The President of the Polish Data Protection Authority (UODO), Mirosław Wróblewski, has requested the Ministry of Health to undertake legislative intervention concerning the management of medical records after the death of a doctor practicing individually.

This initiative follows reports, notably the case of a patient deprived of access to her file. According to the authority's analysis, the current legislation, although designating regional medical chambers as responsible for taking over these records under Article 30a, paragraph 3, point 3 of the Patients' Rights Act, does not specify the method or procedure to be followed, creating legal uncertainty. To address this gap, some chambers have adopted internal regulations conditioning the takeover of documents on a request submitted by the person holding them, such as an heir. The UODO considers that these internal acts, governing the processing of health data, raise fundamental objections with regard to Article 6 and Article 9 of the GDPR, as such gaps cannot be filled by internal rules of a professional order.

Consequently, the President of the UODO has asked the Minister of Health, Jolanta Sobierańska-Grenda, to consider legislative measures to define a comprehensive procedure. The proposals include establishing rules to identify the holders of medical records after death, formalizing the modalities of their takeover by medical chambers, and instituting an obligation to transmit for persons in possession of them. It is also suggested to provide enforcement mechanisms in case of non-compliance with this obligation, as well as to consider introducing criminal sanctions to ensure the protection of patients' rights and the security of their health data.