A patient wants their medical records: what you owe in 72 hours Who can ask, what to hand over, what you can charge, and where the DPDP Act comes in.

When a patient asks for their medical records, regulation 1.3.2 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 requires you to acknowledge the request and issue the documents within 72 hours. Give the patient copies of what your file holds for them, such as OPD notes, prescriptions, investigation reports and certificates, keep the originals, and if you charge at all, charge only for photocopying, which the patients' rights charter allows except when the records are wanted for a second opinion.

How long you must keep records, and the step-by-step desk routine for logging a request, are in how long to keep medical records. The register that proves you met the deadline is in OPD register rules. This post answers the questions that come after the deadline.

What exactly does the 72-hour rule say?

If any request is made for medical records either by the patients / authorised attendant or legal authorities involved, the same may be duly acknowledged and documents shall be issued within the period of 72 hours.

Three things follow from the wording. The period is 72 hours, not 3 working days, so a request on Saturday evening falls due on Tuesday evening. Two acts are expected: an acknowledgement and the issue of documents. And the rule names three kinds of requester, which we come to below. Regulation 7.2 lists as misconduct a doctor who does not maintain indoor records for three years "and refuses to provide the same within 72 hours" when the patient or an authorised representative asks.

The NMC's Registered Medical Practitioner (Professional Conduct) Regulations, 2023 would have changed the period to "5 working days" (regulation 13B). On 23 August 2023 the NMC held those regulations in abeyance and adopted the 2002 regulations "with immediate effect". We checked the NMC e-gazette page on 27 October 2026 and found no later notification on professional conduct, so 72 hours applies.

Who can ask for a patient's records?

The regulations do not define "authorised attendant". A short written note from the patient naming the person who will collect, kept with the request, is the safest reading. After a patient's death the 2002 regulations name no one; ask the family for whatever document your state council or a lawyer advises, and release nothing on a phone call.

What should you hand over?

Regulation 1.3.2 says "medical records" and "documents" without a list. Two documents from the health ministry's side say more. The Charter of Patients' Rights adopted by the National Human Rights Commission, right 2, gives every patient or caregiver "the right to access originals / copies of case papers, indoor patient records, investigation reports". The charter approved by the National Council for Clinical Establishments, updated on 23 August 2021, gives the right "to access a copy of the case papers, patient records, investigation reports and detailed bill (itemized)". For an OPD, that adds up to:

• The OPD card or case notes for every visit asked about.
• A copy of each prescription you issued.
• Investigation reports in your file, and your notes of results the patient showed you.
• Copies of certificates you issued, from your certificate register under regulation 1.3.3.
• Consent forms for any procedure done at the clinic.
• Bills or receipts, if asked; the 2021 charter lists an itemised bill.

Copy the whole set for the period asked about. Do not summarise, edit or re-write old notes before handing them over; if a note needs correcting, add a dated correction and give both.

Should you give originals or copies?

Copies. The NHRC charter speaks of access to "originals / copies", which a patient can have by reading the original at the desk. But regulation 1.3.1 requires you to maintain records for 3 years from the start of treatment, and regulation 7.2 makes failing to maintain them misconduct, so the originals stay with you. Outside lab reports the patient left with you can go back to them, with a copy kept on file.

Can you charge a fee for copies?

Regulation 1.3.2 says nothing about fees. The NHRC charter says records "may be made available wherever applicable after paying appropriate fees for photocopying or allowed to be photocopied by patients at their cost." The same charter, right 6, says that for a second opinion the patient should get "all necessary records and information required for seeking such opinion without any extra cost or delay." The charter is guidance that states adopt or enforce; it is not an Act.

A practical policy that fits both lines: a per-page photocopy charge displayed at the desk, waived when the patient says the copies are for a second opinion. Do not hold records back until a pending consultation fee is paid; regulation 1.3.2 makes no exception for dues. If your state's clinical establishments rules set a fee, follow them; we did not find a central rule that does.

When can you refuse or delay?

To the patient, almost never: regulation 1.3.2 has no exceptions. To anyone else, you must refuse unless the patient has authorised them or a legal authority has ordered it, because regulation 7.14 bars disclosing "the secrets of a patient that have been learnt in the exercise of his / her profession" except in a court under the presiding judge's orders, where there is "a serious and identified risk to a specific person and / or community", and for notifiable diseases. If you refuse a third party, tell them in writing what they need to bring. If the file is genuinely missing, say so in writing within the 72 hours and give what you have.

What does the DPDP Act add, and from when?

The Digital Personal Data Protection Act, 2023 applies to personal data held in digital form or digitised later (section 3). Under notification G.S.R. 843(E) of 13 November 2025, its sections on rights, including section 11, come into force eighteen months from that date, which is 13 May 2027. Our DPDP guide for clinics tracks any change to those dates.

• Section 11(1) gives a person the right to obtain "a summary of personal data which is being processed" and the processing activities, and the identities of others it was shared with. It applies where the person gave consent, or provided data voluntarily for a purpose under section 7(a).
• Rule 14 of the DPDP Rules, 2025 requires a Data Fiduciary to publish "on its website or app, or both" how a person can make such a request, and to respond to grievances "within a reasonable period not exceeding ninety days".
• Section 12(3) gives a right to erasure "unless retention of the same is necessary for the specified purpose or for compliance with any law". Regulation 1.3.1 is such a law for records you must keep.
• Section 14 lets a person nominate someone to exercise these rights after death or incapacity.

Neither the Act nor rule 14 mentions a fee. The 90-day grievance window is much longer than 72 hours, but it does not replace regulation 1.3.2. A patient who asks for their records is owed copies within 72 hours under the conduct code, whatever the DPDP timeline says.

What does a good 72-hour response look like?

1. Write the request down with the date and time; the clock starts here.
2. Check who is asking against the table above, and collect the authorisation or order if it is not the patient.
3. Acknowledge the request the same day, in writing or by message.
4. Copy the complete set for the period asked about; keep the originals.
5. Hand it over, or send it, within 72 hours, and note what was given, to whom and when.
6. Charge only the displayed photocopy fee, and nothing for a second opinion.