Does a patient have the right to have their records deleted?

Partially. The right to erasure is real and it is not absolute: where a legal obligation requires you to keep a clinical record, that obligation generally survives the request. What almost always can be deleted is everything else — marketing consent, mailing lists, chat transcripts, enquiry history — and most people asking for erasure are satisfied by getting that half with a clear explanation of the rest.

How long does a clinic have to respond?

Around a month in most regimes, and taking the full month is usually the wrong choice. A request answered in a day reads as a clinic with nothing to hide; the same answer on day twenty-nine reads as one that had to go looking, and that is often the step where an annoyed patient becomes a regulatory complaint.

Can a patient make us change a clinical note?

They can have a factual error corrected — a wrong date of birth, a misspelled name. They cannot generally require you to replace a professional judgement with their preferred version. Record the disagreement alongside the note rather than overwriting it, and never quietly amend a note in response to a complaint: an edit without a visible trail turns a disagreement about care into a question about honesty.

What is the difference between access and portability?

Access is a copy the patient can read — a PDF is fine. Portability is a machine-readable file another system could import. They are answered with different outputs, and producing the wrong one costs a round trip.

Do we have to verify who is asking?

Yes, and proportionately. Sending a record to the wrong person is a breach you performed yourself, on request. Enough verification to be sure, not so much that it functions as a way of discouraging the request — and third parties such as a partner, a lawyer or an insurer may be entitled but none is automatically.

When a patient asks for their data

It arrives by email, usually on a Friday, usually from somebody who is unhappy about something else. "I want a copy of everything you hold about me." The clinic panics, forwards it to three people, and answers eleven days later in a way that makes the original complaint worse.

Almost all of that is avoidable, and none of the avoiding is legal work. It is knowing which of four things has been asked for, and having decided in advance who answers.

Four requests, not one

They ask for	You produce
Access	A copy of what you hold, in a form they can read
Correction	A factual error fixed — and it is narrower than it sounds
Deletion	Erasure of what you are not obliged to keep
Portability	Their data in a machine-readable format, sometimes to send elsewhere

People conflate the first and the last constantly. Access is a copy for the patient to read. Portability is a file another system can import. A PDF satisfies one and not the other, and answering the wrong one wastes a round trip you did not need.

Correction is narrower than patients expect

A wrong date of birth is a factual error and you fix it. A clinical opinion the patient disagrees with is not an error, and you are not obliged to replace a professional judgement with a patient's preferred version of it.

The workable answer — and generally the expected one — is to record the disagreement alongside the note rather than to overwrite it. The record then says what was found, and says the patient disputes it, which is truer than either version alone.

Important

Never quietly edit a clinical note in response to a complaint. An amended note without a visible trail is the single worst-looking document in any subsequent dispute, and it converts a disagreement about care into a question about honesty.

Deletion does not always win

The right to erasure is real and it is not absolute. Where a legal obligation requires you to keep a clinical record, that obligation generally survives the request — you keep the record and you explain why.

What almost always can go is everything that is not the clinical record: marketing consent, mailing lists, chat transcripts, enquiry history. In practice most people who say "delete everything" want that half, and are satisfied by an answer that gives it to them and explains the rest.

Delete what is not required, and say specifically what you deleted.
Keep what is required, and name the obligation rather than saying "we have to".
Stop using the rest. A record retained for a legal obligation should not still be feeding your recall list.

That third point is the one clinics miss. Keeping a record because you must is not the same as keeping it in circulation, and a patient who asked to be erased and then receives a check-up reminder has been given evidence that you ignored them.

Verify who is asking

An access request sent to the wrong person is a data breach you performed yourself, on request, with your own hands. It is the failure mode this whole process is most exposed to.

Confirm identity proportionately. Enough to be sure, not so much that verification becomes an obstacle designed to discourage.
Be careful with third parties. A parent, a partner, a lawyer, an insurer. Each may be entitled and none is automatically.
Children are their own question, and the answer changes with age and with local rules on capacity.

Answer in a day, not in a month

Most regimes give you around a month. Taking it is legal and it is almost always the wrong choice.

A request answered in a day reads as a clinic with nothing to hide. The same request answered on day twenty-nine reads as a clinic that had to go and look, and it is frequently the step at which an annoyed patient becomes a complaint to a regulator.

Answering quickly is a systems question rather than a legal one. If finding, exporting and correcting a patient's record are things staff can do directly, this is an afternoon. If any of them requires asking a vendor, it is a month by construction.

Log it, whatever it is

Every request, including the ones answered in five minutes and the ones you decline. What was asked, by whom, when, what you did, and why.

Not bureaucracy: it is the only thing that lets you answer "how do you handle these" with evidence instead of a description, and if a regulator ever asks, the log is the answer. It also stops the same request being answered twice, differently, by two people.

Before the next one arrives

Name the person who owns these. One person, with a deputy.
Write a page saying what you hold and how long you keep it, in language a patient can read.
Check your team can find, export, correct and delete a record without contacting anybody.
Decide your identity check now, so it is not invented under pressure on a Friday.
Log every request in one place, including the refusals.

The third step is the one that decides whether the rest is a day or a month, and it is worth testing on your own record before you need it. The retention half of it is a separate decision with its own arithmetic.

Note

This is the general shape rather than legal advice, and the specifics differ by country — the EU member states, the UK and Türkiye each have their own version, with their own deadlines and their own exemptions. Confirm yours locally.

Common questions

Does a patient have the right to have their records deleted?: Partially. The right to erasure is real and it is not absolute: where a legal obligation requires you to keep a clinical record, that obligation generally survives the request. What almost always can be deleted is everything else — marketing consent, mailing lists, chat transcripts, enquiry history — and most people asking for erasure are satisfied by getting that half with a clear explanation of the rest.
How long does a clinic have to respond?: Around a month in most regimes, and taking the full month is usually the wrong choice. A request answered in a day reads as a clinic with nothing to hide; the same answer on day twenty-nine reads as one that had to go looking, and that is often the step where an annoyed patient becomes a regulatory complaint.
Can a patient make us change a clinical note?: They can have a factual error corrected — a wrong date of birth, a misspelled name. They cannot generally require you to replace a professional judgement with their preferred version. Record the disagreement alongside the note rather than overwriting it, and never quietly amend a note in response to a complaint: an edit without a visible trail turns a disagreement about care into a question about honesty.
What is the difference between access and portability?: Access is a copy the patient can read — a PDF is fine. Portability is a machine-readable file another system could import. They are answered with different outputs, and producing the wrong one costs a round trip.
Do we have to verify who is asking?: Yes, and proportionately. Sending a record to the wrong person is a breach you performed yourself, on request. Enough verification to be sure, not so much that it functions as a way of discouraging the request — and third parties such as a partner, a lawyer or an insurer may be entitled but none is automatically.

A day, because nobody has to ask us first.

Find, correct, export or delete a patient's record directly from the panel, and log every request with what was asked and what you did about it — including the ones you decline. Free to start, no card.

Retention and data requests