VURAL
ESCAENContact
← All articles

Patient records: what they include and who keeps them

18 October 2026

Filing cabinet with medical records in a clinic

Patient records are the set of documents holding the data, assessments and information about a person's clinical situation and progress while they are being treated. In Spain, this is what the law calls the historia clínica (clinical record), and the centre that treats the patient is responsible for it. If you run a physiotherapy clinic, a dental practice or a beauty salon, you need to be clear about two things: what counts as a clinical record (with legal obligations) and what is simply information about appointments and how you deal with the customer.

In this guide we explain it step by step, with the official sources, and show you how to keep the two worlds apart so you can work in a more orderly way.

Vural
Organise your appointment book better
Vural handles bookings and basic enquiries on WhatsApp, even outside working hours, respecting your business's terms and prices.
Discover Vural

TL;DR

  • The clinical record must be kept for at least five years after discharge from each episode of care, and some Spanish regions require longer.
  • Patients can ask for access and a first free copy. The general deadline for replying is one month.
  • Custody and security are the centre's responsibility, not the patient's, nor that of the tool you use.
  • Your appointment history (appointments, preferences, deposits, cancellations) is something else: it helps you serve people better, but it does not replace the clinical record.
  • Keeping the two apart saves you legal mistakes and hours of admin.

Contents

What patient records are and why they get confused so often

When someone searches for “patient records” they may mean three different things:

  1. The clinical record: the medical file with diagnoses, tests and progress.
  2. The appointment history: when they came, which service they had, with whom and whether they cancelled.
  3. The relationship history: preferences, how they like to be spoken to, whether they usually pay a deposit, which times suit them.

Law 41/2002 defines the clinical record as the set of documents containing data, assessments and information of any kind about a patient's clinical situation and progress throughout the care process. That is what is regulated in detail. Points 2 and 3 are management information for your business, although, if they include health data, they also call for care.

Mixing them up is the most common mistake. A WhatsApp chat in which a patient describes their injury is not a clinical record, but it is not a place to store diagnoses either. Further down we look at how to draw the line.

What a clinical record must include

The exact structure depends on the speciality and on each region's rules. As a general reference, the clinical record templates published by professional portals include these sections:

  • Patient identification details.
  • Reason for the visit.
  • Personal and family history.
  • Examination and tests carried out.
  • Diagnosis and treatment plan.
  • Progress and follow-up.
  • Informed consent forms, where applicable.

In a physiotherapy clinic, for example, this means the initial assessment, the session plan, the progress at each session and the discharge report. In a dental clinic, the dental chart, the treatments and the accepted quotes.

What is not a clinical record

This information usually lives in the appointment book and is not part of the medical file:

  • The time and day of each appointment.
  • The reminders sent.
  • Cancellations and no-shows.
  • Payment of a deposit.
  • A preference for a particular professional.

This information is useful, but the clinical value lies in what the professional records during the care itself. If an appointment entry reflects health information (for example, “coming in for a torn ligament”), treat it with the same care as any health data.

How long you must keep the records

The national rule sets a minimum. Under Law 41/2002, clinical documentation must be kept for at least five years from the date of discharge from each episode of care. And the obligation to guarantee the security, proper storage and retrieval of the information applies whatever the medium: paper, audiovisual or digital.

Two practical points:

  • The period runs per episode, not per patient. If someone comes back to your centre with a different injury, a new episode of care begins.
  • Your region may require more. The AEPD points out that retention periods can vary between regions. Before destroying old files, check the regional rules that apply to you.

A patient who stops coming is no reason to delete their file. As long as the period is still running, you keep it.

Patients' rights over their records

Patients have the right to access their clinical record. The AEPD (Spain's data protection authority) summarises, on its page about rights relating to health data, what you should have ready at your centre.

Access and copies

  • Patients can access the documents in their clinical record and obtain a copy.
  • The first copy is free.
  • The centre must set out a procedure for exercising this right and, in general, reply within one month. That period can be extended depending on how complex the request is.
  • If they ask for further copies, the centre may charge the associated costs.

Limits on access

The right is not unlimited. According to the same source, it cannot be exercised to the detriment of the confidentiality of third parties who appear in the record for therapeutic reasons. Nor does it extend to professionals' subjective notes, if they have objected to those being handed over.

There is another point that is much debated. A report by the AEPD on access to clinical records deals with whether patients can find out the identity of the professionals who have accessed their record. Access to the record is not the same as an audit of the staff.

How to handle a request without surprises

  1. Check the identity of the person asking for the file. If it is a relative, check what proves their right.
  2. Record the date of the request.
  3. Gather the complete documentation and check whether it contains third-party data.
  4. Hand over the first copy free of charge.
  5. Keep a record of what was handed over and when.

If the patient asks for it at a hospital, the channels are different. For example, La Fe in Valencia and Sant Joan de Déu in Barcelona publish their own procedures. In your private practice, you define the procedure, but it must exist and be in writing.

Who is responsible for the security of the records

This is the point that most surprises people opening a centre. The AEPD states that the centre is responsible for keeping the clinical record safe and for applying security measures that prevent unauthorised access. Storing the data is not enough: you must be able to show that access is controlled, under both the Patient Autonomy Act and the GDPR.

AEPD Guide for healthcare professionals is the reference document for reviewing the legal bases for processing. Read it carefully once and keep it to hand.

A short list of checks:

  • Access by role. Each member of the team sees only what they need.
  • Individual passwords. No shared logins at the front desk.
  • Backups. With a named person in charge and a clear procedure.
  • Contracts with suppliers. If a tool processes data on your behalf, review its terms and its privacy policy.
  • Paper under lock and key. Paper files count too.

If you work with external tools, the responsibility does not go away. It is still yours as the centre. That is why each tool should have a clear, limited role.

Clinical records and appointment history: where to draw the line

Here is the practical decision. We suggest a simple split.

Information Where it lives Who manages it Diagnosis, examination, progress, reports Your clinical records system The healthcare professional Informed consent forms Your clinical records system The centre Past and future appointments The appointment book Reception or assistant Cancellations, no-shows, waiting list The appointment book Reception or assistant Deposits and payments The appointment book and payment management Reception or assistant Time and service preferences The customer file in the appointment book Reception or assistant

The rule is simple: what the professional assesses and decides stays in the clinical record; what organises the day-to-day stays in the appointment book. That way, someone who messages on WhatsApp at eleven at night to change their appointment does not need anyone to open their clinical file.

An example of an ordinary day at a physiotherapy clinic

  • 08:30. A patient arrives for their fourth session. The physio opens the clinical record and notes their progress.
  • 13:00. A patient messages on WhatsApp to cancel her afternoon appointment. The slot is freed up.
  • 13:02. Someone on the waiting list is told about the free slot.
  • 22:40. A new patient asks whether there is an appointment on Thursday. They get a reply and book without waiting until the next morning.

On that day, the clinical record only comes into the first scene. The rest is appointments and communication. If you want to see how this works in a practice's day-to-day, we have a guide on how to automate physiotherapy appointments with AI and WhatsApp.

What a good appointment history gives you

Even though it is not a clinical record, the appointment history improves the service you give. These are the clearest uses:

  • Recognising regular customers. Knowing which service they had last time and with whom.
  • Offering the right slot. If they always come in the afternoon, you don't suggest nine in the morning.
  • Spotting repeat no-shows. And deciding when it makes sense to ask for a deposit. We have an article on advance payment for appointments.
  • Sending the right reminder. With the message and timing that work; we explain it in an article on WhatsApp appointment reminders.
  • Filling slots. When someone cancels, the waiting list lets you fill the session again.

None of this requires opening a diagnosis. It requires organising well what you already know from your contact with the customer.

How to organise the records step by step

Six steps to organise patient records

1. Decide what data you collect

Make a list of what you ask for at the first appointment and what each item is for. If you don't know what it is for, don't ask for it.

2. Keep the systems separate

Clinical records in one place with access control. Appointments and messaging in another. Avoid pasting reports into chats.

3. Write down your access procedure

One page saying who receives the request, who approves it and how quickly it is answered. With one month as the ceiling, not the target.

4. Set your retention periods

Note the national minimum and check whether your region requires more. Schedule a yearly review to decide which files have reached the end of their period.

5. Train the team

A short session is enough: what can be written on WhatsApp, what can't, and whom to tell when in doubt.

6. Review your suppliers

Read their terms and privacy policy. Ask what data they process, where, and what happens if you cancel the service.

Our view

Our view — overview diagram

That is why we argue for separating roles. The clinical record is a legal responsibility of the centre and should sit in a system designed for it. The appointment book and the conversation with the customer are something else: this is where an AI assistant takes repetitive work off your hands, such as booking, changing or cancelling appointments. And it does so with the terms and prices you set, in your business's tone.

Our advice is practical: don't ask any messaging tool to act as a clinical archive, and don't ask your clinical archive to act as a receptionist. Everything in its place, with clear access rights and a written procedure. If you are unsure about processing health data in your case, check with your data protection officer or a specialist adviser.

How Vural helps you with your appointment book

Vural is an AI virtual assistant that manages your appointment book and bookings on WhatsApp, including outside opening hours. It books, changes and cancels appointments, keeps a file for each customer and connects to Google Calendar. On the Pro and Premium plans it keeps a waiting list and prepares the business report, and on Premium it takes the deposit with Stripe at the time of booking. We charge no commission per booking and there is no minimum term.

There are four plans: Inicial, at €79 a month, and these three:

Plan Price Esencial €199 a month Pro €399 a month Premium €999 a month

Prices exclude VAT. On top of this there is a one-off, fixed-price setup fee: €480 on Inicial, €900 on Esencial, €1,200 on Pro and from €1,800 on Premium. You can also add more AI conversations in packs of 250. The monthly fee starts once it is up and running. See all the details at vural.io.

If you want to know how we handle your customers' data, read the service privacy notice and the terms of service, which explain the fee, cancellation and what happens to the data.

Common mistakes with patient records

  • Destroying files after five years without checking regional rules. A longer period may be required.
  • Handing over “everything” without reviewing it. There is third-party data and subjective notes that need special treatment.
  • Charging for the first copy. The first one is free.
  • Using WhatsApp as a clinical archive. Reports and diagnoses belong in the clinical records system.
  • Having no written procedure. If a request arrives and nobody knows what to do, you lose time from the deadline.
  • Assuming the supplier takes care of it. Responsibility for custody remains with the centre.

Frequently asked questions

What goes into a clinical record?

It includes identification details, reason for the visit, history, examination, tests, diagnosis, treatment and progress. In many cases informed consent forms are attached as well. The exact content varies by speciality and region.

How long must a patient's clinical record be kept?

For at least five years after discharge from each episode of care, under Law 41/2002. Some regions set longer periods, so you should check the rules where you are before destroying anything.

Can a patient ask for their records, and how long does it take to receive them?

Yes. They have a right of access and to a first free copy. In general, the centre must provide it within one month, which can be extended depending on complexity. Further copies may be charged for.

Can I keep my patients' records on WhatsApp?

It is not advisable. WhatsApp is for managing appointments and answering basic enquiries, but clinical documentation must be in a system with access control and backups. The centre is responsible for custody, whatever the medium.

Sources

Recommendations

More articles