AEPD rules on access to clinical records in private clinics

The AEPD (Spain’s data protection authority) has adopted an interpretative position recognising citizens’ right to know the exact identity of the natural persons who access their electronic health data, according to information published by elEconomista. In parallel, the AEPD keeps its channels and forms active for exercising data protection rights under the GDPR and the LOPDGDD (Spain’s Organic Law 3/2018), according to its official website. For clinics and private practices, the immediate effect is operational: reviewing how accesses to the clinical record are logged, how access requests are answered and what information is provided when the patient requests traceability.

What has changed: staff identity in accesses to health data

The new approach reported by elEconomista focuses on electronic access to health data: citizens would have the right to know the exact identity of the natural persons who have accessed their clinical information, according to the outlet’s coverage of the interpretative position adopted by the AEPD. For a private clinic, this affects any system that manages the clinical record, viewers for test results, schedules with clinical notes or repositories containing health data.

In practice, the measure forces a rethink of the scope of the “access information” provided when the patient exercises their right of access. Until now, many organisations responded with generic listings (profile, service, role or department). If the position reported by elEconomista is consolidated, it will be necessary to identify the specific person who accessed the data (not just their function), in addition to keeping traceability of what was consulted and when, in line with the proactive accountability approach required by the GDPR published in the BOE (Spain’s official gazette).

The AEPD presents this position not as a technical recommendation but as an interpretation of citizens’ rights over health data, according to elEconomista’s coverage. Therefore, the clinic should treat it as a compliance point to review, not as an optional improvement.

Direct impact on the clinic: access auditing and responding to requests

The consequence for management and the medical directorate is twofold: (1) ensure the system stores sufficient access logs and (2) define an internal procedure to respond to rights requests with the correct information.

The AEPD provides information on exercising rights — access, rectification, erasure, etc. — and makes templates and forms available to process them, via its “Exercise your rights” and “Models and forms” pages. That means a clinic may receive standardised requests and must have a circuit to register them, verify identity and respond.

Moreover, the GDPR (published in the BOE) sets the general framework: the data controller must ensure that the data subject can exercise their rights and receive a response that complies with the rules. The management of access to health data, by its especially sensitive nature, requires reinforced controls and evidence in the event of a complaint to the AEPD, consistent with the GDPR’s general scheme.

To translate this into concrete management tasks for private clinics:

• Review whether the access log identifies a named user (first and last name or an unequivocal identifier assigned to a natural person) and not only a generic profile, in line with the position reported by elEconomista.
• Verify there are no shared accounts, since these make it difficult to prove who accessed which data and when, consistent with the traceability requirement underlying the AEPD’s reported position.
• Align the procedure for handling rights requests with the AEPD templates, to avoid incomplete responses or departures from the documentary standard expected by the Agency.

Patient rights: the most common requests and how they are channelled

The AEPD reminds, on its “Exercise your rights” section, that the regulation allows citizens to contact the data controller to exercise their rights. It also publishes “Models and forms” for the right of access and others, according to its official web pages.

For a clinic, this means requests can arrive via multiple channels (in person, by post, digital channels), but their content tends to converge: access to data, copies of information, clarifications about processing or identification of accesses. Given the position reported by elEconomista on the exact identity of who accessed records, requests for “who has seen my clinical record” are likely to increase, so it is advisable to prepare responses that include what the position requires and to clearly separate what is the patient’s data from what is information associated with access traceability.

The AEPD provides templates to structure these requests, which helps the data controller channel the petition without improvising internal templates that omit relevant information.

Staff, internal control and recordings: lessons from recent rulings

Although not all are in the health sector, some AEPD actions and rulings serve as practical warnings about intrusive practices in the workplace.

On one hand, Confilegal reports an AEPD sanction against a company for recording employees’ conversations to justify a dismissal, noting that the AEPD cites judgment SAN 4102/2025, of 29 September, on the intrusive nature of voice recording and the need for a strengthened justification of suitability, necessity and proportionality. In a private clinic, this affects any idea of recording audio at the front desk, in an internal call centre or in work areas: before implementing it, management must require a legal basis and documented justification, and must inform adequately, according to Confilegal’s reporting.

On the other hand, Confilegal also published a case in which the AEPD reproached an organisation for failing to address a deletion request, reminding that temporary absence (vacation) does not exempt responding to requests. For a small clinic structure, this is especially relevant: substitutions and an operational mailbox for rights must be planned, because the obligation to respond falls on the data controller, not on a specific person.

Regarding video surveillance, elEconomista reports an AEPD sanction for cameras inside a rented dwelling, a context different from healthcare but useful to remind that deploying cameras in private or unjustified spaces can be unlawful. In clinics, this translates into reviewing camera locations (never in areas that compromise intimacy) and purposes, and documenting the proportionality analysis when installation may affect staff or patients, in line with the AEPD’s usual criteria.

Applicable regulatory framework and what to review now

The general framework remains the GDPR (published in the BOE) and the LOPDGDD, according to the AEPD in its frequently asked questions section, which refers to Article 7 on minors (although focused on education, it is a direct reference to the LOPDGDD and its structure). In a private practice, the processing of health data requires special attention by category of data and the obligation to limit access to authorised personnel.

Based on the information available in public sources, the priority review for management and directors should cover:

• Nominal traceability of accesses to the clinical record: what is logged and what can be reported to the patient, according to the interpretative position reported by elEconomista.
• Procedure for rights requests: channels, internal registration, persons responsible for replies and use of the AEPD templates, according to its rights and models pages.
• Internal labour controls: avoid particularly intrusive measures (such as voice recording) without a strengthened justification, in light of Confilegal’s reporting.
• Operational coverage during absences: ensure continuity in handling rights requests, following the case reported by Confilegal.

References and links

• Criterion of the AEPD on identity in accesses to the historial clínico (published by elEconomista).
• Framework of the RGPD en el BOE.
• AEPD page for ejercer derechos.
• Modelos y formularios of the AEPD for requests.
• Case on petición de borrado y obligación de contestar (Confilegal).
• Sanction for grabación de conversaciones en el trabajo (Confilegal).
• elEconomista reference to sanction for videovigilancia en interior de vivienda.

This article summarises public sector information. It is not legal or tax advice.