Patient Rights in Case of Non-Provision of Medical Records

What is a Medical Record?

Medical records are all types of health documents created during a patient's healthcare stay, containing information on diagnosis, treatment, surgery, examinations, medication, observation, care, consultations, imaging, and discharge. Patient files, discharge summaries, surgical notes, anesthesia forms, laboratory results, MRI, CT scans, X-rays, ultrasound images, pathology reports, prescriptions, nurse observation forms, intensive care unit records, consent forms, discharge documents, and consultation notes are all considered medical records.

Medical records are not merely internal hospital correspondence or archival documents. These records constitute essential evidence for patients to understand their own health status, obtain a second opinion from a physician, continue treatment at another hospital, apply for disability reports or invalidity claims, handle insurance procedures, and even file compensation claims when necessary.

The Patient Rights Regulation explicitly regulates the patient's right to request information about their health status. According to the regulation, the patient has the right to request verbal or written information about their health condition, the medical procedures to be performed, their benefits and potential drawbacks, alternative methods, the consequences of refusing treatment, and the course of their illness. The same regulation also stipulates that the patient may examine and obtain copies of their health files and records directly, through their representative, or legal guardian.

Therefore, general refusals from hospitals such as "these records belong to the hospital," "we cannot provide them without the doctor's permission," "a court order is required," or "we cannot provide them to the patient due to the Personal Data Protection Law (KVKK)" are not legally sound. The KVKK is not a regulation that prevents patients from accessing their own health data; on the contrary, it is a protective system that ensures the lawful, secure, and verifiable processing of personal data.

Can a patient request their own medical records?

Yes. The patient has the right to request all records related to their health condition. This right is not limited to the medical report alone. The patient can request all documents, images, reports, consent forms, and procedure records created during the treatment process.

According to Article 16 of the Patient Rights Regulation, a patient may review and obtain a copy of their file and records containing information about their health status, either directly or through their representative or legal guardian. The same article also states that these records may only be viewed by persons directly involved in the patient's treatment.

This regulation is twofold. Firstly, the patient can access their own records. Secondly, the patient's records cannot be arbitrarily disclosed to third parties. In other words, a healthcare institution cannot avoid providing a patient's records by citing the "KVKK" (Personal Data Protection Law); however, they cannot disclose these records to unrelated third parties without the patient's consent.

If the patient is a minor, has limited legal capacity, or lacks the capacity to make reasoned decisions, their guardian or trustee may request the records. If the patient has given power of attorney to a lawyer, the lawyer may also request the medical records within the scope of the power of attorney. The regulation acknowledges that the patient may authorize another person to obtain information about their health condition, and that documentation of this authorization may be required where necessary.

What medical documents might be requested?

The documents a patient may request vary depending on the specific treatment process. However, in practice, it is particularly important to request the following records:

The medical records include: epicrisis reports, patient admission and discharge documents, surgical notes, anesthesia evaluation and monitoring forms, preoperative preparation documents, informed consent forms, nurse observation forms, vital sign monitoring charts, intensive care unit records, laboratory results, blood tests, biochemistry, culture and antibiogram results, pathology reports, radiology reports, MRI, CT scans, X-rays, ultrasound and PET-CT images, prescriptions, medication administration records, consultation notes, emergency department records, ambulance referral forms, discharge instructions, follow-up appointment records, patient complaint applications, and payment/invoice documents.

Medical records form the basis of lawsuits, especially in cases involving malpractice, misdiagnosis, botched surgery, birth defects, cosmetic surgery victimization, dental malpractice, intensive care neglect, hospital infections, or incorrect medication administration. This is because whether the doctor or hospital acted in accordance with medical standards is often determined through these records.

The Constitutional Court has emphasized that in cases where disability or other health problems are alleged to have resulted from medical intervention, whether the intervention was carried out in accordance with current and generally accepted rules of medical science can largely be determined by examining the records of the diagnosis and treatment process. According to the Constitutional Court, the recording and storage of data from the diagnosis and treatment process for a reasonable period is the responsibility of the healthcare institution.

What rights are violated by the failure to provide medical records?

Withholding medical records primarily violates the patient's right to access information and review records. Without knowing their own medical history, a patient cannot develop a new treatment plan, obtain a second opinion from another physician, learn what was done during surgery or treatment, or assess whether any mistakes were made.

This situation also makes it difficult to pursue legal recourse. Because in medical malpractice claims, the patient often does not have direct access to the evidence. The hospital that performed the surgery, the medications used, surgical notes, nurse records, pathology reports, and imaging results are all in the possession of the healthcare institution. The failure to provide the patient with these documents further increases the information imbalance between the patient and the hospital.

The Constitutional Court has stated that in cases where a healthcare institution's responsibility cannot be assessed due to the failure to submit information or documents that should be in the patient's file to the judicial authorities, this situation should not be interpreted against the patient. According to the Constitutional Court, if the healthcare institution's failure to submit the documents in its possession to the court is interpreted against the applicant, who is in a weaker position, it creates an unfair and excessively burdensome situation.

This approach demonstrates that the failure to provide or the incompleteness of medical records constitutes not merely an administrative deficiency, but a serious legal problem that undermines the patient's right to effective redress and proof of wrongdoing.

Health Data within the Scope of the Personal Data Protection Law (KVKK)

Health data is one of the most sensitive categories of personal data. Information such as illnesses, diagnoses, medications, surgeries, psychiatric history, laboratory results, and genetic information are considered special categories of personal data.

According to the Personal Data Protection Authority, data subjects have the right to inquire with the data controller whether their personal data is being processed, to request information if it is being processed, to learn the purpose of processing, to know the third parties to whom the data has been transferred, to request the correction of incomplete or inaccurate data, to request the deletion or destruction of data in certain cases, and to claim compensation for damages incurred due to the unlawful processing of personal data.

The Regulation on Personal Health Data also creates a specific regulatory area regarding health data. The purpose of the Regulation is to determine the procedures and principles to be followed in the processes carried out by the Ministry of Health's central and provincial organizations and health service providers affiliated with the Ministry, within the scope of Law No. 6698. With the amendments made in 2025, the basis of the Regulation and the conditions for accessing health data were updated; e-Nabız security settings and the conditions for accessing health data were regulated in more detail.

Therefore, requests for medical records should be handled within the framework of both the Patient Rights Regulation and the legislation on the protection of personal data. The patient has the right to access and obtain copies of their own health data; the healthcare institution is obligated to provide this data securely, not to disclose it to unrelated third parties, and to maintain accurate records.

Are the records displayed in e-Nabız sufficient?

e-Nabız is an important system that facilitates patients' access to their health data. However, the records visible in e-Nabız may not always encompass the entire patient file. Some imaging files, surgical notes, nurse observation forms, intensive care details, anesthesia records, consent forms, or in-hospital follow-up documents may not be fully visible in e-Nabız.

Therefore, a hospital cannot completely refuse a request for medical records by simply saying, "It's already visible in e-Nabız." While the data visible in e-Nabız provides convenience for the patient, a complete copy of the hospital file may be required for a medical malpractice claim or a detailed legal review.

In its statements regarding the Regulation on Personal Health Data, the Ministry of Health stated that the aim is to ensure the secure recording, processing, and protection of health data; that individuals cannot be forced to share their health data except in cases where it is necessary for the provision of health services; and that health facilities are obliged to take the necessary measures to protect the privacy of all patient data, including test and examination results.

Therefore, e-Nabız is a tool that facilitates patient access to information; however, it does not eliminate the patient's right to request records directly from the healthcare institution.

Can a hospital refuse to provide medical records?

Hospitals, as a rule, cannot refuse to provide a patient's own medical records. However, in some cases, a proper request, identity verification, power of attorney, or legal representation document may be required. These requests should be made within reasonable limits and for data security purposes.

For example, if the patient is applying in person, identification may be requested. If a lawyer is applying, a power of attorney may be required. If a guardian is applying for a minor child, a document showing the custody status may be requested. If a trustee is applying for a patient with limited legal capacity, a guardianship order may be required. These are reasonable requests for the secure delivery of records.

However, hospitals should not refuse to provide records after identity and authorization verification with justifications such as "the doctor doesn't allow it," "the file belongs to the hospital," "we only provide it if the court requests it," "surgical notes are not given to the patient," or "nursing records are internal correspondence." The Patient Rights Regulation clearly stipulates that patients have the right to review and obtain copies of their health records.

However, if the records contain private information belonging to third parties, the hospital may remove or mask this information before providing the records. But this cannot be used as a justification for withholding all documents related to the patient's own medical history.

How to Request Medical Records?

Requests for medical records should be made in writing whenever possible. Verbal requests may be denied or dismissed in practice. Therefore, the safest way is to submit the request in writing to the hospital's records unit, patient rights unit, chief physician's office, or, in private hospitals, to the patient relations or legal unit.

The application must clearly state the patient's name, Turkish Republic identity number, contact information, the department where they are being treated, examination or admission dates, surgery date, the requested documents, and the method of submission. Requested documents should be listed individually whenever possible. For example, instead of simply stating "I want my entire patient file," it is more effective to provide a detailed request such as "epicrisis, surgical notes, anesthesia form, consent forms, nurse observation forms, intensive care unit records, laboratory results, imaging CD/DVD or digital images, pathology reports, and consultation notes.".

If the application is to be submitted in person, a registration number must be obtained, or a delivery stamp must be affixed to a copy of the application. Registered mail, notarized notice, or the institution's official application channels can also be used. In applications against private hospitals, it is important that the application is verifiable to prevent future consumer or compensation lawsuits.

Under the Personal Data Protection Law (KVKK), the fundamental principle is that the data subject must first apply to the data controller. In the KVKK application system, individuals must first submit their requests to the data controller; a direct complaint to the Board cannot be made without exhausting this avenue. Methods that can be used in the KVKK application procedure include written applications, registered electronic mail (KEP), secure electronic signatures, mobile signatures, or registered electronic mail addresses previously provided to the data controller.

What can be done if the hospital doesn't respond?

Depending on the nature of the request, there may be several avenues to pursue, as the hospital may not respond to or provides an incomplete response to the medical record request.

The first option is to apply to the hospital's patient rights unit and the chief physician's office. In state hospitals, written applications can be made through the patient rights unit and the chief physician's office. In private hospitals, the patient relations department, the chief physician's office, the administration, or the legal department can be contacted.

The second option is to file a complaint with the Provincial Health Directorate and the Ministry of Health. The failure to provide medical records constitutes a violation of patient rights and can be subject to administrative appeals and audits. Applications can also be made through CİMER (the Presidential Communication Center); however, CİMER applications must clearly state the specific date, hospital name, requested documents, and previous application registration numbers.

The third option is the application and complaint process under the Personal Data Protection Law (KVKK). According to the KVKK, the data controller must finalize the data subject's application as soon as possible, and no later than thirty days, depending on the nature of the request. If the application is rejected, the response is deemed insufficient, or no response is given within the specified time, the data subject may file a complaint with the Board within thirty days of learning of the data controller's response, and in any case within sixty days of the application date.

The fourth option is to request the court to provide records during the litigation process. If a medical error, compensation, malpractice, insurance, or administrative lawsuit has been filed, the court can be requested to obtain hospital records from the relevant healthcare institution. The court can request patient files and records directly from the hospital.

Incomplete Submission of Medical Records

In practice, hospitals sometimes only provide the discharge summary report and not other records. However, the discharge summary is a summary of the treatment process; it is not always sufficient. In malpractice cases, the most critical documents are often the surgical notes, anesthesia form, nurse observation chart, medication administration form, intensive care unit records, imaging CD, and consent forms.

Therefore, the patient should not rely solely on the discharge summary. A statement in the discharge summary that "the surgery went smoothly" does not prove that the surgical process was truly flawless. How the surgery was performed, which technique was used, whether there were any complications, what happened during the anesthesia process, and postoperative follow-up records should all be examined separately.

The Constitutional Court's assessment regarding the keeping and submission of medical records is important in this respect. The court has accepted that whether a medical intervention complies with medical standards can largely be determined by examining the records; and that in cases where the responsibility of the healthcare institution cannot be assessed due to the failure to submit information or documents that should be in the patient's file, this should not be interpreted against the patient.

Therefore, if the initial record is incomplete, a second written application should be submitted clearly stating which documents are missing and requesting a certified copy of the entire patient file.

The Right to Request Correction of Medical Records

Patients not only have the right to request records; they can also request the correction of erroneous, incomplete, or unclear records. According to Article 17 of the Patient Rights Regulation, patients can request that incomplete, unclear, or erroneous medical and personal information in their records with healthcare institutions be completed, clarified, corrected, and brought into line with their current health status. This right also includes the right to object to reports concerning their health status and to request the preparation of new reports from the same or other institutions.

This is especially important if incorrect diagnoses, erroneous medications, incorrect reports, procedures not belonging to the individual, or incorrect disease records appear in e-Nabız (the Turkish national health information system). Official announcements state that for requests to change health data, the individual must complete the application form containing their identity and contact information, as well as the diagnosis or information they wish to have corrected or deleted; records such as diagnoses, prescriptions, and reports will be evaluated and corrected by the Ministry.

However, it is important to note that not every diagnosis a patient wants is automatically deleted. A correction can be requested if the record is genuinely incorrect, belongs to the wrong person, or lacks medical or legal basis. But a correct and medically necessary record may not be deleted simply due to the patient's social or personal discomfort. Therefore, the request for record correction must be supported by concrete evidence.

Failure to Provide Medical Records at a Private Hospital

If a private hospital refuses to provide medical records, the patient can exercise their rights under both patient rights and private law. Although a private hospital provides paid healthcare services, it cannot arbitrarily retain a patient's health data. The patient has the right to access their own records.

A private hospital may charge reasonable costs for the reproduction or digital transfer of records; however, these costs should not be exorbitant to the point of hindering access to the records. Withholding documents from a patient may also raise suspicions of evidence tampering, particularly in cases involving malpractice allegations.

When filing a complaint against a private hospital, a written petition, a registered electronic mail (KEP), or a notarized warning can be used first. If no response is received, applications/complaints can be made to the Provincial Health Directorate, the Ministry of Health, and the data controller under the Personal Data Protection Law (KVKK). If a lawsuit is filed due to medical malpractice, the lawsuit petition should specifically state that the hospital did not provide the records or provided incomplete records, and the court should be requested to obtain the entire patient file.

Failure to Provide Medical Records at the State Hospital

If medical records are not provided by a state hospital, administrative appeal procedures are more clearly defined. The patient can apply to the hospital's chief physician, the patient rights unit, the Provincial Health Directorate, the Ministry of Health, and CİMER (the Presidential Communication Center). Furthermore, it is also possible to apply to the public administration responsible for data protection under the Personal Data Protection Law (KVKK).

Records from state hospitals are critically important for future full-fledged legal proceedings. Claims of misdiagnosis, malpractice, surgical malpractice, or negligence in service cannot be effectively pursued through administrative appeals and legal action without medical records.

If a patient is forced to file a lawsuit without being able to obtain their medical records, the lawsuit petition must clearly state that the records are held by the hospital, were not provided despite the patient's written request, and that the court requires their submission. Furthermore, the lack of records should not be considered a factor that increases the patient's burden of proof. The Constitutional Court's approach is also along these lines; the failure of a healthcare institution to provide records in its possession should not be interpreted against the patient.

Could the failure to provide medical records be grounds for compensation?

Failure to provide medical records alone does not always result in high compensation. However, liability for damages may arise if, due to the failure to provide records, the patient was unable to continue their treatment, obtain a second medical opinion, their health deteriorated, their insurance or social benefits application was rejected, their right to sue was effectively hindered, or their personal rights were violated.

Furthermore, the complete absence of medical records, incomplete records, subsequent alterations, or failure to present them to court can have very significant consequences in a malpractice case. The lack of records may indicate that the hospital did not conduct the medical process in a verifiable manner.

According to the Personal Data Protection Law (KVKK), individuals who suffer damage due to the unlawful processing of their personal data have the right to demand compensation for that damage. The Personal Data Protection Authority explicitly states that individuals who suffer damage due to the unlawful processing of their personal data may demand compensation for that damage.

Therefore, the failure to provide medical records may have consequences in terms of evidence evaluation in patient rights applications, GDPR complaints, administrative audits, compensation lawsuits, and malpractice cases, depending on the severity of the incident.

Can family members request medical records?

If the patient is alive, medical records are, as a rule, given to the patient or a person authorized by them. Being a relative of the patient does not always grant the right to receive records. Even if the relative is a spouse, child, mother, or father, the hospital may refuse to give the records directly to the relatives if the patient has the capacity to understand and has not given authorization. This is a consequence of the patient's right to privacy.

However, if the patient is a minor, the guardian may request the records; if the patient is incapacitated, the trustee may request them. If the patient has passed away, the heirs may request records based on their legal interests, such as the cause of death, loss of support, compensation, insurance claims, or criminal investigations. Nevertheless, privacy, third-party data, and a balance of legal interests must be considered when sharing records after death.

If records are requested through a lawyer, having a clear authorization in the power of attorney allowing the lawyer to request health records reduces practical problems. The hospital can verify the lawyer's authority; however, it cannot arbitrarily refuse to provide the records even if a valid power of attorney is presented.

What should be considered when requesting a medical record?

The medical record request form must be clear and well-documented. The form should include the following points:

The patient's identification information, contact address, hospital and department where treatment is received, treatment or surgery dates, a detailed list of the requested records, a request for certified copies or digital copies of the records, and a statement that the application is based on rights under the Patient Rights Regulation and the Personal Data Protection Law, and that administrative and legal remedies will be pursued if no response is received, should be included in the application.

The application may be accompanied by relevant documents such as a photocopy of the identity card, power of attorney, guardianship decision, custody certificate, or, in case of death, inheritance certificate. The application must be registered. A document registration number should be obtained for hand delivery; proof of delivery should be kept for submissions via registered mail, notary public, or registered mail with return receipt requested.

The request for records is also important for any future compensation lawsuit. If the hospital has not provided the records or has provided incomplete records, this can be highlighted separately in the lawsuit petition under the headings of "obstruction of access to evidence" and "failure to submit medical records".

Conclusion: Medical Records Are One of the Patient's Most Fundamental Rights

The withholding of medical records constitutes a serious violation of patient rights, directly affecting the patient's right to access information, learn about their health status, monitor their treatment process, obtain a second medical opinion, and pursue legal remedies. The patient has the right to request their own medical file, discharge summary, surgical notes, consent forms, imaging records, laboratory results, and other documents related to their treatment.

The Patient Rights Regulation clearly stipulates that patients have the right to review and obtain copies of their health files and records. The Personal Data Protection Law (KVKK) recognizes patients' rights to request information about their personal data, to request the correction of incomplete or inaccurate data, and to demand compensation for damages incurred due to unlawful data processing.

If the hospital does not provide the records, the patient must submit a written application, ensure the application is registered, and explore avenues including the patient rights unit, the chief physician's office, the Provincial Health Directorate, the Ministry of Health, CİMER (Presidential Communication Center), and the Personal Data Protection Authority (KVKK). If there is an allegation of medical malpractice, the court should be asked to provide the entire patient file; the lack of records should be evaluated within the framework of the healthcare institution's record-keeping and documentation obligations, not against the patient.

Medical records are not merely documents of past treatment; they form the basis of a patient's future treatment, legal protection, and right to compensation. Therefore, if records are not provided, the process should not be delayed, requests should be made in writing and verifiable, corrections should be requested for incomplete or erroneous records, and if necessary, administrative, criminal, GDPR-related, and compensation avenues should be considered together.