AEPD: Data subject entitled to identity of professionals who accessed medical records

Case No.: EXP202521657 DECISION ON RIGHTS PROCEDURE Having reviewed the complaint filed on October 9, 2025, with this Agency and having carried out the procedural steps provided for in Title VIII of Organic Law Organic Law 3/2018, of December 5, on Data Protection and the Guarantee of Digital Rights (hereinafter, LOPDGDD), the following FACTS FIRST: On October 9, 2025, this Agency received a complaint filed by A.A.A. (hereinafter, the complainant) against the MINISTRY OF DEFENSE (hereinafter, the respondent) for failing to properly uphold the right of access. The complainant states that, on April 7, 2025, he requested an audit of accesses to their medical records, to determine the date, time, identity of the healthcare professional, and purpose of each access; and that, in a letter dated May 9, 2025, the respondent denied the access request pursuant to Article 15.4 of Regulation (EU) 2016/679 (GDPR, hereinafter GDPR) and Article 18.3 of Law 41/2002, of November 14, the basic law governing the Autonomy of the and Rights and Obligations Regarding Clinical Information and Documentation (hereinafter LAP), without providing specific reasons, merely offering a general description of the treatments; and that he suspects unauthorized access to his medical records.

The patient submits, among other documents: - A response from the General Health Inspectorate dated April 30, 2025, in which they state: o “Regarding your access request for an audit of accesses to your from the first medical care received to the present, it is not possible to provide such information in accordance with the provisions of Article 15.4 of the GDPR and Article 18.3 of Law 41/2002, of November 14, the basic law regulating patient autonomy and rights and obligations regarding clinical information and documentation .” or “Regarding the exercise of your right of access to our processing of your data, we inform you of the following  Personal data concerning you is being processed.  Attached is the following information regarding the personal data that pertains to you, as established in Article 15 of the European General Data Protection Regulation (…) And you are hereby informed of the purposes of the processing, the categories of data processed, the recipients or categories of recipients to whom your personal data are disclosed, the 28001 - Madrid 6 sedeagpd.gob.es 2/17 the expected period of storage for the data or the criteria used to determine that period, as well as the existence of the right to request rectification, erasure, restriction of processing, and objection to the processing of your data.

In addition, you are hereby informed of the right to file a complaint with the supervisory authority supervisory authority, that the data was obtained from the data subject during their healthcare, and that there is no automated decision-making or profiling, nor have any data transfers been carried out. SECOND: In accordance with Article 65.4 of the LOPDGDD, said complaint was forwarded to the respondent so that it could analyze it and report to this Agency within one month on the actions taken to comply with the requirements set forth in data protection regulations. The respondent submitted a written response to this Agency dated December 22, 2025, in which, in summary, it states that “(...) the complainant submitted his request for an audit of access to his personal medical records to the Patient Services Department of the Central Defense Hospital on April 11, 2025 (...)”. “The audit of access to the personal medical record requested by the complainant, (...), was based on obtaining personal data from third parties who have access permissions to said record; therefore, in the opinion of the attached Data Protection Officer, a report was sent to the complainant, dated April 30, 2025 (...) was sent to the complainant in response to his complaint, explaining the reasons why access to his data could not be granted based on the provisions of Art 15.4 of the GDPR and Article 18.3 of Law 41/2002, of November 14, the basic law regulating patient autonomy and rights and obligations regarding information and clinical documentation.

The referral letter from the Data Controller addressed to the “The Hospital for delivery to the complainant is dated April 30, 2025 (...)”. “The access request was properly received on two occasions (April 11, 2025, via the Central Defense Hospital, and November 5, November 2025 via the Legal Advisory Office of the Ministry of Defense) and was denied twice (April 30, 2025, and November 27, 2025) on the grounds that it would compromise data from third parties who have access to the patient’s medical records, in accordance with the provisions of Article 15.4 of the GDPR and Article 18.3 of Law 41/2002, of November 14, the basic law regulating patient autonomy and obligations regarding clinical information and documentation.” “The requested responses are provided in the letters dated April 30, 2025, and November 27, 2025, in which the controller informs the complainant of his rights. During this period, on October 8, the complainant sent an email to the data protection office of the General Inspectorate of Health requesting a review of the response regarding the audit log for access to his medical records, to which the by the office of the Deputy DPO on October 9, 2025, stating that his request had already been processed and resolved and that it was not possible for that office to address C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/17 his request again.

On October 9, 2025, he was informed that the Spanish Data Protection Authority is the supervisory authority to which he may turn to file a complaint, in response to his question posed via email on that same day, October 9, 2025.” THIRD: In accordance with Articles 64.1 and 65.5 of the LOPDGDD, the decision on whether to accept or reject the complaint for processing must be notified to the complaining party within three months. If, upon the expiration of this period, such notification has not been issued, and if the complaint concerns the failure to address a request to exercise rights, the procedure shall be deemed to have commenced as of the date on which three months have elapsed since the complaint was received by the Agency. Based on the foregoing, and taking into account that the complaint was filed with this Agency on October 9, 2025, the procedure for addressing the request to exercise rights is considered to have commenced, as three months have elapsed since the request was received by the AEPD.

On January 9, 2026, the complaint was accepted for processing. By decision of the Presidency of the Spanish Data Protection Agency dated February 19, 2026, the respondent was granted a hearing, so that within ten business days it could submit the arguments it deemed appropriate. The respondent filed a brief with this Agency on March 3, 2026, in which it states, in summary and as relevant to these proceedings, that, after receiving from the data protection officer within the Ministry of Defense, a request for “(…) the issuance of a report that includes the tracking of all accesses to the complainant’s Electronic Health Record, a determination of the reasons for the accesses, and verification that there has been no unauthorized access; and, if any access is found to be unjustified, clarification from the healthcare professional regarding the reason for the access. We request the traceability of accesses dating back to the first medical care received at the Hospital, as requested by the complainant in his request.

(…)”, dated January 16, 2026, has been sent to the aforementioned Data Protection Officer Data Protection Delegate the comprehensive report on the audit of access to the complainant’s medical record, along with the conclusions of said audit. Regarding the access request for an audit of the personal medical record submitted to the Patient Care Service of the Central Defense Hospital on April 11, 2025, “(…) The audit of access to the personal medical record requested by the complainant, which is attached as an appendix to this report, was based on the collection of personal data from third parties who have access permissions to said record; therefore, in the opinion of the attached data protection officer attached, a report was sent to the complainant, dated April 30, 2025 (which is on file with the AEPD), responding to his complaint and explaining the reasons why access to his data could not be granted based on the provisions of Article 15.4 of the GDPR and Article 18.3 of Law 41/2002, of November 14, the basic law regulating patient autonomy and rights and obligations regarding information and 28001 - Madrid 6 sedeagpd.gob.es 4/17 clinical documentation.

The referral letter from the Data Controller addressed to the Hospital for delivery to the complainant is dated April 30, 2025, and is attached as Annex 3. In that response letter, you were provided with the relevant information regarding the processing of your data related to the management of your personal medical record.” “(…) 2. On November 12, 2025, the Legal Defense Office received a Notice of Charges and Request for Data Protection Measures submitted by the complainant (attached as Annex 4) reiterating in point 6 of his request the demand for an audit of access to his medical record, including the identification of the healthcare professional, their position, the reason, and the date and time of each access. This access request was part of other complaints related to the indictment of a medical officer for an alleged crime of disclosure of secrets, which is being processed in criminal proceedings within the military jurisdiction.

Once again, the response to the requested right of access was processed through the Defense Legal Office, informing him—as the controller—that it was not possible to provide such access information identifying third parties , based on the provisions of Article 15.4 of the GDPR and Article 18.3 of Law 41/2002, of November 14, the basic law regulating patient autonomy and rights and obligations regarding clinical information and documentation. (Appendix 5)” The respondent notes that, in their second request, the complainant requested: “1. That I be expressly informed whether, following the indictment of (…), specific measures were taken for data protection of my clinical data. 2. If so, that I be provided with details of the specific measures that were implemented. 3. If not, that technical and organizational measures be adopted immediately to ensure that my medical record can only be accessed by professionals with a direct medical justification, excluding access by staff whose impartiality may be compromised by their status as suspects in criminal proceedings or as party witnesses. 4.

Once these measures have been adopted, please inform me of them. 5. Please refer this matter to the competent authority in each case for the adoption and supervision of these measures, and notify me which body is responsible and what specific actions will be taken. “6. I reiterate my request for an audit of access to my medical records, including the identification of the healthcare professional, their position, the reason for access, and the date and time of access. “The response to this request was provided on November 27, 2025, and you were informed that it is not possible to provide the information in accordance with the provisions of Art. 28001 - Madrid 6 sedeagpd.gob.es 5/17 15.4 of the GDPR and 18.3 of Law 41/2002, of November 14, the basic law regulating patient autonomy and rights and obligations regarding clinical information and documentation. It is therefore reiterated that the right of access to the does not include the right to know who has accessed it, as this information is not part of the medical record and, furthermore, pertains to personal data of third parties.

In this most recent complaint, the information sought by the complainant was based on a specific healthcare professional who, apparently, is currently involved in legal proceedings on charges of a criminal offense. It is understood that the appropriate channel for obtaining data regarding access to the medical record and its assessment as justified or improper should be carried out through the courts.” “(…) Based on the checks carried out by the relevant IT services, the existence of medical care episodes corresponding to the complainant has been confirmed dating back to 2016. However, routine, immediate, and automated access is only feasible with respect to clinical information contained in the current system as of the aforementioned technological update carried out in 2023. Any extraction, retrieval, or export of clinical information corresponding to the period between 2016 and 2023 would require the application of on historical databases, which would entail an extraordinary allocation of human and material resources beyond the center’s ordinary operations, as well as a financial cost that is clearly and objectively disproportionate in relation to the means of access that the center makes generally available to patients.

It is confirmed that, as of 2023, there has been no improper or unauthorized access to the claimant’s personal health data, and it has been verified that all accesses were based on a valid legal basis, in accordance with the provisions of Regulation (EU) 2016/679 (GDPR), as well as Organic Law 3/2018, of December 5, on Data Protection and the Guarantee of Digital Rights. Furthermore, it is hereby noted that the processing of the data has been carried out in accordance with the principles of integrity, confidentiality, and data minimisation, and that the health information system of the Gómez Ulla Central Defense Hospital has the necessary control and traceability mechanisms to ensure the security of the processing, in compliance with Article 32 of the GDPR.” “- Finally, submission of the traceability report prepared by the Gómez Ulla Central Defense Hospital regarding the complainant’s unauthorized access to data.

(Appendix 9), which states the following: Appendix 9: Report from the Admissions Department of the “Gómez Ulla” Central Defense Hospital “Regarding the complaint received on 04/11/2025 by the Patient Services Department under reference ***REFERENCE.1, to which the Deputy Data Protection Officer (DPO) of IGESAN responded with 28001 - Madrid 6 sedeagpd.gob.es 6/17 dated April 30, 2025, and a new request with reference number ***REFERENCE.2 dated ***DATE.3, the following specification is provided: The following must be done in advance: Since 2007, this healthcare center has had an Electronic Health Record (HCIS-BALMIS), which underwent a technological upgrade in 2023 and was renamed HCIS- CAJAL. This involved the migration of clinical information generated between 2007 (the date the original system was implemented) and 2023 (the date the updated system became operational). The verification conducted by the IT services confirms the the existence of the claimant’s medical records dating back to 2016; however, ordinary and immediate access is only feasible with respect to the information contained in the system as of the update carried out in 2023.

Any extraction, retrieval, or dumping of information corresponding to the 2016–2023 period would require the use of on historical databases, requiring an extraordinary allocation of human and material resources compared to routine operations, as well as a financial cost that is clearly and objectively disproportionate in relation to the means of access that this center generally makes available to patients on a routine basis. In accordance with Article 18 of Law 41/2002, of November 14, the basic law regulating patient autonomy and rights and obligations regarding clinical information and documentation, the patient has the right of access to the clinical record and to obtain a copy of the data contained therein, under the terms and through the organizational procedures established by healthcare facilities. Likewise, Article 13.4 of Organic Law 3/2018, of December 5, on data protection and Guarantee of Digital Rights provides that when the data subject chooses a method other than the one offered to them that entails a disproportionate cost, the request shall be considered excessive, and the data subject must bear the additional costs resulting from their choice, in which case the controller is only required to satisfy the right of access without undue delay.

In accordance with this regulation, this facility guarantees the complainant immediate access to and receipt of the clinical information available in the HCIS CAJAL system (that is, information corresponding to the period after 2023), as this is considered the proportionate and standard means of exercising the right of access. If the complainant also requests data corresponding to the prior period (2016–2023), a request will first be made for the preparation of the corresponding estimate from the enterprise responsible for managing the HCIS system databases, and the claimant must bear the 28001 - Madrid 6 sedeagpd.gob.es 7/17 the cost of the technical operations necessary for the extraction and provision of said information, under the terms set forth in the aforementioned Article 13.4 of Organic Law 3/2018. Of the data analyzed since 2023: There is only one recorded emergency room visit that took place between ***DATE.1 and DATE.2.

In that instance, the individuals who accessed the patient’s medical record were: a) Emergency room administrative staff who receive the patient and carry out the relevant administrative procedures (they access and review administrative details). b) Healthcare professionals (doctors, nurses, and nursing assistants) who access and review administrative and medical record details for the purpose of providing appropriate care and completing the medical report. On ***DATE.5: Administrative staff from the Billing Department belonging to the Admissions Service consult administrative details of the episode for the billing process of the GRD resulting from said care. On 11/03/2025: Medical staff from the Hospital Administration consult administrative details to verify the existence of the medical record at this hospital and process the request. On 12/18/2025: medical staff (in this case, the undersigned of the traceability report) and administrative staff from the SISANDEF department, part of the Admissions Service, accessed the medical record for the episode to extract the data prior to the preparation of this report.

Based on the foregoing, as requested in the referenced document ***REFERENCE.2 dated ***DATE.3, it is confirmed that every employee of this facility—whether administrative or clinical—who has accessed the has done so with just cause, in a timely and proper manner, and it has been verified that there has been no improper access or access without just cause.” FOURTH: After reviewing the brief submitted by the respondent, it was forwarded to the complainant so that, within ten business days, the complainant could submit any arguments it deemed appropriate. The claimant submitted a brief to this Agency dated March 20, 2026, in which—in summary, and as relevant to the present proceedings—it states that in 2019 it became aware that its personal health information was being circulated among members of its unit. The complainant states that the “First Aid Log” systematically records medical care, sick leave, and service restrictions, and that, with reference to him, on ***DATE.4, there was information regarding where and since when 28001 - Madrid 6 sedeagpd.gob.es 8/17 he was hospitalized (...).

He points out that said logbook lacked guarantees of confidentiality. “(…) Given this situation, I requested an audit of access to my medical records. This audit was granted without objection, was provided in full, and included identification of professionals, dates, and accesses. It revealed that professionals not involved in my care had accessed my medical record, thus confirming the existence of unauthorized access. (…)” The complainant states that, upon learning that charges had been filed against certain staff members, “(…) On April 10, 2025, I submitted a request for an audit of access logs and information regarding specific security measures, given the charges for a highly sensitive crime involving hospital staff. (…) The response I received was a denial based on data protection for third parties and alleged technical difficulties. However, the requested information pertains exclusively to my own data; this had already been provided previously (a prior audit had been granted), and the data controller himself acknowledges having accessed said information (since 2023, with my request covering the preceding period).

(…) The argument regarding technical costs lacks legal merit: ● the data exists ● it has been processed ● it was previously provided The exercise of rights cannot be limited for internal organizational reasons.” FIFTH: After the respondent was granted a hearing, it submitted a brief to this Agency dated April 1, 2026, in which—in summary and as far as the present proceeding is concerned—it states that: “With regard to the complaint now set forth in the body of the complaint, this controller considers that this is a new complaint, concerning an activity whose processing falls outside the scope of authority entrusted to the General Inspectorate of Defense Health. The activity, the processing of which is the subject of the current complaint, takes place within the scope of the Central Defense Academy, a body that reports, both organizationally and functionally, to the General Subdirectorate of Education, which in turn reports to the Undersecretary of Defense.

The Controller, therefore, would not be this General Inspectorate of Defense Health, but rather a body reporting to the Undersecretary of Defense, such as the General Directorate of Education of the Ministry of Defense.” “(…) With regard to the current notification from the AEPD regarding the hearing process and submission of arguments received on March 20 and 24, 2026, this controller considers this to be a new complaint filed by the complainant. 28001 - Madrid 6 sedeagpd.gob.es 9/17 The complaint is based on facts relating to an activity whose processing of personal and health data falls outside the scope of action and jurisdiction assigned to the General Inspectorate of Defense Health. The activity, the processing of which is the subject of the current complaint, takes place within the scope of the Central Defense Academy, a body that reports, both organizationally and functionally, to the Subdirectorate General of Education (General Directorate of Education), which in turn reports to the Undersecretary of Defense.

The Controller, therefore, would not be this General Inspectorate of Defense Health, but rather a body reporting to the Undersecretary of Defense; specifically, it would be the General Directorate of Education of the Ministry of Defense. For this reason, with regard to the request to submit the appropriate arguments to be made by this controller, it is not necessary to add anything further to the arguments that have already been submitted previously, in relation to facts arising from the data processing carried out within the scope of the General Inspectorate of Defense.” LEGAL GROUNDS I Jurisdiction In accordance with the powers granted by Article 58(2) of the GDPR to each supervisory authority, supervision and as established in Articles 47, 48.1, and 64.1 of the LOPDGDD, the Presidency of the Spanish Data Protection Agency has jurisdiction to rule on this proceeding. Likewise, Article 63.2 of the LOPDGDD provides that: “Proceedings handled by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, this Organic Law, the regulatory provisions adopted to implement it, and, to the extent they do not conflict with them, on a subsidiarily, by the general rules on administrative procedures.”

II Preliminary Issues In accordance with the provisions of Article 55 of the GDPR, the Spanish Data Protection Agency is competent to perform the functions assigned to it in Article 57, including enforcing the Regulation and promoting awareness among controllers and processors regarding their obligations, as well as handling complaints filed by a data subject and investigating, to the extent appropriate, the grounds for such complaints. Correspondingly, Article 31 of the GDPR establishes the obligation of controllers and processors to cooperate with the supervisory authority upon request in the performance of its duties. In the event that they have designated a 28001 - Madrid 6 sedeagpd.gob.es 10/17 data protection officer, Article 39 of the GDPR assigns to the officer the role of cooperating with said authority. In accordance with these regulations, and following the procedure set forth in Article 65(4) of the LOPDGDD, prior to the acceptance for processing of the complaint regarding the exercise of the rights regulated in Articles 15 through 22 of the GDPR—which gave rise to the present proceedings, the complaint was forwarded to the respondent so that it could review it, respond to this Agency within one month, and provide evidence that it had provided the complainant with the appropriate response.

The outcome of this referral did not satisfy the claims of the complaining party. Consequently, on January 9, 2026, for the purposes set forth in Articles 64.1 and 65 of the LOPDGDD, the complaint was accepted for processing. This acceptance for consideration triggers the initiation of the present proceeding regarding the failure to respond to a request to exercise the rights established in Articles 15 through 22 of the GDPR, as regulated by Article 64.1 of the LOPDGDD, according to which: “When the proceeding relates exclusively to the failure to respond to a request to exercise the rights established in Articles 15 through 22 of the Regulation (EU) 2016/679 of the European Parliament and of the Council, dated April 27, 2016, it shall be initiated by a decision to accept the case for processing, which shall be adopted in accordance with the provisions of article 65 of this Organic Law. In this case, the time limit for resolving the proceeding shall be six months from the date on which the complainant was notified of the decision to accept the case for processing.

Once that period has elapsed, the data subject may consider his or her complaint to have been upheld.” Article 58(2) of the GDPR grants the Spanish Data Protection Agency a series of corrective powers for the purpose of addressing any violation of the GDPR, including “ordering the controller or processor to comply with requests to exercise the data subject rights under this Regulation.” III Individuals’ Rights Regarding Personal Data Protection Individuals’ rights regarding personal data protection are governed by Articles 15 through 22 of the GDPR and Articles 13 through 18 of the LOPDGDD. These include the rights of access, rectification, erasure, objecting, the right to restriction of processing, and the right to data portability. The formal requirements regarding the exercise of these rights are set forth in Article 12 of the GDPR and Article 12 of the LOPDGDD. The provisions of Recitals 59 et seq. of the GDPR are also taken into account. 28001 - Madrid 6 sedeagpd.gob.es 11/17 In accordance with the provisions of these regulations, the controller must establish procedures and mechanisms to facilitate the data subject’s exercise of their rights, which shall be provided free of charge (without prejudice to the provisions of Articles 12.5 and 15.3 of the GDPR), and is required to respond to requests within one month at the latest, unless the controller can demonstrate that it is unable to identify the data subject, and to state its reasons in the event that it does not comply with such request.

The burden of proof regarding compliance with the duty to respond to a request by the data subject to exercise their rights rests with the data controller. Any communication addressed to the data subject in response to their request must be concise, transparent, intelligible, and easily accessible, using clear and simple language. IV Right of Access In accordance with the provisions of Article 15 of the GDPR and Article 13 of the LOPDGDD, “the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, if so, the right of access to the personal data.” With regard to the right of access to personal data, in accordance with the provisions of Article 13 of the LOPDGDD, when the exercise of this right involves a large volume of data, the data controller may request that the data subject specify the “data or processing activities to which the request refers.”

The right shall be deemed granted if the data controller provides remote access to the data, and the request shall be considered fulfilled (although the data subject may request information regarding the matters provided for in Article 15 of the GDPR). The exercise of this right may be considered repetitive if it is exercised more than once within a six-month period, unless there is a legitimate reason for doing so. Furthermore, the request will be considered excessive when the data subject chooses a means other than the one offered to them that entails a disproportionate cost, which must be borne by the data subject. Like the data subject’s other rights, the right of access is a strictly personal right. It allows the individual to obtain information about the processing of their data, the possibility of obtaining a copy of the personal data concerning them that is being processed, as well as information, in particular, regarding the purposes of the processing, the categories of personal data involved, the recipients or categories of recipients to whom the data may be disclosed, the anticipated storage period or storage criteria, the possibility of exercising other rights, the right to file a complaint with the supervisory authority, available information regarding the origin of the data (if it was not obtained directly from the data subject), the existence of automated decision-making, including profiling, and information regarding data transfers to a third country or an international organisation.

The right to 28001 - Madrid 6 sedeagpd.gob.es 12/17 obtain a copy of the personal data being processed shall not adversely affect the rights and freedoms of others. The right of access with respect to medical records is specifically regulated in Article 18 of the LAP, which states: "1. The patient has the right of access, subject to the reservations set forth in paragraph 3 of this article, to the medical record documentation and to obtain a copy of the data contained therein. Healthcare facilities shall establish procedures that ensure compliance with these rights. 2. The patient’s right of access to medical records may also be exercised through a duly authorized representation. 3. The patient’s right of access to the medical record documentation may not be exercised to the detriment of third parties’ right to confidentiality regarding the data contained therein that was collected in the patient’s therapeutic interest, nor to the detriment of the rights of the professionals involved in its preparation, who may invoke the confidentiality of their subjective notes as a basis for denying the right of access. 4.

Healthcare facilities and individual practicing physicians shall only grant access to the medical records of deceased patients to persons with a familial or de facto relationship to the patient, unless the deceased had expressly prohibited such access and this is substantiated. In any case, a third party’s access to the medical record motivated by a risk to their health shall be limited to the relevant data. No information shall be disclosed that affects the privacy of the deceased or the subjective notes of the professionals, nor that harms third parties.” In this regard, it is important to highlight Article 15 of the LAP, which sets forth the minimum content of the medical record: “1. The medical record shall include information deemed essential for an accurate and up-to-date understanding of the patient’s health status. Every patient or user has the right to have a record, in writing or in the most appropriate technical format, of the information obtained during all their care processes, carried out by the health service in both primary care and specialized care settings. 2.

The primary purpose of the medical record is to facilitate health care, documenting all data that, based on medical judgment, provides an accurate and up-to-date understanding of the patient’s health status. The minimum content of the medical record shall be as follows: a) Documentation related to the clinical-statistical form. b) The admission authorization. c) The emergency report. d) The medical history and physical examination. e) The patient’s progress. f) Medical orders. 28001 - Madrid 6 sedeagpd.gob.es 13/17 g) The consultation form. h) Reports of diagnostic tests. i) The informed consent form. j) The anesthesia report. k) The operating room report or delivery record. l) The pathology report. m) Progress notes and nursing care planning. n) Therapeutic nursing interventions. ñ) Vital signs chart. o) The clinical discharge summary. Paragraphs b), c), i), j), k), I), ñ), and o) are required only when completing the medical record in cases of hospitalization or as otherwise provided. 3.

The completion of the medical record, with regard to aspects related to direct patient care, shall be the responsibility of the professionals involved in that care. 4. The medical record shall be maintained according to criteria of consistency and integration, at a minimum within each healthcare institution, to facilitate the best and most timely understanding by physicians of a specific patient’s data in each care process.” Regarding the storage of medical records, Article 17 of the LAP, in its paragraphs 1 and 5, provides that: “1. Healthcare facilities are required to ensure the storage of clinical records under conditions that ensure their proper maintenance and security, though not necessarily in their original format, to provide appropriate patient care for the period of time appropriate to each case and, at a minimum, for five years from the date of discharge for each care episode (...) 5.

Healthcare professionals who practice independently are responsible for the management and safekeeping of the care records they generate.” V Conclusion Before addressing the merits of the case, a number of considerations must be made: - The rights proceeding has been initiated as a result of a failure to comply with any of the rights regulated by data protection legislation. Therefore, in the present case, only the facts relating to the exercise of these rights will be analyzed and assessed, leaving aside the rest of the issues raised by the parties. - This proceeding is initiated following a complaint filed with this Agency when a right is exercised against a controller and 28001 - Madrid 6 sedeagpd.gob.es 14/17 the data controller fails to respond, or, if responding, fails to address the request or fails to deny it with proper justification, within the timeframe established in the data protection regulations.

In the present case, the claimant exercised its right twice before the respondent; one of these instances, on April 11, 2025, the failure to provide proper response gave rise to these proceedings; and a second exercise on November 5, 2025, which occurred while these proceedings were already under way. The second exercise of the right will be analyzed within the framework of these proceedings, since it is a reiteration of the first exercise and not a new exercise of the right. - The complaint must be filed against the responsible party before whom the right was previously exercised. Therefore, the claimant’s statements regarding the “First Aid Kit Log” will not be taken into account. In this case, and in light of the foregoing, the present proceeding concerns the denial of the requested right of access against the Ministry of Defense (General Inspectorate of Health) on April 11, 2025. In the present case, it has been established that the claimant requested that the respondent to disclose who accessed their clinical data, as well as the dates and purposes of such access, and that the respondent denied this request because “(…) it is not possible to provide such information in accordance with the provisions provisions of Article 15.4 of the GDPR and Article 18.3 of Law 41/2002, of November 14, the basic law regulating patient autonomy and rights and obligations regarding clinical information and documentation.”

Article 15 of the GDPR grants the data subject the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, if so, the right of access to the personal data; this right is embedded within the framework of the principles of processing established in Article 5 of the GDPR, in particular the principle of transparency (Article 5.1.a of the GDPR), as well as the requirement for proactive accountability on the part of the controller (Articles 5.2 and 24 of the GDPR) and the requirement to implement appropriate technical and organizational measures by design and by default (Article 25 of the GDPR), which must ensure, among other aspects, the traceability and control of access to personal data. Likewise, the right of access constitutes a manifestation of the fundamental right to data protection, understood as the data subject’s right to control their data, including the right to know who holds it and for what purpose it is processed.

The CJEU, in its judgement of June 22, 2023 (Case C-579/21), has held that the right of access is not an absolute right and that, as a general rule, it does not necessarily entail the disclosure of the identity of natural persons 28001 - Madrid 6 sedeagpd.gob.es 15/17 within the controller’s organization who have accessed the data; this requirement may be satisfied by indicating categories of professionals, unless such identification is necessary to ensure the effective exercise of the data subject rights and taking into account the rights and freedoms of those employees. However, this interpretation must be contextualized within the framework of the regulatory evolution of Union law, particularly in sectors characterized by intensive processing of special categories of data, such as the healthcare sector. In this regard, Regulation (EU) 2025/327 of the European Parliament and of the Council, of February 11, 2025, on the European Health Data Space, and amending amends Directive 2011/24/EU and Regulation (EU) 2024/2847 (hereinafter, the EEDS Regulation), which is in force as of the date of this resolution—even though it is not applicable until March 26, 2027, under the terms set forth in Article 105 thereof, introduces a heightened standard of transparency regarding access to electronic health data, which charts a new course that must be taken into account in this interpretation, particularly in Article 9, which recognizes the right to obtain information regarding access to electronic health data in the following terms: “1.

Natural persons shall have the right to obtain information, including through automatic notifications, regarding any access to their personal electronic health data through the access service provided by healthcare professionals in the context of healthcare, including access provided in accordance with Article 11, paragraph 5. 2. The information referred to in paragraph 1 shall be provided, free of charge and without delay, through electronic health data access services and shall be available for at least three years from the date of access to the data. That information shall include, at a minimum, the following: a) information about the healthcare provider or any other person who has accessed the personal electronic health data; b) the date and time of access; c) the personal electronic health data that has been accessed. 3. Member States may provide for limitations on the right referred to in paragraph 1 in exceptional circumstances, where there are concrete indications that disclosure would jeopardize the vital rights or interests of the healthcare professional or the care provided to the natural person.”

This sector-specific regulation, adopted in light of the particular sensitivity of health data (classified as special categories of data under Article 9 of the GDPR) and the significant risks to the rights and freedoms of data subjects, reinforces the substantive content of the right of access with respect to information on accesses, establishing a model based on full traceability and effective control by the patient. 28001 - Madrid 6 sedeagpd.gob.es 16/17 Although these obligations are not currently enforceable, to the extent that the EEDS Regulation has entered into force, it is considered that, in light of this regulatory framework, the interpretation most consistent with Union law requires that that, as a general rule, the right of access to information regarding access to health data includes the identification of the persons who have accessed such data, to the extent that such identification is necessary to ensure the transparency of the processing and effective control of its lawfulness.

However, in accordance with the case law of the Court of Justice and the principle of proportionality governing the application of the GDPR, this right is not absolute. Consequently, the disclosure of an individual’s identity may, in exceptional cases, be restricted may be exceptionally restricted when specific circumstances justify it, whether due to an express statutory provision or as a result of an appropriate balancing of the rights and interests at stake, particularly when the disclosure of such identity is disproportionate or unnecessary for the intended supervisory purpose. In such cases, the controller must be able to demonstrate, in accordance with the principle of proactive accountability (Articles 5(2) and 24 of the GDPR), that the restriction of processing is duly justified and documented. Consequently, an interpretation that generally and automatically excludes the disclosure of the identity of individuals accessing the data does not comply with the heightened standard of transparency required in the healthcare sector; such a restriction must be treated as a duly justified exception rather than the general rule.

Therefore, the respondent must grant the right of access to the identity of the individuals who have accessed the claimant’s health data or duly justify the denial of that right based on one of the circumstances mentioned above, which does not appear to have been done in the present case. The conduct under review constitutes a breach of the duty to respond in a timely and complete manner to a request to exercise the right of access, as recognized in Article 15 of the GDPR, in conjunction with Articles 12 of the GDPR and 12 of the LOPDGDD, which impose on the controller the obligation to respond within a maximum period of one month, providing the requested information or, where applicable, adequately justifying a total or partial denial. Consequently, the complaint must be upheld, as the right of access was not fully honored in accordance with the terms set forth above. In view of the aforementioned provisions and other generally applicable provisions, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO UPHOLD the complaint filed by A.A.A., on the grounds that there has been a violation of the provisions of Article 15 of the GDPR, and to urge the MINISTRY OF DEFENSE, with Tax ID No. S2801407D, para, within ten business days 28001 - Madrid 6 sedeagpd.gob.es 17/17 following notification of this decision, to provide the complainant with a written statement either granting the requested right or denying it with justification, specifying the reasons why the request cannot be granted, in accordance with the provisions set forth in the body of this decision.

Any actions taken as a result of this Decision must be reported to this Agency within the same timeframe. Failure to comply with this decision could constitute a violation of Article 83.6 of the GDPR, classified as very serious for the purposes of the statute of limitations set forth in Article 72.1.m) of the LOPDGDD, which shall be sanctioned in accordance with Article 58.2 of the GDPR. SECOND: NOTIFY A.A.A. and the MINISTRY OF DEFENSE of this resolution. In accordance with the provisions of Article 50 of the LOPDGDD, this Decision shall be made public. Publication shall take place once it has been notified to the data subjects. Against this decision, which concludes the administrative proceedings pursuant to Article 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the data subjects may, at their discretion, file a motion for reconsideration with the Presidency of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file a contentious-administrative appeal with the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law. Lorenzo Cotino Hueso President of the Spanish Data Protection Agency 28001 - Madrid 6 sedeagpd.gob.es