In Chile, the medical record (ficha clínica) is the mandatory record of each patient's healthcare, and all the information it contains is sensitive data. Only the patient, their representative and the persons listed in article 13 of Law 20.584 may see it. It is kept for at least fifteen years and, from December 1, 2026, it will also be subject to Law 21.719.
The essentials in 30 seconds
- All the information in a medical record is sensitive data (article 12 of Law 20.584).
- Only the persons listed in article 13 may see it; the healthcare provider's staff who are not involved in the care may not.
- It is kept for at least fifteen years from the last entry of information (Decree 41 of 2012).
- Law 21.668, of 2024, requires healthcare providers to adopt interoperability measures.
- From December 1, 2026, Law 21.719 will require impact assessments (DPIA), breach notification and contracts with suppliers.
In Chile, medical records are governed by Law 20.584, known as the law on patients' rights and duties, and by its regulation, Decree 41 of 2012 of the Ministry of Health. In 2024, Law 21.668 added to Law 20.584 the duty to adopt interoperability measures. If you want the full picture, start with our guide to the data protection law in Chile.
Law 19.628 already applies to them today, because article 13 of Law 20.584 makes healthcare providers responsible for complying with it. From December 1, 2026, that law will be rewritten by Law 21.719, which overhauls Chile's personal data protection law. The overall picture is in the summary of Law 21.719. Sources reviewed on October 21, 2026.
What is a medical record under Law 20.584?
A medical record is the mandatory instrument in which a person's health history is recorded, held in custody by the healthcare providers that delivered the care. Under article 12 of Law 20.584, its purpose is to bring together the information from the care process and to enable continuous, coordinated care.
It may be kept on paper or in electronic form, provided the records are complete and timely access, preservation, confidentiality and authenticity are ensured. Decree 41 sets out its minimum content: identification of the patient and of the provider, a chronological record of the care provided, and the patient's decisions, such as informed consents and refusals of treatment (article 6).
All of that information is sensitive data: article 12 so provides by reference to letter g) of article 2 of Law 19.628, which today includes «physical or mental states of health» and from December 1, 2026 will read «data relating to health, to the human biological profile». More in sensitive data.
Who can access a medical record?
Third parties who are not directly involved in the care have no access to the record, and that includes the healthcare and administrative staff of the same provider who do not take part in it (article 13 of Law 20.584). The same provision lists who may obtain it, upon express request:
| Who | Condition |
|---|---|
| The data subject (the patient), their legal representative or their heirs | Express request; heirs only if the data subject has died (letter a). |
| A third party authorized by the data subject | A simple power of attorney before a notary, or one signed with an electronic system that guarantees its authenticity (letter b). |
| Courts of law | If the information relates to the cases before them (letter c). |
| Prosecutors of the Public Prosecutor's Office and lawyers | With prior authorization from the competent judge, if it is directly linked to the investigation or defence they are in charge of (letter d). |
| Public Health Institute and Ministry of Health | In the exercise of their powers (letter e). |
| Superintendency of Health | To oversee and sanction healthcare providers (letter f). |
| The individual healthcare provider and the professionals directly involved in the care | The data essential for continuity of care (letter g). |
| Superintendency of Social Security, medical reviewers of the Preventive Medicine and Disability Commissions (COMPIN) and professionals who issue medical leave certificates | Regarding the condition that gave rise to the medical leave (letter h). |
Those who access it must safeguard its confidentiality and use the information only for the purpose for which it was requested. Decree 41 also requires internal access to be controlled and a log to be kept of the dates on which each record was consulted and the persons who consulted it (article 9). Insurers and employers are not on the list, so article 13 leaves them only the letter b) route: a simple power of attorney from the data subject, granted before a notary or signed electronically. In addition, from December 1, 2026, article 16 bis of Law 21.719 will prohibit processing or assigning health data collected in the employment or insurance context, unless a law expressly authorizes it in qualified cases that fall within the situations set out in that article.
How long is a medical record kept and how is it deleted?
At least fifteen years (article 13 of Law 20.584), counted from the last entry of information (article 11 of Decree 41). Each new episode of care that is recorded restarts the count.
Once that period has elapsed, the provider may delete the record by means that ensure confidentiality and effective destruction, and must draw up a formal deletion statement with the patient's name and the record number. Public providers authorize deletion by resolution, and private providers register the statement with a notary (article 12 of the regulation).
From December 1, 2026, Law 21.719 will make two rules more precise. Its proportionality principle will require data that is no longer necessary for the purposes of the processing to be erased or anonymized, without prejudice to legal exceptions, and will require legal authorization or the data subject's consent to keep it for a longer period (article 3 letter c). Since fifteen years is a minimum, it is advisable to document why the record remains necessary after that period, for example for continuity of care. And erasure will not apply if the processing is necessary to comply with a legal obligation (article 7), so the patient will not be able to demand that their record be erased during that period; the Law 19.628 currently in force already prevents requesting the cancellation of data stored by legal mandate (article 15). More in data retention and deletion.
What rights does a patient have over their medical record?
The rights under Law 19.628 already apply to medical records (article 13 of Law 20.584). From December 1, 2026, they will apply as amended by Law 21.719, with a response due within thirty calendar days, extendable once (article 11). Until then, the Law 19.628 currently in force gives two business days to respond (article 16).
| Right | What the patient can request | Special rule for medical records |
|---|---|---|
| Access and copy | A full copy, free of charge and without undue delay (Law 20.584, article 13). | Today, also the source, the recipients and the purpose (Law 19.628 in force, article 12); from December, the retention period is added (Law 21.719, article 5). |
| Portability | A copy in a structured, commonly used format, or transfer to another provider (Law 20.584, article 13). | Portability under Law 21.719 will require the patient to have provided the data and the processing to be automated and based on their consent (article 9); Law 20.584 grants a right of its own, without those conditions. |
| Rectification | Modification of erroneous, inaccurate or incomplete data (Law 19.628 in force, article 12); from December, rectification of inaccurate, out-of-date or incomplete data (Law 21.719, article 6). | The provider must already confirm the patient's identification at each episode of care (article 7 of Decree 41). |
| Erasure | Deletion of data stored without a legal basis or that has expired (Law 19.628 in force, article 12); from December, on the grounds in article 7 of Law 21.719. | It will not apply while the legal obligation to keep the record is in force. |
| Heirs | Access to the record of a deceased person (Law 20.584, article 13). | From December, Law 21.719 will provide that heirs may not access it if the deceased person expressly prohibited it or if a law so provides (article 4); no rule yet clarifies how that provision is reconciled with letter a) of article 13 of Law 20.584. |
What changed with Law 21.668 on medical record interoperability?
Law 21.668, published in the Official Gazette on May 28, 2024, amended Law 20.584. Following that reform, article 13 makes healthcare providers responsible for adopting interoperability measures with other providers, for giving timely access to the professionals directly involved in the care and for complying with Law 19.628, which from December will be the text as amended by Law 21.719.
The law gave the Ministry of Health eighteen months, counted from the entry into force of the amendment, to update the regulation (third transitory article of Law 20.584, added by Law 21.668). As of the date of this review, October 21, 2026, the BCN (Library of the National Congress) does not show any published regulation replacing Decree 41 of 2012, which it lists as in force in its original version.
What changes with Law 21.719 from December 1, 2026?
Law 21.719 does not amend Law 20.584: the two will apply in parallel. Its article 16 bis provides that, even with express consent, health and biological profile data may be processed only for the purposes provided for in special health legislation and, without consent, only in specifically listed cases, such as where processing is necessary for medical diagnosis or healthcare (letter e). In addition, five obligations apply to medical records:
- Impact assessment. It will be mandatory for a private healthcare provider that processes sensitive data under an exception to consent (article 15 ter letter d), before processing begins; article 21 does not include it among the rules applicable to public bodies. Failing to carry it out will be a very serious infringement (article 34 quáter). More in impact assessment (DPIA).
- Security. Measures appropriate to the risk, such as pseudonymization and encryption (article 14 quinquies). In the event of an incident leading to a judicial or administrative dispute, the provider will have to prove that those measures existed and worked.
- Breaches. If a breach creates a reasonable risk to patients' rights and freedoms, it must be reported to the Personal Data Protection Agency without undue delay and, because sensitive data is involved, also communicated to each person affected, or to their representative where appropriate, as with patients who are children under fourteen; if that is not possible, through a notice in a mass media outlet with national reach (article 14 sexies). Failing to communicate it will be a serious infringement; failing to do so deliberately, a very serious one (articles 34 ter and 34 quáter).
- Secrecy. Breaching the duty of secrecy regarding sensitive data will be a very serious infringement (article 34 quáter), with a fine of up to 20,000 UTM (article 35).
- Suppliers. A medical record software or cloud supplier that processes data on behalf of the healthcare provider is a processor and will need the contract required by article 15 bis. Law 20.584 already provides that the healthcare provider is the controller of the patient records generated in the course of managing health support systems, and that suppliers have the responsibilities of an agent (mandatario) (article 3). More in contracts with processors.
What should each player in the healthcare sector review?
What to review depends on the role: controller or processor (article 2 letters n and x of Law 21.719).
| Player | Role | What to review |
|---|---|---|
| Clinics and medical centres | Controllers of the records they hold. | Lawful basis, impact assessment, access log, breach plan and retention periods. |
| Public hospitals | Public bodies (article 20). | The obligations listed in article 21: the lawful basis in article 20, health data (article 16 bis), secrecy, security, breaches and processors; that article does not mention the impact assessment in article 15 ter. Because sensitive data is involved, the fine for the head of the public body will be 50% of their monthly remuneration, with suspension of up to thirty days (article 44). |
| Clinical laboratories | Controllers or processors, depending on whether they process data on their own patients or on behalf of another healthcare provider. | Biological profile data (article 16 bis) and contracts with those who refer tests to them. |
| Insurers | Controllers of the data they collect; not on the list in article 13 of Law 20.584. | From December, the prohibition on processing or assigning health data collected in the insurance context, unless a law expressly authorizes it in qualified cases that fall within the situations in article 16 bis. |
| Independent professionals | Individual healthcare providers who hold their own records. | Retention, security and a contract with their supplier; the Agency will set differentiated information and security standards (article 14 septies). |
| Software and cloud suppliers | Processors acting for the healthcare provider (article 15 bis). | Use in accordance with instructions, secrecy, security and reporting of security breaches. |
If you run a healthcare provider, Law 21.719 in healthcare explains how we implement it, with the form to request an assessment.
Is your clinic or laboratory ready for December?
In a 30-minute assessment for healthcare providers, we review who accesses your medical records, which suppliers process them and what you still need to comply with Law 21.719.
Schedule an assessmentFrequently asked questions
What is a medical record?
In Chile, a medical record (ficha clínica) is the mandatory instrument in which a person's health history is recorded, held in custody by the healthcare providers that treated them (article 12 of Law 20.584). All the information it contains is sensitive data.
Who can see my medical record in Chile?
The data subject (the patient), their legal representative or, if the patient has died, their heirs; a third party holding a simple power of attorney from the data subject; and the authorities and professionals listed in article 13 of Law 20.584, such as the courts, the Superintendency of Health and those directly involved in the care. The provider's staff who are not involved in the care have no access.
How many years is a medical record kept?
At least fifteen years (article 13 of Law 20.584), counted from the last entry of information (article 11 of Decree 41 of 2012). Once that period has elapsed, the provider may delete it with a formal deletion statement, which private providers register with a notary.
Can I request a copy of my medical record?
Yes. The data subject, their legal representative, their heirs if the data subject has died, or a third party authorized by a simple power of attorney may request a full copy, free of charge and without undue delay (article 13 of Law 20.584). Today, Law 19.628 gives two business days to respond (article 16); from December 1, 2026, Law 21.719 will set thirty calendar days, extendable once by a further thirty (article 11).
What is the law on patients' rights and duties?
It is Law 20.584, published in 2012, which regulates people's rights and duties in connection with their healthcare, with any provider, public or private. Its articles 12 and 13 govern the medical record: what it is, who can access it and how long it is kept.
Which law protects patient confidentiality in Chile?
Law 20.584, in its paragraph «On the confidentiality of the information contained in the medical record» (articles 12 and 13), together with the duty of secrecy currently set by Law 19.628 (article 7). From December 1, 2026, that duty will be in article 14 bis of Law 21.719; breaching it with respect to sensitive data will be a very serious infringement, with a fine of up to 20,000 UTM for a private healthcare provider (articles 34 quáter and 35).
Can an insurer request a patient's medical record?
Insurers are not among the recipients listed in article 13 of Law 20.584; under that article, they can obtain it only as third parties authorized by the data subject through a simple power of attorney before a notary or signed electronically (letter b). In addition, from December 1, 2026, article 16 bis of Law 21.719 will prohibit processing or assigning health data collected in the insurance context, unless a law expressly authorizes it in qualified cases that fall within the situations set out in that article. The data subject's authorization is not among those exceptions.
Who oversees compliance with the rules on medical records?
The Superintendency of Health oversees compliance with Law 20.584 and the regulation on medical records (article 38 of the law and article 13 of Decree 41). From December 1, 2026, the Personal Data Protection Agency will oversee compliance with Law 21.719 (article 30 bis). There is a bill to postpone the law at its first constitutional stage in the Senate as of October 20, 2026, but it is not law.
Official sources
- Law 20.584, which regulates people's rights and duties in connection with their healthcare (current text, with the amendments of Law 21.668) — Library of the National Congress
- Law 21.668, which amends Law 20.584 to establish the interoperability of medical records (Official Gazette, May 28, 2024)
- Decree 41 of 2012 of the Ministry of Health, regulation on medical records
- Law 19.628 consolidated with the amendments of Law 21.719 (in force from December 1, 2026)
- Law 21.719 — text as published, with its transitory provisions
- Law 19.628 on the protection of private life, text in force until November 30, 2026
This article is for information purposes only and does not constitute legal advice for a specific case.