How do I get my medical records from a Brazilian hospital after leaving Brazil?

By Ramon Martins Andrade, attorney (OAB/RJ 188.374)

You can obtain a full copy of your medical record from a Brazilian hospital without returning to Brazil. The request is made in writing, by you or by someone you authorise, and rests on two grounds: the Medical Ethics Code, which forbids a physician to refuse the copy, and the General Data Protection Law (LGPD), which gives you a right of access against the hospital itself. Leaving the country changes neither; it changes the logistics.

One belief needs correcting first. Law 13.787/2018, often called Brazil’s “medical records law”, gives patients no right to a copy. It governs digitisation and retention, and its central rule is a clock: “Decorrido o prazo mínimo de 20 (vinte) anos a partir do último registro, os prontuários em suporte de papel e os digitalizados poderão ser eliminados” (after a minimum of 20 years from the last entry, paper and digitised records may be destroyed; article 6, our translation). The patient appears only in paragraph 2, and only as an alternative to destruction: “o prontuário poderá ser devolvido ao paciente” (the record may be returned to the patient). A request built on that law rests on the wrong text.

Step one: find out who holds the record

The Ethics Code (CFM Resolution 2.217/2018) states that the record “estará sob a guarda do médico ou da instituição que assiste o paciente” (shall be kept by the physician or by the institution caring for the patient; article 87, § 2, our translation). An inpatient stay is in the hospital’s file; consultations in a surgeon’s private practice before or after admission may sit in another file and need a request of their own.

Step two: put the request in writing, and say what “everything” means

Article 88 of the Ethics Code forbids the physician to “negar ao paciente […] acesso a seu prontuário, deixar de lhe fornecer cópia quando solicitada” (deny the patient access to their record, or fail to provide a copy when requested; our translation), with one exception: where these “ocasionarem riscos ao próprio paciente ou a terceiros” (would pose risks to the patient or to others). The Code binds physicians; the LGPD binds the hospital directly: article 18, II, gives the data subject the right to obtain from the controller “acesso aos dados”, at any time and on request.

Ask for the complete record, not a summary, and say so in plain words: the full chart from admission to discharge, with test and imaging results. A discharge summary is written about you afterwards; the record is what was written while you were treated.

The wording matters. Lye and colleagues, in a 2018 cross-sectional study in JAMA Network Open, posed as patients with the records departments of 83 top-ranked US hospitals: only 44 release forms offered the entire record, yet all 83 said by telephone that they could release it. The study is American, from 2017 and built on simulated calls; it says nothing about Brazil, but it shows that a standard form may offer less than the law gives.

Step three: sign it, or authorise someone in writing

If someone in Brazil, a relative or a lawyer, will collect the copy, article 89 of the Ethics Code both allows and limits it: no copies are released except for a court order, the physician’s own defence, or “quando autorizado por escrito pelo paciente” (when authorised in writing by the patient; our translation). The LGPD agrees: the rights are exercised “mediante requerimento expresso do titular ou de representante legalmente constituído” (by express request of the data subject or of a duly appointed representative; article 18, § 3, our translation). A signed authorisation naming the person and the record, with a copy of your identity document, is the core. If a lawyer will act for you, the power of attorney and its apostille follow the sequence set out in Can I sue a Brazilian clinic without flying back? The documents and the deposit.

You may not need anyone to collect anything: under article 19, § 2, of the LGPD the data may be provided, at the data subject’s choice, “por meio eletrônico, seguro e idôneo para esse fim” (by secure and suitable electronic means) or in print.

Step four: the deadline and the cost

Neither the Ethics Code nor Law 13.787 sets a deadline. The LGPD does: access is provided either “em formato simplificado, imediatamente” or by a clear and complete statement “fornecida no prazo de até 15 (quinze) dias, contado da data do requerimento” (within up to 15 days of the request; article 19, our translation). Keep proof of the date. On cost, article 18, § 5, says the request “será atendido sem custos para o titular, nos prazos e nos termos previstos em regulamento” (shall be met at no cost to the data subject, within the periods and on the terms set by regulation). If a hospital asks for payment, my reading is that a first copy requested as an exercise of the right of access falls within that clause, and that the reference to regulation governs how the right is met, not whether it costs money. A hospital may read it differently.

Europe has had that argument. Article 15(3) of the GDPR says the controller “shall provide a copy of the personal data undergoing processing”, with fees allowed only for further copies. In Case C-307/22 (26 October 2023), a German patient who suspected errors in his dental treatment wanted a free first copy of his records to pursue his dentist; national law made him pay. The Court of Justice of the European Union held the first copy free even when the reason is unrelated to data protection, and said that in the doctor-patient relationship it includes “diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided”. In the United States, HIPAA (45 CFR 164.524) gives the provider 30 days, extendable once by 30, and allows a “reasonable, cost-based fee” for labour, supplies and postage. On cost, the LGPD reads closer to the European model.

Step five: if the hospital does not answer

The LGPD lets you petition the National Data Protection Authority (ANPD) against the controller (article 18, § 1), or consumer protection bodies (§ 8). Article 3 applies the law to processing in Brazil “independentemente […] do país onde estejam localizados os dados”, and nothing ties the right to your residence. On the ethics side, article 90 obliges the physician to hand over a copy when the Regional Council of Medicine (CRM) requests it, so a complaint to the CRM of the state where you were treated is a further route. And under article 89, § 1, a record requested by a court is sent to that court.

Wanting the record is not having a claim; a record may hold an explanation rather than an error, which is a useful answer too. If what arrives looks incomplete, or you cannot tell, you can get in touch with the firm and describe the treatment you had, so the gaps are found before anything is decided.

Two clocks, and which one runs out first

The 20-year minimum retention under Law 13.787 is counted from the last entry, so a recent record should not yet have been lawfully destroyed. The clock that matters more is the other one: the limitation period for a claim, which is far shorter than twenty years and is explained in How long do you have to sue a doctor in Brazil? I think the record should be requested as soon as you suspect something went wrong, before deciding whether to pursue anything: it is what turns a suspicion into something that can be assessed, and the limitation period does not wait for certainty. On the rights the record may support, see Cosmetic surgery in Brazil: the legal rights foreign patients don’t know they have and Dental work in Brazil went wrong: your rights as a foreign patient.

This content is for information and education only. It does not constitute legal advice, advertising of results or any guarantee of outcome, under Rule 205/2021 of the Brazilian Bar Association (OAB).