to Patient ’ s Medical Records in the Light of the Case Law of Administrative Courts

This study contains an analysis of legal regulations on the access to patient’s medical records and the compliance with these regulations in Poland. Based on the extensive case-law of the administrative courts, the following were examined, i.a., the forms of making medical records available, with particular respect to the making available of the original of these records, the possibility of charging fees for the provision of medical records, the form of the request for access to medical records and the time within which the provider of health services is required to make that documentation available. The list of entities authorised to get access to patient’s medical records has been discussed and attention has been drawn to problems in gaining access to the medical records of a deceased patient.


INTRODUCTION
For the patient to participate fully, consciously in the diagnostic and medical processes, it is necessary to guarantee his right to information about his health condition and the health services provided. This is not only necessary for the correct consent to medical intervention, but also entails respecting the subjectivity of the patient, who should know what is happening to his body. The patient has the right term "medical records", 6 as was the case, for example, under the Act of 30 August 1991 on healthcare establishments. 7 The legislation currently in force only lists the elements medical records are required to have. In accordance with Article 25 para. 1 PRA, these include: identification of the patient, enabling his identity to be established; identification of the provider of health services with an indication of the organisational unit in which the health services were provided; a description of the patient's health condition or the health services provided to him or her; and the date when it was drawn up. On the other hand, the MRR lists categories of medical records such as individual internal and external records, and collective records.
The concept of medical records has been repeatedly considered by legal scholars. According to U. Drozdowska, it can be defined as "a set of documents which are medical data storage media, kept by providers of health services in order to exercise the patient's right to information and in connection with the performance of other legally defined duties". 8 On the other hand, M. Dercz, H. Izdebski and T. Rek define medical records as "medical data and information relating to the patient's health condition or medical services provided to the patient by entities carrying out health services, collected and made available as set out in the Act on the patient's rights and the Ombudsman of Patient's Rights". 9 The fact that the files are to be made available to the patient, i.e. the person concerned, does not raise any doubts. However, the legislature did not provide for whether access to it is available to every patient, regardless of age. While the regulation of the PRA on the right of a minor patient to information and to consent to a medical intervention appears to be complete, in the case of the right of access to medical records, the legislature has only stated that the patient is entitled to it. However, taking into account the regulation of these rights, as well as the fact that the right of access to medical records is referred to as a derivative of the right to information, 10 it should be stated that a patient who has reached the age of 16 has the right of access to medical records, but until he reaches the age of 18, this right is also vested in his legal representative. For patients under 16 years of age, only their statutory representatives may have access to medical records.

U M C S
Also the legal situation of incapacitated patients (even partially incapacitated) may raise doubts, since the legislature did not mention them in the context of the right of access to medical records either. The regulations on the right to information cannot be of use here, because in this case, too, the legislature is silent about this group of patients. It seems, however, that we should not deny an incapacitated patient (especially partially incapacitated) access to his medical records, provided that he is able to assess his or her health condition and the situation in which he or she found themselves.
Pursuant to Article 26 para. 1 PRA access to medical records may also be granted to a person authorised by the patient. This may be a close person within the meaning of Article 3 para. 1 point 2 PRA, but it may also be any other person, if clearly specified in the authorisation. The legislature has not specified any requirements as to the form of authorisation. Therefore, it should be assumed that it can be both written and oral form. This is also the opinion of the Supreme Administrative Court, which in its judgement of 9 February 2016 stated that the introduction of the requirement of written authorisation to access medical records in the organisational regulations of an entity performing therapeutic activities constitutes a violation of patients' collective rights. 11 In the Court's opinion, allowing the oral form of authorisation along with its recording in writing by a person employed in that entity should not constitute a particular burden on its organisational duties. 12 It is also worth noting that oral authorisation is also not precluded by § 8 para. 1 point 2 MRR, according to which a patient's statement of authorisation to obtain the files, indicating the name and surname of the authorised person, is included or attached to the individual internal records. Therefore, as stated by the Supreme Administrative Court, it may be an oral statement recorded subsequently by an employee of the entity which carries out the therapeutic activity.
The patient may authorise access to medical records by any number of individuals. This does not mean that he or she waives his or her right. They may, concurrently to the authorised persons, request access to medical record. 13 The authorisation of third parties to access medical records is a specific type of authorisation which differs from the power of attorney regulated in the Act of 23 April 1964 -Civil Code. 14 In the opinion of the Voivodeship Administrative Court in Rzeszów, as expressed in the judgement of 13 July 2010, "the essential difference is that the 'authorisation' does not expire with the patient's death, but after the patient's death it continues to produce legal effects, while the classic power of 11 Judgement of the Supreme Administrative Court of 9 February 2016, II OSK 2843/15, LEX no. 1976297. 12 Ibidem. 13 Similarly D. Karkowska,op. cit.,p. 538. 14 Consolidated text Journal of Laws 2020, item 1740 as amended.
Pobrane z czasopisma Studia Iuridica Lublinensia http://studiaiuridica.umcs.pl Data: 29/08/2021 23:49:42 U M C S attorney expires with the principal's death". 15 The Supreme Administrative Court also claims that "the person authorised to consult the medical records during the patient's lifetime is also entitled to this after the patient's death". 16 There is also another view presented in the literature, namely that the legislature, in Article 26 para. 1 and 2 PRA, provided for two types of authorisations: the first being a classic power of attorney expiring upon the patient's death and the second, which is a statement by the patient authorising access to medical records after his death, and therefore effective only from that moment on. 17 Until recently, a significant problem was the issue of access to the medical records of a deceased patient in a situation where the patient did not manage to authorise anyone. The literature points out that in such cases, healthcare providers have very often denied access to the records to patient's relatives on the grounds of lack of appropriate authorisation. 18 It has also been proposed to introduce changes to the PRA aimed at allowing unauthorised relatives of a deceased patient to have access to his or her medical records, if only so that they could pursue possible claims against the entity which carried out the treatment. 19 By the Act of 6 December 2018 amending the Act on the professions of medical practitioner and dentist and some other acts, 20 the legislature amended Article 26 para. 2 PRA by adding that, apart from the persons authorised during the patient's lifetime and the patient's statutory representative, access to medical records is also granted to a close relative, unless such access is opposed by another close relative or the patient's himself or herself when alive. The legislature also added to Article 26 PRA para. from 2a to 2c, in which it regulated the issues of a conflict between the patient's relatives and the patient's own opposition to making medical records available after his death. The new solutions were examined in detail by M. Świderska. The author has rightly pointed out the far-reaching casuistic character of the regulation, as well as the fact that it is hardly rational and undermines the essence of the autonomy of the patient's will. 21 The greatest objection concerns the possibility, adopted by the legislature in Article 26 para. 2 PRA, to consent to 15 provide medical records, granted by a court in non-contentious proceedings at the request of a close family member where the patient himself has objected to it during his lifetime. One should agree with M. Świderska that the financial interests of third parties (i.e. the wish to obtain damages or compensation for the death of the patient) placed above the autonomy of the patient's will "do not have sufficient legitimacy in the postulate of proportionality of protection". 22 Apart from to the above amendment which may raise doubts whether it is right, the changes introduced by the Act of March 23 March 2017 amending the Act on the patient's rights and the Ombudsman of Patient's Rights and some other acts, 23 which changed the wording of Article 26 para. 2 PRA should be assessed positively. Before the amendment, this provision was widely criticized for being limited to making the deceased patient's files available for inspection only. 24 In the above-mentioned judgement of 13 July 2010, the Voivodeship Administrative Court in Rzeszów has stated that the application of a linguistic interpretation to construe the provision under analysis raises doubts and a systemic interpretation should be rather used, and consequently it should be stated that "making the documentation available to such a person covers all forms specified in Article 27 of the Patient's Rights Act, i.e. inspection, making a copy, releasing the original document with receipt confirmation, upon stipulation of return". 25 The present content of Article 26 para. 2 PRA does not provoke any objections any more, as the legislature replaced the phrase "the right to inspect the medical records" with the statement "medical records shall be made available".
In Article 26 para. 3, 3a and 4 PRA the legislature also mentioned a number of bodies, institutions and other entities to whom health services providers make the patient's medical documentation available. These are, among others, public authorities, including the Patient's Rights Ombudsman, National Health Fund, medical professions self-government bodies, healthcare consultants, Psychiatric Hospital Patient Ombudsman, the minister competent for health matters, courts, prosecutor's offices, forensic medicine doctors, professional liability ombudsmen, Agency for Health Technology Assessment and Tariff System, Medical Research Agency, pension authorities, disability assessment teams, entities maintaining medical service records, regional boards for adjudicating on medical incidents, health service providers and a number of other entities, if they need medical documentation to perform their tasks. Considering the fact that medical records contain information of particular importance to the patient, it would be desirable for the 22  patient to make them available to a small group of entities and only in exceptional cases. Meanwhile, the multitude of entities authorised to access medical records raises doubts as to whether the PRA duly protects patients' medical data.
In this context, it is worth noting that the legislature, by guaranteeing the patient the right to access the medical records under Article 23 para. 2 PRA stipulates that the data contained in these records are protected. The need to protect the data contained in medical records should not be objectionable. Apart from the information enabling the patient to be identified, the records describe the patient's health condition or the health services provided to him (Article 25 para. 1 PRA), and therefore data the unlawful disclosure and use of which could be specially troublesome for a person. According to the Voivodeship Administrative Court in Warsaw, expressed in the judgement of 8 June 2017, "health condition data are so-called sensitive data. In democratic ruleof-law states, their protection is guaranteed not only in legal acts of statutory rank, but also in those hierarchically supreme ones, within the framework of the right to the protection of private life in the broad sense". 26 In the current Constitution of the Republic of Poland of 2 April 1997, 27 such a guarantee is provided under Articles 47 and 51. Health data are also included in the vulnerable data group, referred to in Article 9 para. 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), 28 which are prohibited to be processed except as referred to in Article 9 para. 2 of that Regulation. The obligation to protect medical data also arises from a number of laws governing the practice of individual medical professions and which form the basis of professional secrecy. However, this issue goes beyond the framework of this study.

THE MANNER OF MAKING MEDICAL RECORDS AVAILABLE
Article 27 PRA governs the way in which medical records are made available. The legislature has provided for five possibilities for making the records available, i.e. for inspection at the place where health services are provided, excluding medical emergency activities, or at the premises of the health service provider, with the possibility of taking notes or photographs; by drawing up an extract, certified copy, copy or print-out thereof; by releasing the original document with receipt confirmation, upon stipulation of return, at the request of public authorities or general courts, as well as in the event where a delayed release of the documents could endanger the life or health of the patient; by means of electronic communication and on a data storage medium. X-ray images taken on film, like the original medical documentation, are made available with confirmation of receipt, upon stipulation of return. The choice of the form of making the records available belongs to the patient or another authorised person, and the order of the options indicated by the legislature for making the documentation available should be considered irrelevant. 29 The catalogue of forms of making medical records available specified in Article 27 para. 1 PRA is complete, which means that the patient or an authorised person may not request making the records available to them in a form that is not provided for by the legislature. In particular, they may not expect the treatment provider to provide information contained in the medical records by telephone. This form would not guarantee the safety of the data covered by the medical records. On the other hand, it should be emphasised that also the medical service provider is bound by the prohibition on making medical records available in a manner other than that resulting from Article 27 PRA. Therefore, its duty is to organise working time in such a way that the entitled persons have a real possibility to use the forms of access to medical records as set out by the legislature. In this context, it is worth mentioning the judgement of the Supreme Administrative Court of 26 July 2016, in which the Court stated that "both the regulation of Article 26 para. 1 and Article 27 of the Act of 2008 on the patient's rights and the Ombudsman of Patient's Rights did not introduce the form of making medical records available by telephone. The use of such a form was a violation of patients' rights to medical records". 30 Out of the forms of access to medical records listed in Article 27 para. 1 PRA, special attention should be paid to the possibility of making the originals of these records available. This form has been provided for since the entry into force of the Act of 23 March 2017 amending the Act on the patient's rights and the Ombudsman of Patient's Rights and certain other acts, however, the legislature has extended the possibility of selecting it. Originally, the patient or a person authorised by him or her could expect the original medical documentation to be made available only if requested by an authorised body or entity, while the aforementioned amendment has also taken into account the case of making the original documentation available if a delay in the release of the documents could have put at risk the patient's life or health. In the opinion of the Supreme Administrative Court expressed in the judgement of 30 January 2018, "the clause of making the original documentation 29 For another perspective, see D. Karkowska,op. cit.,p. 549 available to patients where a delay in providing the documentation could put the life or health of the patient at risk is a clause which requires an emphasis to be placed on the right to protect life and health, and therefore rigorousness in this respect violates constitutional standards not only regarding the right to the protection of life and health, but also the right to access documents collected in relation to an individual, and this includes medical records". 31 However, it may be doubtful whether the patient or another authorised person, when requesting the original medical records, should specify the reason why they expect the original and not a copy of that documentation to be given. It seems that under the previous legislation, where the original document could only be made available at the request of an authorised authority or entity, it was necessary to indicate who exactly required the documentation in that form. At present, where it is possible to make the original medical records available even if the patient's intention is not to submit the records to the competent body, but to use it for other own purposes, it seems unfounded to specify the reason for the request. The Voivodeship Administrative Court in Warsaw, in its judgement of 24 May 2017, stresses that the PRA "does not require, for the validity or effectiveness of the request for access to medical records, to demonstrate the purpose for which the patient requests the documents. This means that the medical records should be made available without the need to justify the patient's request". 32 The patient or an authorised person, upon obtaining the original medical records from the healthcare provider, assumes responsibility for its storage until their return. This is so since they are not given the ownership of these documents The literature rightly points out that the right guaranteed by the legislature in Chapter 7 of the PRA is, in fact, the right to access medical records, not the right to these records themselves. 33 They are owned by the health care provider who is required, as the owner, to store them for the period set out in Article 29 PRA. It should also require the patient or other authorised person receiving the original documents to confirm the receipt, which, as the Supreme Administrative Court points out in its judgement of 30 January 2018, "constitutes a mandatory element of the medical records of a patient who has been provided with health services". 34 By allowing as many as five manners of providing medical records, the legislature did not provide for the form in which the patient or other authorised person may request the health services provider to make those records available. However, since it has not imposed any restrictions in that regard, it is well worth considering that those persons may do so in the most convenient form of their choice, e.g. in oral, written or electronic forms. Therefore, the Supreme Administrative Court rightly stated in its judgement of 8 September 2016 that "limiting the form of request for access to medical records it is a breach of the patient's right by the health services provider.
[…] It is the patient who may choose the form of the request, including the basic one, i.e. the oral form. The waiver of this form therefore constitutes a violation of the collective rights of patients". 35 In the opinion of the Supreme Administrative Court expressed in the judgement of 17 June 2015, each of the persons authorised to access medical records "by requesting access to medical documentation, including the patient, is required to provide identification". 36 The Supreme Administrative Court emphasized that it is not enough to present one's ID card upon receipt of the records, as the health services provider may only disclose the documentation to an authorised person. Therefore, it must determine, at the stage of submitting the request for access to the files, whether the person requesting access to the medical records is indeed entitled to do so. If the applicant fails to do so, the provider may refrain from taking any action, without exposing itself to the accusation of inactivity. 37 The legislature did not regulate in the PRA the time limit within which the health services provider would be obliged to disclose medical records. This time limit was, however, defined by the Minister of Health, providing in § 78 para. 1 MRR that it should be done without undue delay. The issue of the time limit for making medical records available has often been subject to consideration by administrative courts. In its judgement of 6 September 2016, the Supreme Administrative Court stated that the "expression 'without undue delay' should be referred only to the need to prepare the medical records, the preparation of which is not related to undertaking complex activities, as the health services provider is obliged to keep the records". 38 On the other hand, in the above-mentioned judgement of 9 February 2016, the Supreme Administrative Court stated that "health protection should have priority over the freedom to conduct business activity, therefore the clinic should organize its activities in such a way that medical records can be made available to patients without undue delay". 39 This is of particular importance in situations where the health care provider Pobrane z czasopisma Studia Iuridica Lublinensia http://studiaiuridica.umcs.pl Data: 29/08/2021 23:49:42 U M C S ceases to provide health services for various reasons. An example of such action is participation in lawful industrial action. In the judgement of 28 October 2015, the Voivodeship Administrative Court in Warsaw stated that "the exercise of the patient's right to access medical records may not be in any way restricted or hampered by the entity providing health services, also in the event of cessation of healthcare services as a result of participation in lawful industrial action. The necessity of absolute, rigorous observance of this patient's right stems from the fact that not only does it serve to protect health, but can often decide about the protection of life, for example in the event of an emergency surgical procedure or the need to continue strictly defined treatment, solely on the basis of data from medical records". 40 Participation in the industrial action is temporary, which does not change the fact that it may (though it should not) be associated with difficulties in accessing medical records. A much bigger problem for the patient and other entitled persons could be the use of the right in question in a situation of permanent cessation of health services by the health care provider. Therefore, the legislature regulated in Article 30a PRA the issue of keeping and sharing medical records after cessation of medical activity. According to Article 30a para. 2 PRA, in such a situation, the entity required to keep and share medical records is the entity taking over the responsibilities of the entity which terminates its activities. However, when there is no such entity, pursuant to Article 30a para. 3 and 7 PRA, these successors may be: a founding or supervising entity; an entity providing health services with which the entity ceasing to perform medical activities has concluded an agreement for the storage of medical records; the competent district medical chamber or the district chamber of nurses and midwives or the National Chamber of Physiotherapists; and also the voivodeship governor, in the cases specified in the provisions under analysis. In view of the above, it should be noted that the right of the patient and other authorised persons to access to medical records does not expire upon the liquidation of the health care provider. So, they can be granted access to these records in all forms provided for in Article 27 PRA, also after the cessation of medical activities by the entity, from other entities listed by the legislature as obliged to store and share the patient's medical records.
The medical records may be made available upon payment of a fee. In Article 28 PRA the legislature regulated the rules of charging and determining the amount of such fees. First of all, it should be noted that charging a fee for providing medical documentation is not obligatory. The legislature expressly provided for it as an option, using in Article 28 para. 1 PRA the expression: "the entity providing health services may charge a fee". Secondly, the aforementioned option of charging a fee is related only to the selected methods of making medical records available. According to the will of the legislature, a fee may be charged for the preparation of an excerpt, certified copy, copy or printout of medical records, making it available on an electronic data storage medium, as well as making a copy in the form of a digital representation (scan) and sending via e-mail or on an electronic data storage medium. Therefore, the health care provider may not require the patient or other authorised persons to pay a fee for releasing the original medical records or only for access to these records and for sending it via electronic means of communication. This is related to the nature of the fee which, as stated by the Supreme Administrative Court in its judgement of 4 December 2018, "may only cover the amount of costs incurred by the health services provider. Therefore, it cannot violate the principle of equivalence". 41 Among the forms of sharing medical records for which fees may be charged, the legislature indicated only those that involve costs for the health services provider.
In the context of the analysis of the legal nature of the fee for the provision of medical records, the reasons for the judgement of the Constitutional Tribunal of 28 November 2005 remain valid, 42 even if issued before the PRA was adopted, in which the Tribunal concluded that the fee for the provision of medical records was not a public imposition or other income earned by public finance entities. The Tribunal also held that "in return for the payment of that fee, the authorised entity receives a specific service of a healthcare establishment consisting of a specific technical act: making a certified copy, an extract, a copy. Thus, the fee for making medical records available has certain characteristics of price for a service, i.e. unlike a fiscal payment, the amount of the fee is closely linked to the cost of the service actually provided. In view of the above, the authorised entity must receive consideration from the healthcare establishment in return for the fee paid, which has no less value than the payment made". 43 Article 28 para. 2a PRA provides for exceptions to the possibility of charging a fee for the provision of medical records. According to that provision, the fee shall not be charged where medical records are made available to the patient or his/her legal representative for the first time, to the extent requested, and in connection with proceedings before the regional boards for adjudicating on medical incidents. In addition, these fees are not charged to pension authorities (Article 28 para. 2 PRA) and to the Agency for Health Technology Assessment and Tariff System, and to the Medical Research Agency (Article 28 para. 2b PRA).
The question whether to charge or not for the provision of medical records in cases allowed by the PRA is decided by the healthcare provider itself. It also in- dependently decides on the amount of such a fee, having regard to the restrictions resulting from Article 28 para. 4 PRA. The legislature has regulated therein the maximum amount of the fee for the provision of medical records. As U. Drozdowska, E. Kowalewska-Borys and M. Wojtal rightly claim, the amounts of the fee should be made public to patients and other authorised persons in a place accessible to them so as to learn about these amounts in an unfettered manner. 44 Article 24 para. 1 point 9 of the Act of 15 April 2011 on medical activities 45 provides for that the amount of the fee for the provision of medical records be laid down in the organisational regulations of the healthcare provider. On the other hand, the Supreme Administrative Court stated in its judgement of 10 April 2018 that "since the fee for the provision of medical records is not a public imposition and constitutes a kind of price for a service, the amount of which reflects the cost of the service actually provided, its amount may be determined upon receipt of an order for the service". 46 Although the legislature has not put this explicitly, the case-law has accepted that medical records are made available through factual activities. 47 In the opinion of the Voivodeship Administrative Court in Rzeszów, as expressed in the judgement of 13 July 2010, the provisions of the Act of 14 June 1960 -Code of Administrative Procedure 48 do not apply to making medical records available, and if the records are not made available, a complaint for inaction may be filed with the administrative court without any additional conditions (e.g. a prior complaint against failure to settle the matter within the prescribed time limit). 49 The legislature has also failed to regulate in the PRA the situation where the healthcare provider refuses to provide access to medical records. This issue was regulated by the Minister of Health in § 71 MRR. According to this provision, if it is not possible to make the records available, the refusal shall be submitted in a paper or electronic form, as requested by the authorised body or entity and with a presentation of the reasons for such refusal. One should also agree with D. Karkowska, who claims that such a provision should be included not in the regulation, but in the PRA. 50