Quick answer

Yes. A patient generally has the right to reasonably access and obtain copies of personal and health information held by a hospital, clinic, laboratory, diagnostic center, physician, or other healthcare provider. This right applies to records kept on paper or electronically and to both public and private facilities.

The right comes principally from Sections 16 and 18 of the Data Privacy Act of 2012 and the National Privacy Commission’s rules on data-subject rights. Medical information is sensitive personal information, so the provider may verify identity, use secure release procedures, redact information about other people, and apply lawful exceptions. It should not simply reject a valid request without clearly explaining the legal and factual reason.

Patients are ordinarily entitled to access their information—not necessarily to take the provider’s original chart. Ask for a readable copy, electronic export, inspection, or a certified true copy depending on why the record is needed.

What records may be requested?

A patient may ask for the contents of personal information processed about them. Depending on what the provider maintains, this may include:

Emergency-room and triage records
Admission and discharge records
Medical history and physical-examination findings
Physicians’ orders and progress notes
Nursing notes and medication-administration records
Operative, anesthesia, recovery-room, and procedure records
Consent and refusal forms
Laboratory, pathology, and blood-bank reports
Radiology reports and available image files
Prescriptions and treatment plans
Referral and consultation reports
Discharge summary or clinical abstract
Itemized bills, hospital charges, insurance, HMO, and PhilHealth-related records
Dates on which personal information was accessed or modified
Available information about the sources, recipients, purposes, and manner of processing of the patient’s data

The right is limited to the requesting patient’s own personal data. A facility may redact information identifying another patient, a confidential informant, a relative, or another person where disclosure would improperly affect that person’s rights.

A “medical certificate,” “clinical abstract,” “discharge summary,” and “complete medical chart” are not interchangeable. A certificate or abstract may contain only a summary. If the details matter, state exactly which documents are required or request the complete record for the relevant treatment period, subject to lawful redactions.

Records may also be distributed among separate custodians. A hospital may hold the confinement chart, while an independent doctor, laboratory, imaging center, pharmacy, or HMO holds other records. Send a separate request to each provider that controls the information.

How to make the request

1. Find the correct office

Contact the facility’s:

Health Information Management Department or Medical Records Section;
records custodian;
patient-relations office; or
data protection officer.

Check the provider’s website, privacy notice, patient portal, or Citizen’s Charter. There is no single nationwide filing portal or mandatory request form for all healthcare providers.

2. Make the request in writing

A provider may offer its own form, but the NPC Advisory on Data Subject Rights states that there is no universal form. A request containing enough information to process it should be acted upon even if the provider’s standard form was not used.

Include:

Patient’s full name, including any name used during treatment
Date of birth
Address and reliable contact information
Hospital or patient number, if known
Dates or approximate period of treatment
Department, physician, or type of service
Specific documents requested
Whether a plain or certified true copy is needed
Preferred format and delivery method
Purpose, if it helps identify the proper records
Patient’s signature and date

The provider may reasonably ask for identification. It should collect only what is necessary to verify the requester.

3. Specify the format

State whether the records should be:

inspected on-site;
released as photocopies;
sent as secure PDF files;
exported in an available structured electronic format; or
released as certified true copies.

For imaging studies, request both the written report and the image files in the format maintained by the facility, if available. For court, insurance, employment, migration, or benefits purposes, confirm whether the receiving office requires certification, a dry seal, a custodian’s certification, or a newly issued medical certificate.

The provider may use a secure portal, encrypted file, password-protected attachment, personal pickup, or another reasonable method because medical information requires heightened protection. The NPC has explained that safeguards for telephone inquiries should not be treated as a general requirement for prior approval by the attending physician for every access request. See NPC Advisory Opinion No. 2018-045.

4. Obtain proof of receipt

Ask for a stamped receiving copy, reference number, email acknowledgment, courier tracking record, or portal confirmation. Record the date when all requested supporting documents were submitted because the applicable response period may run from that point.

Sample request

Subject: Request for access to and copies of medical records

I am requesting access to and copies of my medical records under Sections 16 and 18 of Republic Act No. 10173 and applicable National Privacy Commission issuances.

Patient name: Date of birth: Patient or hospital number, if known: Dates of treatment: Department or attending physician:

Please provide the following records: [List the documents or state the relevant scope.]

I request the records in [plain paper copy / certified true copy / secure electronic copy] and prefer release through [pickup / secure email / portal / direct transmission to another provider].

Please acknowledge receipt, advise me promptly of any missing requirement or reasonable copying charge, and identify the expected release date. If any portion is withheld or redacted, please provide the specific reason in writing and release all reasonably separable portions that may lawfully be disclosed.

Name and signature: Contact details: Date:

How long should release take?

Private hospitals and providers

The NPC’s 2021 advisory requires compliance without undue delay and, generally, no later than 30 working days after receipt of the request and the necessary supporting or additional documents.

For a complex or numerous request, the provider may extend the period by up to 15 additional working days, but it must notify the patient or representative of the reason for the extension.

These are maximum periods, not permission to delay every request for 30 working days. Urgent continuity-of-care requests should be identified as such, and NPC Advisory Opinion No. 2018-081 recognizes that restricting or delaying medical-record access can have serious consequences for a patient’s health and life.

Government hospitals

For a government facility, the NPC advisory directs agencies to follow the Ease of Doing Business and Efficient Government Service Delivery Act and its implementing rules.

The hospital’s current Citizen’s Charter should classify the transaction and state its requirements, fee, and processing period. The statutory ceilings are generally:

3 working days for a simple transaction;
7 working days for a complex transaction; and
20 working days for a highly technical transaction.

The period ordinarily begins when the complete requirements and required payment have been received. An allowed extension must follow the law and the Citizen’s Charter, and the requester should receive written notice before the original period expires. A medical-record request is not automatically a three-day transaction; check the facility’s published classification.

May the provider charge a fee?

Generally, a person should not be charged simply for exercising data-subject rights. When copies are requested, however, the provider may charge a reasonable amount covering administrative costs. The fee must not be exorbitant or excessive enough to discourage access.

There is no single nationwide price for every type of medical-record copy. Charges may differ for photocopying, certification, retrieval, storage media, imaging files, courier service, or newly prepared medical certificates.

Ask for:

The written fee schedule
An itemized computation
An official receipt
A less costly electronic or inspection option, if appropriate

A newly prepared certificate or professional medical opinion may involve a different service from copying an existing record and may therefore carry a separate fee.

Who may request the records?

The competent adult patient

The patient may request their own records directly. A spouse, partner, parent, adult child, employer, insurer, or lawyer does not automatically acquire unrestricted access merely because of that relationship or because the person paid the medical bill.

An authorized representative

A patient may specifically authorize another person to make or facilitate the request. The provider may require:

The patient’s signed, specific authorization
Identification of both patient and representative
Documents showing the representative’s authority
Its release or authorization form
Notarization or a special power of attorney where reasonably required by its policy or the circumstances

The authorization should identify the records, recipient, purpose, and permitted delivery method. A special power of attorney is expressly relevant if the representative later files an NPC complaint for the patient.

A minor

Parents or legal guardians generally exercise data-subject rights for a minor, subject to the child’s rights, evolving capacity, the circumstances of treatment, and special confidentiality laws.

Do not assume that every parent is automatically entitled to every confidential record without verification. Custody orders, guardianship, abuse concerns, independently consented treatment, and special statutes may change the result.

For example, the Philippine HIV and AIDS Policy Act contains special rules for consent, confidentiality, disclosure of HIV-related test results, and minors. HIV results are subject to particularly strict release procedures.

An incapacitated or deceased patient

Section 17 of the Data Privacy Act allows lawful heirs and assigns to exercise the patient’s rights after death or when the patient is incapacitated or incapable of exercising them.

The provider may require documents such as:

Death certificate
Birth or marriage certificate
Court order, guardianship document, or other proof of authority
Valid identification
Other documents establishing that the requester is a lawful heir or assign

Being a relative is not always sufficient. Competing heirs, guardianship disputes, a will, or conflicting claims can make the proper recipient a fact-dependent legal question. NPC Advisory Opinion No. 2022-004 explains that succession and guardianship rules may need to be considered.

When may access be limited?

The right of access is strong but not absolute. Any restriction should be lawful, necessary, proportionate, and clearly explained.

Possible limitations include:

Information concerning another person
Repeated, identical, or substantially similar requests already granted, unless a reasonable interval has passed
A request requiring disproportionate effort or resources after reasonable evaluation
Information subject to a valid legal privilege or another confidentiality rule
Processing solely for qualifying scientific or statistical research
Information connected with an authorized criminal, administrative, or tax investigation, to the extent access would prejudice it
National-security restrictions imposed under law or a competent court order
Exceptional cases in which professional evaluation shows that disclosure may cause serious physical, mental, or emotional harm
Records no longer held because they were lawfully disposed of under an applicable retention schedule

A broad inconvenience, an internal disagreement with a contractor, or a routine administrative obstacle is not by itself a sufficient reason to deny the patient’s medical information. If only part of the record is restricted, ask the provider to release the remainder with appropriate redactions.

Mental-health records

The Mental Health Act expressly gives a service user access to clinical records. The attending mental-health professional may withhold information if disclosure would harm the service user’s health or put another person’s safety at risk.

The patient or legal representative may contest that decision before the facility’s internal review board or the Commission on Human Rights. A provider relying on this exception should make an individualized professional determination, not impose a blanket ban on psychiatric records.

HIV-related records

HIV-related information is governed by heightened statutory confidentiality. Disclosure to another person ordinarily requires written consent, subject to narrow exceptions provided by law. Test results must be released through the procedure required by the HIV law, including the applicable rules for minors and counseling.

Court, law-enforcement, and third-party requests

Police officers, employers, schools, insurers, and other third parties do not have blanket access to a patient’s medical records. Disclosure requires the patient’s valid authorization or another lawful basis, such as an applicable statute, court order, search warrant, or subpoena. The scope should be limited to what the authority actually permits.

What if information in the record is wrong?

Access and correction are separate rights. If the record contains inaccurate, incomplete, outdated, or false personal data:

Identify the exact entry, date, and document.
Explain the claimed error.
Attach reliable supporting evidence.
Request correction or an appropriate supplemental entry in writing.
Keep both the original request and the response.

A patient cannot require a provider to erase a documented clinical opinion merely because the patient disagrees with it. Whether an entry should be corrected, retracted, or supplemented depends on its nature, the evidence, professional recordkeeping duties, and applicable retention rules. The provider should preserve the integrity of both original and corrected information where the law requires it.

If the request is delayed or refused

Ask for the decision in writing

Send a written follow-up to the records custodian and data protection officer. State:

The original submission date
The reference number
The complete requirements provided
The applicable deadline
The records still outstanding
Any immediate medical or legal need

Ask for the specific reason, legal basis, expected release date, and release of all portions not affected by the stated restriction. Under NPC guidance, a provider denying or limiting a data-subject right should clearly and fully inform the requester of the reason.

Escalate internally

Use the hospital’s patient-relations, grievance, compliance, privacy, or medical-director process. For a government hospital, consult its Citizen’s Charter and public-assistance or complaints desk.

Consider an NPC complaint

Before filing with the NPC, a complainant ordinarily must:

Inform the provider or other responsible entity in writing of the privacy violation; and
Allow it to take appropriate action.

Under the 2021 NPC Rules of Procedure, as amended, a complaint generally will not be given due course unless the provider failed to take timely and appropriate action or did not respond within 15 calendar days after receiving that written notice. The NPC may waive this requirement for good cause or certain serious violations.

A formal complaint generally requires a verified complaint or completed, notarized complaint-assisted form, supporting evidence, and any witness affidavits. Review the NPC’s current complaint instructions and forms before filing.

Government-service delay

Unexplained delay, extra requirements, or unlisted charges by a government facility may also be raised through its complaints desk and, when appropriate, the Anti-Red Tape Authority’s complaint system. An ARTA complaint addresses government-service compliance; it does not replace an NPC complaint about the substantive right to personal-data access.

Evidence to preserve

Keep:

The original request and every attachment
Proof of submission and receipt
IDs and authorization documents submitted
The provider’s forms and privacy notice
Screenshots of portal submissions and error messages
Reference numbers and acknowledgment receipts
Names, offices, dates, and summaries of calls or visits
Fee quotations and official receipts
Written denials, extension notices, and explanations
Copies in their original electronic format, including metadata where available
Envelopes, courier tracking, and email headers

If a possible medical-negligence, insurance, benefits, employment, or court dispute exists, request records promptly. Consider sending a written preservation notice identifying relevant charts, diagnostic images, consent forms, electronic audit information, and other records. A preservation request does not automatically establish liability or prevent every lawful disposal, but it documents the need to protect potentially important evidence.

Common mistakes

Asking only for a “medical certificate” when the complete chart is needed
Giving no treatment dates, department, or identifying details
Relying solely on a telephone conversation
Failing to obtain proof that complete requirements were received
Assuming the hospital holds records created by every independent physician or laboratory
Requesting records of a competent adult relative without written authority
Sending medical information through an insecure or mistyped email address
Paying an unexplained charge without asking for the fee schedule and official receipt
Waiting until a court, insurance, employment, or benefits deadline is near
Altering, renaming, or overwriting the only electronic copy received
Treating a plain photocopy as a certified true copy when authentication is required
Demanding removal of an unfavorable clinical opinion instead of identifying a provable factual error

When help is urgent

Seek prompt medical or legal assistance when:

A new provider needs the information for immediate treatment
Delay could interrupt medication, surgery, cancer care, dialysis, pregnancy care, or another time-sensitive service
A mental-health-record restriction affects current treatment or safety
Records appear to have been altered, lost, prematurely destroyed, or disclosed without authority
A provider refuses to release any record and gives no written reason
A minor, incapacitated patient, deceased patient, or disputed representative is involved
A court, administrative, insurance, employment, or benefits deadline is approaching
The records may be evidence in a malpractice, criminal, civil, or administrative matter

Do not postpone emergency care while waiting for records. Tell the treating provider what information is missing and authorize direct provider-to-provider coordination where appropriate.

Frequently asked questions

Can a hospital require its own form?

It may use a form to organize and securely process requests. Under NPC guidance, however, a sufficiently informative request should still be acted upon even if the standard form was not used. The provider may reasonably ask the patient to supply missing information or verification documents.

Does the attending doctor always have to approve release?

No general rule makes attending-physician approval a prerequisite for every patient access request. The facility may involve the physician where a specific legal or safety exception is being evaluated, but it must still respect the patient’s statutory rights.

Can records be sent directly to another doctor?

Yes, if the provider offers that method and the patient gives clear authorization. Identify the recipient, address, secure email or portal, scope of records, and purpose. Keep confirmation of transmission.

Can a spouse request the patient’s records?

Not merely because of marriage. A competent adult patient should ordinarily make the request or specifically authorize the spouse. Different rules may apply when the patient is incapacitated or deceased, but proof of lawful authority may be required.

Can the facility redact the record?

Yes, where necessary to protect another person, comply with a special confidentiality rule, or apply another lawful limitation. Ask for the reason and for all reasonably separable information to be released.

Is a provider required to create a record that does not exist?

No. The access right generally concerns information the provider actually processes or holds. A provider may separately offer to prepare a certificate, summary, or professional report, potentially for a reasonable service fee.

What if old records are no longer available?

Ask for a written certification stating that the records cannot be located or no longer exist, the search performed, and—if they were disposed of—the applicable retention or disposal authority and date. The Data Privacy Act does not require indefinite retention merely to answer possible future access requests.

Can access be denied because of an internal system or contractor dispute?

An outsourcing or system dispute does not erase the patient’s rights. The healthcare provider controlling the data remains accountable and should coordinate with its processor or contractor. NPC guidance emphasizes that patients should not be denied access to their medical information because of such arrangements.

Official sources

This article provides general legal information, not legal or medical advice. The correct procedure and result may depend on the records requested, the facility’s lawful policies, the patient’s capacity, special confidentiality laws, and relevant documents. Sources and procedures were checked as of August 10, 2026.