Yes. In the Philippines, a private clinic can release medical records to the patient because the information in those records is the patient’s personal and sensitive personal information. But “release” usually means giving the patient a copy, medical certificate, clinical abstract, laboratory result, imaging report, prescription record, or other relevant reproduction—not surrendering the clinic’s original file. The clinic must also verify the requester’s identity, protect confidentiality, and avoid releasing records to spouses, relatives, employers, insurers, schools, or lawyers unless there is valid authority or a legal basis.
For many patients, the problem is practical: the clinic says “confidential,” “doctor is unavailable,” “records are property of the clinic,” “you still have an unpaid balance,” or “we cannot release without management approval.” Some of these concerns are legitimate, but they do not erase the patient’s right to access their own health information.
This article explains when a private clinic may release medical records to a patient in the Philippines, what laws apply, what documents are usually required, how to request records properly, what clinics can lawfully withhold, and what to do if a clinic refuses.
The short answer: a patient has the right to access their own medical records
A patient in the Philippines generally has the right to:
- View the contents of their medical records
- Request copies of relevant medical records
- Receive a medical certificate upon request
- Ask for correction of inaccurate personal information
- Know how their personal and health data is being processed
- Authorize another person to obtain records on their behalf
This right is recognized under the Data Privacy Act of 2012, Republic Act No. 10173, Department of Health patient-rights issuances, and the broader Philippine legal principles protecting privacy, confidentiality, and access to personal information.
However, the clinic also has duties. A private clinic must not casually hand out records to anyone who asks. Medical records contain sensitive personal information, which includes information about a person’s health. Because of this, the clinic must check identity, require proper authorization when a representative is involved, keep a release log, and disclose only what is appropriate for the purpose.
In simple terms:
| Requester |
Can the private clinic release medical records? |
Usual requirement |
| Patient requesting their own records |
Yes |
Valid ID and written request |
| Parent of a minor patient |
Usually yes |
Parent’s ID, child’s details, proof of relationship if needed |
| Authorized representative |
Yes |
Authorization letter or Special Power of Attorney, valid IDs |
| Spouse or adult child of a living adult patient |
Not automatically |
Patient’s written consent or legal authority |
| Employer, school, insurer, or agency |
Not automatically |
Patient’s consent, contract requirement, law, subpoena, or other legal basis |
| Police or investigator |
Not automatically |
Court order, subpoena, search warrant, or specific legal authority |
| Heirs of a deceased patient |
Possible in proper cases |
Proof of relationship, death certificate, purpose, and clinic review |
Why medical records are confidential but still accessible to the patient
“Confidential” does not mean “hidden from the patient.” It means the clinic must protect the record from unauthorized access or disclosure.
A patient’s medical record may include:
- Consultation notes
- Diagnosis
- Laboratory and imaging results
- Prescriptions
- Referral letters
- Vaccination records
- Procedure notes
- Medical certificates
- Clinical abstracts
- Consent forms
- Billing details
- Hospital or clinic summaries
- Psychiatric or psychological notes
- HIV, reproductive health, mental health, or other highly sensitive information
Under Philippine data privacy law, health information is sensitive personal information. This gives the patient stronger privacy rights, while also requiring the clinic to apply stricter safeguards.
So the correct balance is this:
- The patient has a right to access their own medical information.
- The clinic has a duty to verify and protect the information.
- The original record normally stays with the clinic for legal, medical, audit, and continuity-of-care purposes.
- The patient is usually given a copy, abstract, certificate, or reproduction of relevant portions.
Legal basis for releasing medical records to the patient
Data Privacy Act of 2012: the patient is the data subject
The most important law is the Data Privacy Act of 2012, Republic Act No. 10173.
Under the Data Privacy Act, the patient is the data subject, meaning the individual whose personal information is processed. A clinic is usually a personal information controller, meaning it determines how and why patient data is collected, stored, used, and disclosed.
The law gives the data subject the right to reasonable access, upon demand, to the contents of personal information processed about them. This includes information such as:
- The contents of the personal information processed
- The sources of the information
- The recipients to whom the information was disclosed
- The reasons for disclosure
- The date the information was last accessed or modified
- The identity and contact details of the personal information controller
For a private clinic, this means a patient can make a proper access request for their own medical records. The clinic should not treat the request as a favor. It is a legal right, subject to reasonable procedures and lawful limitations.
Health information is sensitive personal information
Section 13 of the Data Privacy Act treats health-related information as sensitive personal information. Processing sensitive personal information is generally prohibited unless a lawful basis applies.
In a clinic setting, common lawful bases include:
- The patient gave specific consent.
- Processing is necessary for medical treatment.
- Processing is necessary to protect life and health.
- Processing is required by law or regulation.
- Processing is necessary for legal claims or court proceedings.
- Processing is carried out by a medical practitioner or medical treatment institution with adequate protection.
When the patient requests their own record, the clinic is not “violating confidentiality” by releasing it to the patient after proper verification. The clinic is allowing the data subject to exercise a legal right.
DOH-recognized patient rights
The Department of Health has long recognized patient rights in health facilities. In 2024, the DOH Health Facilities and Services Regulatory Bureau posted Department Circular No. 2024-0138, reiterating the official version of the Patient’s Rights and requiring posting in strategic areas of health facilities.
DOH patient-rights materials recognize that a patient has the right to privacy and confidentiality of medical records and the right to see or get a copy of medical records, except records restricted by law.
In practical terms, private clinics should have an internal procedure for patient requests. Even a small clinic should know how to receive, verify, process, and document a request for records.
Civil Code protection of privacy
Article 26 of the Civil Code of the Philippines, Republic Act No. 386, provides that every person must respect the dignity, personality, privacy, and peace of mind of others. It also recognizes civil remedies for acts that invade privacy or disturb private life.
This matters because medical records are deeply private. Improper disclosure can expose the clinic, physician, or staff to civil liability, especially if the disclosure causes humiliation, discrimination, reputational harm, employment issues, insurance problems, family conflict, or emotional distress.
Physician-patient privilege in court
Medical records may also be protected by physician-patient privilege in civil cases. In Chan v. Chan, G.R. No. 179786, July 24, 2013, the Supreme Court discussed the privileged nature of hospital records and physician-patient communications. The Court explained that the rule encourages patients to be open with their doctors and prevents compelled disclosure of privileged medical information without the patient’s consent in covered situations.
You can read the decision on the Supreme Court E-Library page for Chan v. Chan.
This doctrine is important when third parties ask for records, especially in litigation. But it does not prevent the patient from requesting their own records.
Special laws for highly sensitive medical information
Certain types of health information have additional protection.
For example, the Philippine HIV and AIDS Policy Act, Republic Act No. 11166, gives strong confidentiality protection to HIV-related information. Unauthorized disclosure of HIV status or HIV-related records can have serious legal consequences.
The Mental Health Act, Republic Act No. 11036, also protects the rights, dignity, and confidentiality of persons using mental health services.
These laws do not mean the patient can never access their own information. Rather, they mean clinics must be especially careful in verifying identity, documenting consent, and limiting disclosures to authorized persons.
What kind of medical records can a patient request?
A patient may request records that relate to their own care. Depending on the clinic, these may include:
| Type of record |
Common examples |
Usually released as |
| Consultation record |
Date of visit, complaints, findings, diagnosis, treatment plan |
Clinical abstract or copy |
| Laboratory result |
Blood test, urinalysis, swab test, pathology report |
Printed or electronic result |
| Imaging record |
X-ray, ultrasound, CT scan, MRI report |
Report, film, CD, digital copy |
| Prescription record |
Medicines prescribed, dosage, date |
Prescription copy or certificate |
| Procedure record |
Minor surgery, wound care, dental procedure, cosmetic procedure |
Procedure note or certificate |
| Medical certificate |
Fitness to work, illness, confinement, consultation |
Signed medical certificate |
| Billing and payment records |
Official receipts, statement of account |
Copy of receipt or billing statement |
| Referral records |
Referral to specialist or hospital |
Referral letter copy |
| Vaccination records |
Vaccine type, date, batch if recorded |
Vaccination certificate or card copy |
A clinic may not always give the patient the doctor’s handwritten raw notes in the exact format requested, especially if the notes contain third-party information, internal quality comments, or material restricted by law. But the clinic should provide meaningful access to the patient’s medical information through copies, summaries, or relevant extracts.
Does the clinic have to give the original medical record?
Usually, no.
The clinic commonly keeps the original medical record because it is part of its official health documentation. The original may be needed for:
- Continuity of care
- Regulatory compliance
- Defense against malpractice or administrative complaints
- Insurance audit
- PhilHealth, HMO, or billing review
- Court proceedings
- Professional accountability
- Medical history if the patient returns
The patient is normally entitled to a copy or reproduction, not the physical original.
This is why a clinic may say: “We cannot release the original chart, but we can issue a certified true copy, medical certificate, clinical abstract, or laboratory result.” That is generally reasonable.
Can the clinic charge a fee?
Yes, a clinic may usually charge a reasonable reproduction or administrative fee, especially for:
- Photocopying
- Printing
- Certification
- Scanning
- Retrieval from archives
- Digital storage device
- Medical abstract preparation
- Doctor’s certification or review time
The fee should not be abusive or used to defeat the patient’s right of access. In practice, simple lab results or medical certificates may be released for a modest fee, while older archived records, certified copies, or detailed abstracts may cost more.
A good clinic should be able to explain:
- What the fee covers
- When the record will be available
- Whether the patient can get an electronic copy
- Whether the record must be picked up personally
- Whether a representative may claim it
Can a clinic refuse to release records because the patient has unpaid bills?
As a general rule, a patient’s access to their own medical information should not be denied merely because of unpaid bills.
DOH-recognized patient rights state that a patient may obtain reproduction of pertinent parts of the medical record at the patient’s expense, even if financial obligations have not been fully settled. The clinic may still collect unpaid professional fees, procedure fees, or other lawful charges through proper means, but withholding essential records can create legal and ethical problems, especially where the records are needed for continuing treatment, insurance claims, employment, travel, or legal compliance.
A practical distinction is important:
- The clinic may charge a reasonable copying or certification fee.
- The clinic should not use unrelated unpaid bills as a blanket reason to deny access to the patient’s own health information.
Step-by-step guide: how to request medical records from a private clinic
1. Identify exactly what you need
Before making the request, be specific. Clinics process requests faster when the patient identifies the exact document.
Instead of saying:
“Please give me all my records.”
Say:
“Please provide a copy of my consultation record, diagnosis, prescription, laboratory results, and medical certificate for my visits on March 10 and March 17, 2026.”
Common request wording:
- “Clinical abstract”
- “Medical certificate”
- “Copy of laboratory results”
- “Copy of ultrasound report”
- “Certified true copy of my medical record”
- “Treatment summary”
- “Certificate of consultation”
- “Prescription history”
- “Procedure record”
- “Billing statement and official receipt”
2. Prepare a written request
A written request protects both the patient and the clinic. It creates a paper trail and reduces misunderstanding.
Your request should include:
- Full name of patient
- Date of birth
- Contact number and email
- Address, if needed
- Date or period of treatment
- Name of doctor, if known
- Type of record requested
- Purpose of request
- Preferred format: printed, scanned PDF, email, pickup
- Signature of patient
- Date of request
A simple request may look like this:
I am requesting a copy of my medical records relating to my consultation and treatment at your clinic on [date/s], including my consultation notes or clinical abstract, diagnosis, prescription, laboratory results, and medical certificate. I am the patient and data subject. I am attaching a copy of my valid ID for verification. Please let me know the applicable reproduction or certification fee and expected release date.
3. Attach a valid ID
Clinics normally require a government-issued or recognized ID to confirm identity.
Commonly accepted IDs include:
- Philippine passport
- Driver’s license
- UMID
- PhilSys National ID or ePhilID
- PRC ID
- Postal ID
- Voter’s ID
- Senior citizen ID
- PWD ID
- Alien Certificate of Registration card, for foreigners
- School ID, for students, depending on clinic policy
For electronic requests, the clinic may ask for a scanned ID, selfie verification, or pickup in person. This is not necessarily harassment. It is part of protecting medical confidentiality.
4. Submit the request to the proper clinic channel
Depending on the clinic, submit the request to:
- Reception or records section
- Clinic administrator
- Attending physician’s secretary
- Data Protection Officer or privacy contact
- Official clinic email
- HMO or company clinic coordinator, if applicable
Avoid sending sensitive medical information through unofficial social media accounts or personal staff accounts unless the clinic specifically uses that channel and provides safeguards.
5. Ask for a receiving copy or acknowledgment
For in-person requests, bring two copies and ask the clinic to stamp or sign one copy as received.
For email requests, keep:
- Sent email
- Attachments
- Auto-reply or acknowledgment
- Follow-up emails
- Any promised release date
This is important if you later need to complain to the clinic management, the National Privacy Commission, the DOH, or a professional regulatory body.
6. Pay the reasonable fee, if any
Ask for an official receipt if you pay a fee.
If the fee seems excessive, ask for a breakdown. The clinic may charge for reproduction and certification, but the amount should be reasonable in relation to the work required.
7. Claim the record securely
When claiming records, bring:
- Original valid ID
- Claim stub or acknowledgment, if any
- Official receipt, if already paid
- Authorization documents, if claiming for someone else
If records are sent by email, the clinic may use password-protected PDF files, encrypted links, or separate password transmission. These are good privacy practices.
Required documents for common situations
| Situation |
Documents usually needed |
| Patient personally requests own records |
Written request, valid ID, payment for copy/certification fee |
| Representative claims records for patient |
Patient’s authorization letter or SPA, patient’s ID, representative’s ID |
| Parent requests records of minor child |
Parent’s valid ID, child’s details, child’s birth certificate if relationship is not clear |
| Guardian requests records |
Valid ID, proof of guardianship or authority |
| Spouse requests adult patient’s records |
Written consent from patient, IDs of patient and spouse; marriage certificate may be requested but is not enough by itself |
| Heir requests deceased patient’s records |
Death certificate, proof of relationship, valid ID, purpose of request, possible affidavit or SPA among heirs |
| Lawyer requests records |
SPA or written authorization from patient, lawyer’s ID or details, patient’s ID |
| Employer requests records |
Patient’s written consent or lawful basis; employer request alone is usually insufficient |
| Insurance company requests records |
Patient’s consent, claim form authorization, policy-related documents |
| Embassy or foreign authority needs records |
Patient’s request, clinic-issued certificate or records; notarization/apostille may be needed depending on use |
How long does it usually take?
There is no single fixed timeline for all private clinics, but in practice:
| Type of request |
Common timeline |
| Recent laboratory result |
Same day to 3 working days |
| Medical certificate for recent consultation |
Same day to 3 working days |
| Clinical abstract |
3 to 10 working days |
| Certified true copy of records |
3 to 15 working days |
| Archived old records |
1 to 4 weeks, depending on storage |
| Records requiring doctor review |
Depends on doctor availability |
| Hospital-based clinic records |
Often longer due to records department process |
Common causes of delay include:
- The attending doctor is unavailable to sign or validate the certificate.
- The record is archived off-site.
- The clinic changed management or system provider.
- The patient’s name was misspelled or encoded differently.
- The request is too broad.
- The patient used a different name, married name, nickname, or foreign name format.
- The record contains information about third parties.
- The request involves psychiatric, HIV-related, reproductive health, medico-legal, or highly sensitive records.
- The clinic has no clear data privacy process.
A reasonable follow-up is usually appropriate after 3 to 5 working days for simple records and after 10 working days for more complex records.
Can a representative request records for the patient?
Yes, but the clinic should require proof of authority.
For ordinary requests, an authorization letter may be accepted. For more sensitive records or where the patient is abroad, the clinic may require a Special Power of Attorney, often called an SPA.
The authorization should clearly state:
- The patient’s full name
- The representative’s full name
- The specific records requested
- The purpose of the request
- The authority to receive, sign, and claim the records
- The date and signature of the patient
- Copies of valid IDs of both patient and representative
For Filipinos abroad, the clinic may ask for:
- A notarized SPA
- A consularized SPA, if executed before a Philippine Embassy or Consulate
- An apostilled document, if executed in a country that is a party to the Apostille Convention
- A copy of the patient’s passport or valid ID
Whether apostille or consularization is needed depends on where the document was executed and the clinic’s risk policy. For many routine requests, some clinics accept a scanned signed authorization plus video or email verification. For sensitive, disputed, or medico-legal records, clinics are stricter.
Can a spouse get the patient’s medical records?
Not automatically.
This is one of the most common mistakes in the Philippines. A husband, wife, parent of an adult child, sibling, or adult child may believe they have an automatic right to medical records because they are family. For a living adult patient of sound mind, the safer legal rule is: get the patient’s consent.
A spouse may be allowed to receive information in limited practical situations, such as emergency care or when the patient has chosen the spouse as the contact person. But for formal release of records, the clinic should normally ask for written authorization from the patient.
This is especially important for records involving:
- Pregnancy
- Sexually transmitted infections
- HIV
- Mental health
- Substance use
- Reproductive health
- Domestic violence
- Psychiatric treatment
- Sensitive diagnoses
- Marital disputes or annulment cases
A marriage certificate alone does not give a spouse unlimited access to the other spouse’s medical records.
Can parents get the medical records of their child?
For minor children, parents or legal guardians can usually request the child’s medical records because they have parental authority and responsibility for the child’s care.
However, clinics may apply extra care where:
- The parents are separated and custody is disputed.
- A court order limits parental authority.
- The child is close to majority age and the matter involves sensitive services.
- The record involves abuse, violence, sexual health, mental health, or other protected matters.
- Releasing the record may place the child at risk.
For adult children, parents no longer have automatic access. The adult child’s written consent is generally required.
Can foreigners request medical records from a Philippine private clinic?
Yes. Foreign patients in the Philippines have the same basic right to request their own medical records from a private clinic.
Foreigners should be ready to present:
- Passport
- ACR I-Card, if applicable
- Clinic patient number, if available
- Dates of consultation or treatment
- Email or foreign address
- Authorization documents if a representative will claim the records
If the records will be used abroad, ask the receiving country or institution what format it requires. A Philippine clinic record may need:
- Doctor’s signature
- Clinic letterhead
- Clinic contact details
- PRC license number of the physician
- Notarized affidavit or certification, in some cases
- Apostille by the Department of Foreign Affairs, if the document must be used in another Apostille Convention country
A common practical problem is that DFA apostille generally applies to notarized or properly authenticated documents, not merely any clinic printout. If the record will be used for immigration, insurance, school, employment, or court abroad, ask the foreign institution exactly what it needs before requesting the clinic document.
Can the clinic send records by email or messaging app?
Yes, but it must be done securely and with proper verification.
Email release is common for laboratory results, telemedicine records, medical certificates, and overseas patients. But because medical information is sensitive, clinics should use reasonable safeguards such as:
- Sending only to the patient’s verified email
- Password-protecting files
- Sending the password through a separate channel
- Avoiding group emails
- Confirming identity before sending
- Keeping a release log
- Avoiding unnecessary details in the email subject line
- Getting written authorization before sending to a third party
Messaging apps are convenient but risky. A clinic should be careful when sending records through Viber, Messenger, WhatsApp, or SMS because phones may be shared, stolen, or misaddressed. Patients should also avoid asking clinic staff to send records through personal accounts if an official channel is available.
When can a private clinic refuse or limit access?
A clinic should not deny access arbitrarily. But it may lawfully refuse, delay, redact, or limit release in certain situations.
The clinic cannot verify the requester’s identity
If the requester cannot prove they are the patient or an authorized representative, the clinic should not release the record.
This is a legitimate reason to pause the request.
The requester is a third party without consent
A spouse, employer, lawyer, police officer, school, insurer, or relative cannot simply demand records without consent or lawful authority.
The record includes third-party information
If the medical record contains information about another person, the clinic may need to redact that part before release.
Example: A psychiatric note contains statements about family members, a partner, or another identifiable person. The clinic may release the patient’s own clinical information while protecting third-party details.
The request is vague or overly broad
A request for “all records ever made by your clinic” may take longer. The clinic may ask the patient to narrow the request by date, doctor, procedure, or purpose.
The record is restricted by law or requires special handling
HIV-related, mental health, reproductive health, medico-legal, child protection, violence against women and children, or psychiatric records may require stricter review.
The record no longer exists because the retention period expired
Clinics are not expected to keep every record forever. Retention depends on law, regulation, professional standards, and clinic policy. However, a clinic should not falsely claim that records are unavailable if they still exist.
The request is clearly fraudulent, malicious, or unauthorized
A clinic may refuse release if there are signs of identity theft, forged authorization, family conflict, litigation abuse, or coercion.
What if the clinic says “medical records are clinic property”?
This statement is only partly correct.
The clinic may own or control the physical chart, software system, paper file, or original record. But the health information inside the record concerns the patient. Under the Data Privacy Act, the patient has rights over their personal data.
A better explanation is:
- The original file remains with the clinic.
- The patient may access or obtain a copy of their own information.
- The clinic may charge reasonable reproduction fees.
- The clinic must protect confidentiality.
- The clinic should not use “ownership” as a blanket excuse to deny access.
What if the doctor refuses to sign a medical certificate?
A doctor should not issue a false or misleading medical certificate. If the requested certificate goes beyond what the doctor personally knows or what the records support, the doctor may properly refuse or limit the certificate.
For example, a doctor may refuse to certify:
- That the patient was sick for dates when the patient was not examined
- That the patient is fit for heavy work without proper evaluation
- That an injury was caused by a specific person if the doctor cannot determine that
- That a condition is permanent without adequate basis
- That the patient has no mental health condition without appropriate assessment
But the clinic should still release appropriate records, such as consultation date, diagnosis, treatment given, and test results, if properly requested by the patient.
What if the clinic lost the records?
If a clinic lost records, it should not ignore the patient. It should explain the situation and, where possible, provide alternatives such as:
- Certification that the patient consulted on certain dates
- Available billing or appointment records
- Laboratory results from the lab system
- Prescription copies
- Doctor’s summary based on available information
- Incident explanation if the loss may involve a data breach
If loss, unauthorized access, or improper disposal of sensitive personal information occurred, the clinic may have obligations under the Data Privacy Act, including breach assessment and possible notification.
What to do if a private clinic refuses to release your medical records
1. Ask for the reason in writing
Do not rely only on verbal statements from reception. Ask politely:
May I know the specific reason why my request for my own medical records is being denied or delayed? Please provide the clinic’s written policy or legal basis.
This often resolves the issue because many refusals happen at the front desk without legal review.
2. Send a formal written follow-up
Send a dated letter or email to the clinic administrator, records officer, attending physician, and Data Protection Officer if known.
Include:
- Your original request
- Date submitted
- Proof of identity
- Records requested
- Reason the records are needed
- Any urgency, such as continuing treatment, insurance deadline, employment requirement, travel, or legal deadline
- Request for release within a reasonable period
3. Offer to comply with reasonable verification
If the clinic’s concern is identity or authorization, provide:
- Clear ID copy
- In-person appearance
- Video verification
- Authorization letter
- SPA
- Proof of relationship
- Proof of guardianship
- Death certificate and heirship documents, if applicable
4. Escalate to clinic management or the hospital records department
If the clinic is inside a hospital or medical center, the physician’s private clinic may not be the only record holder. Ask whether the records are with:
- Hospital medical records department
- Laboratory department
- Radiology department
- HMO desk
- Billing department
- Ambulatory surgery unit
- Emergency room records
- Health Information Management Department
Many patients waste time asking the doctor’s secretary for records that are actually controlled by the hospital records office.
5. File a complaint with the National Privacy Commission if data privacy rights are violated
If the issue involves denial of access to personal data, unauthorized disclosure, improper release, or misuse of medical information, the patient may consider the National Privacy Commission.
The NPC explains its process on its official filing a complaint page. Formal complaints generally require a filled-out complaint form or verified complaint, supporting evidence, and notarization.
Important practical point: NPC rules generally require the complainant to first inform the personal information controller in writing and give it an opportunity to act, unless the NPC waives the requirement for good cause or serious violations.
Keep copies of:
- Your written request
- Clinic acknowledgment
- Follow-up emails
- Denial message
- Screenshots
- IDs and authorization documents submitted
- Proof of unauthorized disclosure, if any
- Witness statements, if relevant
6. Consider DOH or professional regulatory remedies
Depending on the issue, other remedies may be relevant:
| Problem |
Possible office or remedy |
| Clinic refuses patient access without valid reason |
Clinic management, DOH regulatory office, NPC |
| Unauthorized disclosure of medical records |
NPC, civil action, possible criminal complaint depending on facts |
| False medical certificate |
PRC complaint, clinic management, possible criminal/civil remedies |
| Professional misconduct by physician |
Professional Regulation Commission, Board of Medicine |
| Hospital detention or refusal due to unpaid bills |
DOH, legal remedies depending on facts |
| Insurance or HMO record dispute |
Insurance Commission, HMO/provider grievance process, clinic records office |
| Court case requiring records |
Subpoena, discovery, court order, subject to privilege rules |
Common real-life scenarios
“My employer wants my diagnosis. Can the clinic send it directly?”
Not unless there is a valid legal basis or your consent.
A fit-to-work certificate may be enough. Employers often do not need the full diagnosis, lab results, or private treatment details. Under data privacy principles, disclosure should be proportional and limited to the purpose.
A safer approach is to ask the clinic for a certificate stating what the employer truly needs, such as:
- Fit to work
- Unfit for work for a stated period
- Cleared to return on a specific date
- With restrictions, if medically necessary
“My HMO or insurance company needs the records for my claim.”
The clinic may release records to an HMO or insurer if the patient gave proper authorization, usually through the claim form or a separate consent. The release should be limited to the claim purpose.
Patients should read authorization clauses carefully because some insurance forms allow broad access to medical records.
“I need records for a second opinion.”
This is one of the strongest practical reasons to request records. A patient should be able to bring lab results, imaging reports, prescriptions, and treatment summaries to another doctor.
Clinics should not block continuity of care.
“I am abroad and need someone in the Philippines to get my records.”
Use a signed authorization or SPA. Include copies of your passport and your representative’s ID. If the clinic requires notarization, consularization, or apostille, ask exactly what format they require before preparing documents.
For urgent medical care abroad, ask whether the clinic can send the records directly to your verified email or to your new doctor with your written consent.
“My spouse is using my medical records in an annulment case.”
Medical records are not freely available just because there is a family court case. In Chan v. Chan, the Supreme Court recognized the privileged nature of hospital records in the context of litigation. A party seeking medical records in court may need to use proper court procedures, and privilege objections may apply.
If your records were obtained or disclosed without your consent, keep evidence and consider privacy, civil, and procedural remedies.
“The clinic posted or discussed my condition publicly.”
That may be a serious privacy violation. Take screenshots, identify witnesses, preserve messages, and send a written complaint to the clinic. Depending on the facts, you may have remedies under the Data Privacy Act, Civil Code, professional regulations, and other laws.
Practical request template
You may adapt this wording for a private clinic:
I am requesting access to and copies of my medical records as the patient and data subject under applicable Philippine law, including the Data Privacy Act of 2012.
Patient name: [Full name]
Date of birth: [Date]
Date/s of consultation or treatment: [Date/s]
Attending doctor: [Name, if known]
Records requested: [medical certificate / clinical abstract / lab results / prescriptions / procedure notes / complete relevant record]
Purpose: [continuing treatment / insurance claim / employment requirement / personal file / travel / legal requirement]
Preferred format: [printed copy / scanned PDF / certified true copy]
I am attaching a copy of my valid ID for verification. Please inform me of the applicable reproduction or certification fee and the expected release date.
For a representative:
I authorize [representative’s full name] to request, receive, and sign documents necessary for the release of the above medical records on my behalf. Attached are copies of my valid ID and my representative’s valid ID.
Frequently Asked Questions
Can a private clinic release medical records directly to the patient in the Philippines?
Yes. A private clinic may release copies of medical records to the patient after verifying the patient’s identity. The patient has the right to reasonable access to their own personal and health information under the Data Privacy Act and DOH-recognized patient rights.
Is my medical record confidential from me?
No. Confidentiality protects your medical record from unauthorized third parties. It does not normally prevent you, the patient, from accessing your own medical information.
Can the clinic refuse because I have unpaid bills?
A clinic should not use unpaid bills as a blanket reason to deny access to your own medical records. It may charge a reasonable fee for copying, printing, certification, or retrieval, but access to medical information should not be withheld merely to pressure payment of unrelated balances.
Can my spouse get my medical records without my consent?
Usually no, if you are an adult patient with capacity. A spouse does not automatically have unlimited access to your records. The clinic should ask for your written consent or another valid legal basis, especially for sensitive records.
Can parents request their child’s medical records?
Usually yes, for minor children, because parents generally exercise parental authority. But clinics may apply stricter review if there is a custody dispute, abuse concern, court order, or highly sensitive medical issue. For adult children, parental consent is not enough; the adult patient’s consent is generally required.
Can I request my records by email?
Yes, many clinics allow email requests, especially for overseas patients or telemedicine consultations. The clinic may require a scanned valid ID, signed request, password-protected release, or other verification steps.
Does the clinic have to give me the original chart?
Usually no. The clinic normally keeps the original medical chart or electronic record. You may request copies, certified true copies, clinical abstracts, medical certificates, test results, or relevant reproductions.
How long should a clinic take to release records?
Simple records may be released the same day or within a few working days. Clinical abstracts, certified copies, old archived records, and records needing physician review may take longer, often several days to a few weeks depending on the clinic’s system.
What can I do if the clinic refuses?
Ask for the reason in writing, send a formal follow-up, comply with reasonable ID or authorization requirements, and escalate to clinic management. If your data privacy rights are violated, you may consider filing a complaint with the National Privacy Commission using its official complaint process.
Can a clinic release my medical records to police or a lawyer?
Not automatically. Police, lawyers, employers, schools, relatives, and other third parties generally need your consent, a court order, subpoena, search warrant, or another specific legal basis. Clinics should be cautious because unauthorized release of health information can create legal liability.
Key Takeaways
- A private clinic in the Philippines can release medical records to the patient after proper identity verification.
- The patient usually receives a copy, certificate, abstract, result, or reproduction—not the clinic’s original chart.
- Medical records are confidential against unauthorized third parties, but the patient has a right to access their own health information.
- The Data Privacy Act of 2012 treats health information as sensitive personal information and gives patients rights as data subjects.
- A spouse, employer, insurer, lawyer, or relative does not automatically have the right to obtain a patient’s records without consent or legal authority.
- Clinics may charge reasonable copying or certification fees, but should not use unpaid bills as a blanket reason to deny access.
- Sensitive records, such as HIV, mental health, psychiatric, reproductive health, or medico-legal records, require extra care but are not automatically inaccessible to the patient.
- If a clinic refuses without a valid reason, the patient should make a written request, ask for a written explanation, keep evidence, and consider remedies through clinic management, the National Privacy Commission, DOH channels, or other appropriate offices.