Quick answer

A hospital generally cannot refuse, without a valid legal reason, to give a patient reasonable access to the patient’s own medical information. Medical and health information is sensitive personal information, but confidentiality protects it from unauthorized disclosure; it ordinarily does not authorize the hospital to conceal it from the patient.

Under Section 16(c) of the Data Privacy Act of 2012, a patient may demand reasonable access to personal information processed by the hospital. This includes the contents of the information, its sources, recipients, manner of processing, reasons for disclosure, and dates of access or modification.

The right is not unlimited. A hospital may verify identity and authority, protect another person’s information, follow lawful restrictions, or explain that particular records no longer exist under an applicable retention policy. Special rules may apply to minors, deceased or incapacitated patients, mental-health records, litigation, and records requested by someone other than the patient. What the hospital should not do is issue a vague or indefinite refusal without identifying the records involved and the factual or legal basis for withholding them.

What patients are entitled to obtain

A request may cover records such as:

Admission and discharge summaries
Medical history and physician progress notes
Operative and anesthesia records
Nursing notes and monitoring sheets
Medication administration records
Laboratory and pathology reports
Radiology reports and, where available, copies of imaging studies
Emergency-room records
Referral and consultation reports
Consent forms
Medical certificates
Information about disclosures of the patient’s data

The Data Privacy Act grants reasonable access to the contents of personal information. It does not necessarily require a hospital to surrender its original paper chart. Hospitals may preserve the original as part of their official records while allowing inspection or providing paper, electronic, authenticated, or certified copies.

A medical abstract, discharge summary, or medical certificate is not always a substitute for the complete portions of the chart requested. If the hospital offers only a summary, the patient should clarify in writing whether the request is for a summary or for specified underlying records.

Section 18 of the Data Privacy Act also recognizes data portability where personal information is processed electronically in a structured and commonly used format. Whether that right applies to a hospital’s particular system and the requested material depends on how the data is stored and processed.

Confidentiality does not normally defeat the patient’s own request

Hospitals have a serious duty to keep medical information confidential. That duty is why they may require identification, a signed authorization, proof of guardianship, or other safeguards before releasing records.

Confidentiality, however, primarily restricts disclosure to unauthorized third parties. It should not be treated as a blanket reason to deny the patient access to information about the patient.

Physician-patient privilege is also different from a patient’s access right. In Chan v. Chan, the Supreme Court discussed privilege in the context of compelling hospital records for use in litigation against a patient who had not waived the privilege. The case does not establish that a hospital may invoke the patient’s privilege against the patient’s own request. See the Supreme Court decision in G.R. No. 179786.

The National Privacy Commission has likewise stated that denying or delaying access to medical information can seriously affect patient care. In a 2025 hospital-records case, the NPC upheld the application of Data Privacy Act access rights and noted that health-information exchange rules do not curtail those rights. See NPC Case No. 21-357.

When a hospital may limit, delay, or refuse access

A restriction may be defensible when it is specific, proportionate, and supported by law or the circumstances. Possible grounds include:

Identity or authority has not been established

Because medical records are sensitive, the hospital may require sufficient proof that the requester is:

The patient;
A specifically authorized representative;
A parent or lawful guardian acting within legal authority;
A court-appointed representative; or
A lawful heir or assign entitled to exercise a deceased or incapacitated patient’s rights.

A spouse, sibling, adult child, employer, insurer, or lawyer does not automatically receive unrestricted access merely because of that relationship or profession. The hospital may require the patient’s valid authorization or another lawful basis for disclosure.

The request includes another person’s confidential information

A chart may contain information about relatives, donors, witnesses, other patients, or persons who supplied information confidentially. The hospital may need to redact or separate that material. This ordinarily supports a tailored limitation, not automatic withholding of the entire record.

A special law restricts disclosure

Certain records receive additional statutory protection. These may include mental-health, HIV-related, reproductive-health, child-protection, or other specially protected information. The proper result depends on the exact law, the requester, the purpose, and any applicable exception.

Restrictions protecting information from third parties should not automatically be assumed to eliminate the patient’s own access rights.

The information falls within a statutory Data Privacy Act exception

Under Section 19 of the Data Privacy Act, specified data-subject rights do not apply when information is used only for scientific or statistical research, no action or decision is taken regarding the person, and strict confidentiality is maintained. The rights also do not apply to personal information gathered for investigations involving the data subject’s criminal, administrative, or tax liabilities.

These are limited exceptions. A hospital should identify how the exception applies to the particular information instead of merely labeling the chart confidential.

The hospital does not have the requested record

The record may be held by an independent doctor, laboratory, imaging center, ambulance provider, or another facility. It may also have been lawfully disposed of after the applicable retention period. Ask the hospital to state:

Whether the record ever existed;
Which entity created or currently holds it;
Whether it was transferred, archived, lost, or destroyed;
The date and basis of any destruction; and
Which requested records remain available.

Mental-health disclosure would create a legally recognized risk

Section 5(r) of the Mental Health Act gives a service user access to clinical records but allows withholding when, in the attending mental-health professional’s opinion, disclosure would harm the service user’s health or put another person’s safety at risk.

This is not an unrestricted discretion. The service user or legal representative may contest the decision before the facility’s internal review board or the Commission on Human Rights.

Special situations

Requests for a minor’s records

A hospital will ordinarily require proof of parentage, legal custody, or guardianship. Where legal custody belongs exclusively to one parent, or a court has appointed a guardian, access may be limited to the person with legal authority.

A child’s maturity, the nature of the treatment, confidentiality protections under special laws, custody orders, and the child’s own rights may affect the result. A parent should not assume that a birth certificate resolves every case, particularly where custody or abuse concerns exist.

Incapacitated patients

Section 17 of the Data Privacy Act permits lawful heirs and assigns to invoke data-subject rights when the patient is incapacitated or incapable of exercising them. The hospital may require documents establishing both the patient’s condition and the representative’s authority.

For mental-health care, the Mental Health Act contains more specific provisions on legal representatives, supported decision-making, advance directives, and temporary impairment of decision-making capacity.

Deceased patients

Death does not make the medical record public. Section 17 allows lawful heirs and assigns to invoke the deceased data subject’s rights, but the hospital may require a death certificate and documents establishing heirship, assignment, or authority to act for the estate.

Disputes among relatives, questions of legitimacy or succession, and requests affecting other people’s privacy may require legal evaluation. Being the person who paid the bill does not, by itself, necessarily establish authority over all records.

Requests by another doctor

The patient may authorize direct transmission to a new physician or facility. The authorization should identify the recipient, the records covered, the purpose, and, when appropriate, the period of validity.

If continuing treatment is urgent, ask both facilities to coordinate immediately and request an interim discharge summary, medication list, recent results, and imaging reports while the full request is being processed.

Records needed for a court case

A patient’s own access request is different from a third party’s attempt to obtain records through discovery or subpoena. Privilege, relevance, confidentiality, court orders, and the Rules of Court may affect litigation disclosure. Do not rely on an ordinary authorization form when records are disputed evidence or subject to a preservation issue; obtain legal advice promptly.

How to make an effective written request

Send the request to the hospital’s Health Information Management or Medical Records Department and copy its Data Protection Officer or privacy office.

Include:

The patient’s full name, birth date, address, and hospital or patient number, if known.
The dates of admission, consultation, procedure, or treatment.
A precise list of records requested.
Whether inspection, electronic copies, ordinary photocopies, authenticated copies, or certified copies are needed.
The intended recipient and secure delivery method.
A copy of the identification the hospital reasonably requires.
If filed by a representative, the authorization, special power of attorney, guardianship order, custody document, or proof of heirship applicable to the case.
The urgency and medical reason, if delay may affect treatment.
A request for acknowledgment, the expected completion date, applicable fees, and written reasons for any denial or redaction.

A useful formulation is:

I am exercising my right to reasonable access under Section 16(c) of Republic Act No. 10173. Please provide the records listed below or permit me to inspect them. If any part cannot be released, please identify the specific record withheld and provide the factual and legal basis for the restriction.

Ask for a stamped receiving copy when filing personally. For email, retain the sent message, attachments, delivery confirmation, and any automated acknowledgment. For registered mail or courier, keep the receipt and proof of delivery.

Is there a fixed deadline for release?

The Data Privacy Act requires reasonable access upon demand, but it does not prescribe one universal number of days for every hospital-record request. The time reasonably needed may depend on the age and volume of the chart, whether it is archived, the form of certification requested, identity verification, required redactions, and clinical urgency.

Do not confuse this with the 15-calendar-day rule for filing an NPC complaint. Under the NPC’s amended procedural rules, a complainant generally must first notify the hospital in writing and give it an opportunity to act. An NPC complaint may proceed when the hospital takes no timely or appropriate action or gives no response within 15 calendar days after receiving that written notice. This is an exhaustion requirement; it is not a blanket rule declaring that every complete chart must be released within exactly 15 days.

The NPC may waive exhaustion for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy, or patently illegal action. See the 2021 NPC Rules of Procedure, as amended in 2024.

Charges for copies

There is no single nationwide price in the Data Privacy Act for every page, certification, storage medium, or imaging copy. Hospitals may have administrative charges, but the patient should ask for:

An itemized estimate;
The hospital policy or legal basis for the charge;
Less expensive electronic or inspection options;
A distinction between copying, certification, professional, and courier fees; and
An explanation of any unusually high or prohibitive amount.

Do not pay an unexplained charge without obtaining an official assessment and receipt. If the amount effectively prevents access, include that fact and the written fee schedule in an escalation to the hospital’s Data Protection Officer or the NPC.

What to do after a refusal or prolonged delay

1. Ask for the refusal in writing

Record the date, employee or office involved, records requested, stated reason, requested requirements, and promised completion date. If the refusal was verbal, send an email summarizing the conversation and ask the hospital to correct any misunderstanding.

2. Escalate internally

Write to the medical-records head, hospital administrator, and Data Protection Officer. Attach the original request and proof of receipt. Ask for a specific decision on each category of record.

If the reason is incomplete identification or authority, cure the deficiency promptly. If the hospital claims confidentiality, ask whose confidentiality would be violated and whether redaction or direct transmission to another doctor would solve the concern.

3. Preserve the evidence

Keep copies of:

All requests, authorizations, and identification submitted;
Receiving stamps, email headers, and delivery receipts;
Hospital forms and written policies;
Replies, rejection notices, and fee assessments;
Names and positions of personnel spoken to;
A dated chronology of calls and visits;
Proof of medical urgency or harm caused by delay;
Proof that the requested records exist; and
Any notice suggesting alteration, loss, transfer, or destruction of records.

If litigation is reasonably anticipated, send a focused written preservation request identifying the records that must not be destroyed or overwritten, including electronic audit logs where relevant. A lawyer can determine whether court processes are needed.

4. File a complaint with the National Privacy Commission

A refusal that may violate data-subject access rights can be brought to the NPC after the required written notice and opportunity to act, unless a waiver of exhaustion is justified.

The amended rules generally require a written, signed, and verified complaint identifying the parties, narrating the material facts, attaching supporting evidence and correspondence, stating the relief sought, and including a certification against forum shopping. A representative ordinarily needs a special power of attorney; special proof rules apply to minors and persons alleged to be incompetent. Filing fees may apply, subject to the stated government, indigency, and discretionary-waiver exceptions.

Use the NPC’s official complaint resources and Complaints-Assisted Form and check the current NPC Rules of Procedure before filing.

5. Raise regulatory concerns with the DOH

If the conduct also concerns hospital licensing, record-management obligations, patient safety, or the operation of a health facility, contact the Regulation, Licensing and Enforcement Division of the Department of Health Center for Health Development that has jurisdiction over the hospital. DOH regional offices publish their own complaint procedures and contact details; for example, the CALABARZON office identifies its health-facility complaint and licensing function.

A DOH complaint and an NPC complaint address different regulatory issues. Filing with one agency does not guarantee that it has jurisdiction over every part of the dispute.

6. Consider legal assistance

A lawyer may assess possible administrative, civil, criminal, contractual, evidentiary, or professional remedies. The correct remedy depends on the reason for refusal, the harm caused, the records involved, and whether a court case is pending or contemplated.

Patients who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility and merits requirements, or with an accredited legal-aid organization.

When help is urgent

Act immediately when records are needed for:

Emergency or time-sensitive treatment;
Surgery, dialysis, chemotherapy, pregnancy care, or continuation of essential medicine;
Transfer to another facility;
A rapidly approaching court, insurance, employment, or benefits deadline;
Investigation of suspected medical error, alteration, or loss of records;
A child-protection or domestic-violence matter;
An incapacitated or detained patient;
A threatened destruction or routine deletion date; or
A mental-health decision that may endanger the patient or another person.

For immediate treatment, do not wait for a legal complaint to be resolved. Ask the attending physician or receiving facility to request an urgent clinical handoff, and seek emergency care when medically necessary. Request the most critical materials first: diagnosis, allergies, medication list, recent results, discharge summary, operative report, and imaging findings.

Common mistakes to avoid

Making only verbal follow-ups and keeping no proof of the request.
Asking for “all records” without dates, encounters, or categories.
Assuming a medical certificate or abstract contains the complete chart.
Sending an unauthorized relative without adequate written authority.
Posting confidential records or disputes publicly on social media.
Treating a 15-day NPC exhaustion period as a universal release deadline.
Demanding the original physical chart instead of inspection or copies.
Ignoring redactions that remove the patient’s own information without explanation.
Signing a broad waiver or release without understanding its scope.
Waiting until a medical, insurance, or court deadline is about to expire.
Filing an NPC complaint without the prior written notice, supporting correspondence, verification, or certification against forum shopping.
Assuming that an unpaid account automatically cancels data-subject rights.

An outstanding hospital bill and access to personal data are distinct issues. The hospital may pursue lawful collection remedies, but it should identify a valid legal basis if it claims that nonpayment justifies withholding requested medical information. The Supreme Court has separately held that a hospital ordinarily may not physically detain a patient solely for nonpayment, while preserving the hospital’s right to collect through lawful remedies. See Manila Doctors Hospital v. Chua, G.R. No. 150355.

Frequently asked questions

Can the hospital release my records to my spouse or child?

Not automatically. The hospital may require your specific written authorization or another lawful basis. Different rules apply if you are incapacitated or deceased and the requester proves legal authority.

Can I request records from many years ago?

Yes, but availability depends on whether the hospital still lawfully retains them. Ask for a written explanation if the hospital says they were archived, transferred, lost, or destroyed.

Can the hospital give me only a medical abstract?

It may provide an abstract when that is what was requested, but an abstract may not satisfy a request for specified underlying personal information. Restate the exact records required and invoke the right to reasonable access under Section 16(c).

Can the hospital redact part of the chart?

Sometimes. Redaction may be appropriate to protect another person’s confidential information or comply with a special law. Ask the hospital to identify the category of information removed and the basis for the redaction.

Can I demand correction of a wrong diagnosis or entry?

You may dispute inaccurate or erroneous personal information and request correction under Section 16(d) of the Data Privacy Act. A correction right does not necessarily require a clinician to erase a genuinely held professional assessment. The hospital may preserve the original entry, correction, and audit trail while accurately recording the dispute or later clinical finding.

Can mental-health records be withheld from the patient?

Only under the specific Mental Health Act standard: the attending mental-health professional must believe disclosure would harm the service user’s health or put another person’s safety at risk. The decision may be contested before the facility’s internal review board or the Commission on Human Rights.

Does a subpoena always override medical confidentiality?

No. The validity, scope, relevance, privilege issues, and issuing authority must be examined. A hospital should respond through lawful procedures, and affected parties may need prompt legal advice.

Can I go directly to the NPC?

Usually, first notify the hospital in writing and allow it to address the violation. If it gives no response within 15 calendar days or takes no timely or appropriate action, an NPC complaint may be pursued. The NPC may waive exhaustion in qualifying serious or urgent circumstances.

Official legal references

This article provides general legal information, not legal advice or a prediction of the outcome of any case. Rights and remedies can depend on the patient’s status, the requested documents, hospital policies, special confidentiality laws, court orders, and proof of authority. Official sources were checked as of September 5, 2026.