensure security during the processing of medical records kept on various information carriers – paper, electronic, portable carriers. Budgetary resources should


Abstract
The flow of information contained in medical records can be controlled by implementing appropriate legal and technical procedures and the hospital is protected against costs associated with the loss or release of medical records to unauthorised persons.
The aim of the article is to analyse the legislative and organisational regulations defining the scope of obligations of healthcare system entities to keep medical records, as well as the effectiveness of tools ensuring the protection of patients' rights with regard to medical records produced as a result of health care services provided to them.
An analysis of the legal state of affairs was carried out (October 2021) regarding the patient's rights to medical records and access to them, an analysis of the personal and material scope of the right to medical records, including the right to patient privacy and confidentiality in terms of medical records.
The analysis of the legal situation regarding medical records and the patient's right to them concerned the applicable rules regarding access to records during the patient's life and after death, also in the context of persons authorised by the patient.The results of the analysis dealt with the forms in which the records were made available to persons and entities authorised by the legislation, as well as the consequences of violating patient's rights to medical records.
The results of the analyses made it possible to formulate the following conclusions: the issue of the implementation of the right to documentation is very important and constitutes a fundamental right of the patient.The policy of ensuring access to medical records to authorised entities is an important element of the functioning of a healthcare entity.All participants in the system are obliged to exercise due diligence in respecting the rights and obligations imposed, to ensure security during the processing of medical records kept on various information carriers -paper, electronic, portable carriers.Budgetary resources should

Introduction
The issue of the exercise of the right of access to medical records is very important and constitutes a fundamental right of the patient.This right is also linked to the exercise of other rights, such as the right to information, to health services or to be able to make an informed decision about further treatment.The right of access to records must be exercised in such a way that the patient's privacy and intimacy are guaranteed.Any infringement of the patient's right to medical records in terms of restricting the possibility of obtaining them or unduly easing the rules for their release may result in a misuse of the other rights mentioned.
The protection of the patient's intimacy and the secrecy of their medical data is one of the fundamental elements in creating and maintaining trust between the patient and the doctor, which in turn is the foundation of the mutual relationship between these entities that determines the safety and effectiveness of the treatment process and affects the health security of society as a whole.

Material and methods
When discussing the patient's rights to medical records and access to them, it was necessary to analyse the laws and regulations in this area.The aim of the concept of patient's rights is to protect the autonomy, i.e. the freedom of the patient from interference by other actors defined as the negative aspect, and the right to demand the rightful conditions for the realisation of these rights (positive aspect).Two categories of patient's rights are traditionally identified in health policy: 1. rights of a social nature (patient-state/public authority relationship), 2. rights of a subject-related nature (individual rights of the patient).
The catalogue of patient's rights is extensive and includes, among others: Patient's right to information: 1. the patient over the age of 16 and the legal representative of each patient has the right to be informed about their state of health, the diagnosis, and the proposed and possible methods of diagnosis and treatment foreseeable, as well as the results of the treatment and the further prognosis, 2. the patient has the right to present their own opinion to the doctor on the information they have obtained, 3. the right to receive information about the care and nursing treatments to which the patients are subjected, 4. the right to be informed of their rights in writing -information should be displayed at the place where the medical service is provided, 5. the right to information on preventive health programmes that are publicly funded [3].
Patient's right to confidentiality of information that concerns them: 1. the right to maintain the confidentiality of information relating to them which has been obtained in connection with the exercise of the medical profession, 2. medical professionals who provide health services are obliged to maintain confidentiality even after the death of the patient [4].
Patient's right to affirm consent to health services: 1. the right to consent or refuse to consent to specific health services after being informed, 2. consent or objection may be formulated either orally or by specific behaviour which establishes in unequivocal terms the will to submit to the acts proposed by the doctor or the absence of such will [5].
The right to respect for the intimacy and dignity of the patient: 1. the patient has the right to particular respect for their privacy and dignity during the provision of health services, 2. this right includes the right to die in peace and with dignity.A patient who is in a terminal state has the right to services that provide relief of pain and other suffering [6].
Patient's right to medical records: 1. the right of access to medical records which relate to their state of health and in respect of the health services provided to them, 2. medical records should include: patient's name, surname and forename, date of birth, sex, address, PESEL number, name of the health care provider, description of the patient's condition and the services provided, date of preparation of the document, 3. an entity that has provided benefits shall also make medical records available to: other entities providing benefits, if such records are necessary for the continuity of health services, public authorities, as well as the National Health Fund, the minister in charge of health, as well as courts, prosecutors, court-appointed physicians and ombudsmen of professional responsibility, authorities and institutions authorised by separate acts, disability authorities, teams adjudicating on disability, entities that keep registers of medical services, insurance companies, 4. the healthcare provider is obliged to keep medical records for 20 years, with the exception of medical records in the case of death of a patient as a result of injury or poisoning -30 years, X-rays -10 years, referrals for examinations -5 years, medical records of children under 2 years of age -for 22 years [7].

Results
Running, storing and providing access to medical records are a legally required element of conducting medical activity.The definition of medical records is contained in the provision of Article 2(1)(1) of the Medical Activity Act, which indicates that medical records are the records referred to in the provisions of the Act on Patient's Rights.
There is no legal definition of medical records in Poland.It is important to distinguish between the definition of a document and the definition of a medical record, which is understood as "a chronologically ordered collection of data concerning a patient's health and illness and the health services provided to the patient".Medical records are crucial in terms of maintaining continuity of treatment and improving the quality of health services provided [8].The patient has legally guaranteed access to their medical records and may also authorise other persons to do so.The above-described issues are regulated by the provisions on the patient's right to medical records contained in Chapter 7 of the Act on Patient's Rights and are also analysed in this article.
Article 25 of the Act on Patient's Rights indicates the content of medical records: 1. identification of the patient, allowing to determine their identity: a) surname and forename(s), b) date of birth, c) gender designation, d) address of residence, e) the PESEL number, if one has been assigned, in the case of a newborn child, the PESEL number of the mother, and in the case of persons who have not been assigned a PESEL number, the type and number of their identity document, f) where the patient is a minor, totally incapacitated or incapable of giving informed consent, the surname and forename(s) of the legal representative and the address of their residence.2. identification of the healthcare provider indicating the organisational unit where the healthcare services were provided, 3. a description of the patient's state of health or of the health services provided to the patient, 4. date of preparing the document.
The patient's right to medical records is exercised by the healthcare entity on the principles indicated in the Act on Patient's Rights through the obligation to keep, store and make such records available.In accordance with Article 23 of the Act on Patient's Rights, the patient has the right to access the data contained in the medical records in the area of two categories: data on the patient's health condition -information on the diagnosis made, results of tests performed, diagnosis made, data on health services provided.The patient has the right of access to individual and collective records kept in the healthcare unit.In the latter situation, this right may not infringe on the right to privacy of other patients, and access consists in making extracts from the collective documentation concerning the patient making the request (the Supreme Administrative Court of the Republic of Poland in its judgment of 19 May 2003) [9].
The catalogue of persons and entities that can obtain access to a patient's medical records includes two main groups: 1. the patient, the patient's legal representative and the person authorised by the patient, 2. entities indicated in Article 26(3) of the Act on Patient's Rights, among others, entities providing healthcare services, if the documentation is necessary to ensure continuity of healthcare services, disability authorities and disability assessment commissions in connection with their proceedings, or insurance companies (with the patient's consent).
The way in which medical records are made available depends on whether they are electronic records or other records in electronic or paper form [10]. Electronic medical records are made available via the P1 Platform in accordance with the regulations related.The sharing of other medical records is carried out according to the rules described primarily in the Act on Patient's Rights and complementarily in the Regulation on Medical Records [11].According to this Regulation, the following rules for making medical records available are possible: 1. the obligation to make records available with integrity, confidentiality and authenticity without undue delay, 2. where the records are made available in hard copy printout, a person authorised by the originating body shall certify that the printout is in conformity with the records and shall sign it with their forename, surname, position and signature, 3. where paper records are made available by issuing an original against acknowledgement of receipt and subject to return after use, at the request of public authorities or ordinary courts, and where delay in releasing the records could cause a risk to the patient's life or health, the record keeper must retain a copy of the records issued, 4. where it is not possible to grant access to the records, the refusal shall be communicated in electronic or paper form, as requested by the competent authority or body.A statement of the reasons for refusal shall be required in each case.
After the death of a patient, medical records may be made available to the person authorised by the patient during their lifetime or to the person who was the patient's legal representative at the time of death [12].Medical records after the death of a patient are also made available to a close person.A close person within the meaning of the Act on Patient's Rights is: a spouse, a relative up to the second degree, a statutory representative, a person in cohabitation or a person designated by the patient.In the event of reasonable doubt as to whether the person requesting or opposing access to the records is in fact a person close to the patient, then the medical professional acting on behalf of the medical entity to which access to the records has been requested has the right to apply to the court to authorise access to the medical records.However, a healthcare provider will not be entitled to release medical records after the death of a patient to a relative if: 1. the release is opposed by another relative -in the event of a dispute between relatives over the release of medical records, the release is also authorised by the court on the application of the relative or medical professional; 2. access was objected to by the patient during their lifetime -where the patient during their lifetime objected to their medical records being made available to their relatives after their death, then, in special cases, on application by the relatives, the court may, in non-trial proceedings, authorise the release of the records and determine the extent of their release, but only on condition that the release is necessary in order for the relatives to claim compensation or damages, on account of the patient's death, or for the protection of life or health.
The right to inspect medical records may be exercised either by the patients themselves or through persons to whom they have given authorisation.The legislation does not reserve any particular form for the effectiveness of the authorisation.The exercise of the right to inspect medical records does not constitute a legal act, and therefore the granting of 'authorisation to inspect medical records' by a patient to another person is not the granting of a power of attorney within the meaning of Article 95 of the Civil Code.Therefore, authorisation to inspect medical records may be granted by a patient to any person, including a person who does not have full legal capacity [13].
The forms of making medical records available have been specified in the Act on Patient's Rights, and the catalogue of forms of making them available is enumerative.Additionally, if the documentation is maintained in paper form, making scans of this documentation available in accordance with the principles specified in points 4. and 5. depends on introducing such a possibility in the organisational regulations of a given entity.Pursuant to Article 27 of the Act on Patient's Rights, medical records are made available: 1. to be inspected, including in healthcare databases, either at the place where the healthcare services are provided, with the exception of emergency medical treatment, or at the premises of the healthcare provider, with provision for the patient or other authorised bodies or entities to take notes or photographs, by making an extract, copy or printout thereof, 2. by handing over the original against acknowledgement of receipt and subject to return after use, at the request of public authorities or ordinary courts, and where delay in handing over the records could endanger the life or health of the patient, 3. by electronic means of communication, 4. on a digital data carrier.
The original documentation shall be issued only at the clear request of the authorised authority or body.The patient may request the original of the individual internal records and the collective records only to the extent of the entries concerning themselves [14].The obligation to return medical records after their use is not precisely defined, which is justified, as the legislator could not foresee in advance, for example, what kind of proceedings the authorised body would have to deal with for the entity conducting the treatment activity [15].

Discussion
The patient's right to medical records remains one of the most frequently violated patient's rights, and the number of investigations into this matter continues to increase.The Patient's Rights Ombudsman's report on compliance with patient's rights between 1 January and 31 December 2020 indicated that the number of identified violations of this right increased by 45% compared to 2019, with the previous year also showing a significant increase.Therefore, in both years, the degree of non-compliance with this right was assessed to have a medium level [16].
The most common breach of this right took the form of: 1. incorrect medical record keeping; 2. deficiencies in the storage of medical records; 3. inadequate application of the provisions of the Act relating to access to medical records, in particular with regard to the submission of requests for medical records by authorised persons, including the form of such requests; 4. the processing time for requests for medical records [17].
Article 4(1) of the Act on Patient's Rights provides that in the case of a culpable violation of a patient's rights, the court may award the injured party an appropriate sum as monetary compensation for the harm suffered on the basis of Article 448 of the Civil Code.However, paragraph 3 of this provision indicates a catalogue of patient's rights, the culpable violation of which does not give the patient the right to claim compensation.This limitation concerns: the patient's right to keep valuables in the depository of the healthcare provider, the right to information about the type and scope of health services provided by the providers of these health services, the right to report adverse reactions to medical products and the right of access to medical records concerning the patient's health [18].
The right to medical records and access to them has a significant impact on patient satisfaction.Successfully treating a patient is not enough to gain the patient's trust.The patient's opinions and feelings are extremely varied and often change.Learning about patients' opinions makes it possible to detect shortcomings and thus strive to continuously improve the quality of services provided in a medical facility [19].
Nowadays, diagnosing and treating a patient correctly may not be enough, and gaining the patient's trust is of particular importance.The quality of services and its role continues to grow, due to increasing standardisation, but also to the increasingly observed and important individual approach to the patient, as well as increasing patient demands [20].
After using a medical service, the patient can assess the medical service, which has its own particular characteristics, one of the most relevant and significant being the psychological complexity of the process occurring in the medical facility, as well as the stress accompanying the patient [21].An important feature is the interaction between the patient and the medical staff.Consequently, the attitude and behaviour of the medical staff towards the patient is extremely important [22].

Conclusions -recommendations
The issues concerning the processing of medical records, the obligations of public authorities, the National Health Fund and healthcare providers, as well as medical professionals presented in the article, allow to draw the conclusion that the problem of exercising the right to medical records is important and forms a part of the fundamental rights of the patient.
The right of access to medical records is closely linked to the respect of other rights, including the right to information, the right to health services or the right to make an informed decision about further treatment.It should be noted that the right of access to medical records should be exercised in such a way as to ensure patients' sense of privacy and intimacy.Violation of a patient's right to medical records, whether by limiting the possibility to obtain them or by unduly easing the rules on their release, may also result in a misappropriation of the other rights listed.
Another conclusion from the analysis of the legal regulation of medical records and access to them is that the right to privacy may be limited by the right to disclosure of medical data.It is incumbent on the legislator to ensure that those entitled (the patient and/or persons authorised by the patient) are able to exercise their right to access medical records.In this way, through the negative as well as the positive aspect of the obligations, the fullest possible respect of the patient's rights, including the right to medical records, should be sought while ensuring the right to privacy.This is particularly relevant in the context of medical records, which should be kept, collected and made available in accordance with the terms of the law.which prescribes respect for the patient's right to privacy.One of the key elements in building and maintaining trust between the patient and the doctor is the protection of the patient's intimacy and therefore the confidentiality of their medical data, which is the foundation of the interaction between these entities, conditioning the safety and effectiveness of the treatment process.This also has implications for the health security of society as a whole.
Legal regulations on ensuring access to medical records to authorised entities constitute an important element of the functioning of a healthcare entity and should be treated with due attention.They should primarily concern the establishment of a safe, and at the same time free from excessive and unsupported by law, manner of exercising these rights.Taking into account the essence and subject matter of the processed information, its importance for effective diagnostic and therapeutic decision-making, the participants of the system should exercise due diligence in respecting the imposed rights and obligations, ensuring security during the processing of medical records kept on various information carriers -paper, electronic, portable carriers.
The legally defined right to medical records and access to them also has an impact, which is not often emphasised, on the patient's sense of satisfaction and thus also on quality management in medical facilities.
The strategic objective should be to ensure that budgetary resources are invested in the further development of central IT systems that enable the secure collection of medical event information and provide access to it at an appropriate level of security.
The concept of patient's rights is based on the model presented in 1994 by the WHO -Model of the Declaration of the Promotion of Patients' Rights and in the European Charter of Patients' Rights.In Polish legislation, patient's rights are guaranteed in: 1. Constitution of the Republic of Poland of 2 April 1997, 2. ratified international agreements: 1) the 1984 Charter on the Rights of Patients at the initiative of the European Parliament, 2) Declaration of the Promotion of Patients' Rights in Europe, 1994, 3) European Charter of Patients' Rights, 4) International Covenant on Civil and Political Rights of 19 December 1966 [1], 5) Convention for the Protection of Human Rights and Fundamental Freedoms 1950 (ratified by Poland on 02 October 1992) [2], 3. Act of 6 November 2008 on Patient's Rights and Patient's Rights Ombudsman (Act on Patient's Rights), 4. implementing regulations.