Told to Ask His Insurer for His Own Medical File, He Waited Fourteen Months. Portugal's Health Regulator Has Now Ruled

A man injured at work went to the clinic that treated him and asked for his own medical history. He was told the clinic had orders not to release it without the insurer's permission. That was December 2024. He received the file in February 2026, fourteen months later, days after Portugal's health regulator opened an inquiry into the clinic.

The case is set out in deliberation ERS/002/2026, one of two decisions the Entidade Reguladora da Saúde approved on 17 April and published on its website on 9 September. Both concern the same thing: a provider refusing a patient access to their own clinical record. Both were sent to the Comissão Nacional de Proteção de Dados.

What the two cases were

In the first, the provider, Farortopédica Lda., told the patient in writing that because he had been seen under a workplace accident policy, he should direct the request to the insurer, which was "the competent entity to provide you with all the medical information". The ERS found that this is not how the law works. When the file finally arrived, the patient wrote back noting the "happy coincidence" of its timing relative to the opening of the inquiry. The regulator recorded that the provider had shown no recognition that its conduct was irregular and had adopted no internal measures to change it.

In the second, ERS/004/2026, a woman who had a hearing test at a Belaudição shop in Ermesinde was refused her audiogram. The company's position, maintained right through the proceedings, was that no clinical record exists: the checks it performs produce no clinical reports, only technical information for programming a hearing aid, so there is nothing it is obliged to hand over. The ERS rejected that and issued an order, not merely an instruction, requiring the company to prove it had delivered the results in full and free of charge, within five working days.

The rule the regulator keeps restating

Neither decision breaks new ground. Both apply Supervision Alert n.º 3/2023, which the ERS issued in November 2023 precisely because complaints kept arriving. Its terms are worth quoting because they answer most of the excuses patients encounter.

• Where care is given under an insurance policy, the provider must hand the record to the patient freely and free of charge, and may not refer the decision to the insurer, which in turn may not hinder or condition access.
• The same applies where care is given under an employment contract, including occupational health, with the employer in the insurer's place.
• Results of tests offered free of charge, including promotional screenings, must be given to the patient on request, whether or not they go on to be treated there.
• Records must be locatable and available at the provider's premises at all times.
• No justification, motivation or purpose may be demanded of a legitimate requester.
• The request does not have to be made in a consultation with the doctor, and it is not the doctor's decision to make.

What this means for you

• Ask at reception, in writing, and keep the copy. Both deliberations turned on a documented refusal. A verbal "no" is much harder to take anywhere.
• "Ask your insurer" is not a lawful answer. Nor is "ask your employer", nor "that is a technical record, not a clinical one". The ERS has now ruled against all three.
• You do not have to say why you want it. Wanting a second opinion, or wanting to change provider, is reason enough and you need not state it.
• Complain to the ERS, and consider the CNPD. The regulator takes complaints through its online reclamações form, and it routinely copies these decisions to the data protection authority. Ignoring an ERS decision is an administrative offence carrying a fine of 1,000 to 44,891.81 euros.

The right itself rests on Lei n.º 12/2005 and Lei n.º 15/2014 and on the GDPR, and it applies to public, private, cooperative and social providers alike. If you hold private health insurance in Portugal, the first case is the one to remember: the policy pays for the care, but the record is still yours.