How to Request and Organise Medical Records in South Africa

Key takeaways

A medical record is more than the doctor's notes

The National Health Act requires a health establishment to create and maintain a health record for each user. HPCSA guidance treats that record as a longitudinal collection of personal and health information in any medium.

Different parts of one episode may be held by different entities. A hospital file may not contain the ambulance record, a treating specialist's rooms file, the radiology images, a pathology laboratory's data or the medical scheme's claim history. A bill proves that a service was charged; it does not replace the clinical entry for that service.

For a hospital admission, consider requesting the categories that actually existed for the treatment:

• emergency or casualty triage records;
• admission forms, ward notes, nursing notes and observation charts;
• doctors' progress notes and consultation notes;
• referral letters and specialist reports;
• consent forms and records of information given before a procedure;
• theatre, operation, anaesthetic and recovery-room records;
• medication prescriptions and administration charts;
• pathology requests, results and collection timestamps;
• radiology requests, written reports and the underlying images in an available digital format;
• monitoring traces, fluid-balance sheets and other relevant charts;
• discharge summaries, follow-up instructions and booked appointments;
• rehabilitation, physiotherapy or occupational-therapy notes; and
• correspondence about the patient's care.

Ask separately for relevant invoices, receipts, scheme statements, employment records, travel costs and complaint correspondence. They may prove expense or administration, but are not treatment notes.

Who may request the records

An adult patient may request access after proving identity. POPIA section 23 provides for free confirmation of whether a responsible party holds the patient's personal information, and access in a reasonable form, subject to applicable fees and lawful refusal grounds.

Access is not ownership of the provider's only original. HPCSA guidance says the practitioner or entity that generated the record owns it, while the patient may access its information. Ask for a complete copy or export; the holder retains the source it must preserve.

A request for another person needs proof of authority. A signed authorisation may suit an adult representative, but requests involving a child, incapacity or a deceased patient require situation-specific authority. A family relationship alone does not make every confidential record available. Ask what proof is required and obtain advice if authority is disputed.

The provider may verify identity, remove material that must lawfully be withheld, or separate information about another person. PAIA specifically provides for severing a protected part where the remainder can reasonably be disclosed. A partial response is therefore not automatically proof that the clinical file was altered.

Eight steps for a controlled records request

1. Build a holder list

List every facility, practice, laboratory, radiology group, pharmacy, ambulance service and rehabilitation provider involved. Record the name used at the time of treatment, the facility or branch, patient or hospital number if known, and the approximate dates. Do not send one hospital a request for records that were created by an independent provider unless the hospital confirms it holds copies.

2. Find the correct records contact

Use the provider's published records, information-officer, privacy or patient-administration channel. For a formal request, consult its current PAIA manual for the information officer, record categories and request route. Do not send health information to an unverified directory address.

3. State exactly whose records are requested

Give identifying details securely, note any earlier surname, and attach only reasonably required identity and authority documents. If a representative acts, state the role and attach the authority relied on.

4. Scope the treatment and record categories

Specify the facility, provider, admission or consultation dates and the categories sought. A request for "my full file" may be too vague to locate records spread across departments. A scoped list is also easier to audit when the response arrives. If exact dates are unknown, give the narrowest reliable range and explain what event identifies the episode.

5. Choose a usable format

Ask for searchable PDFs where available and native radiology images where a report is not the underlying image. For paper records, request legible scans of both sides, colour where meaningful and every page in sequence. Specify secure transfer for large files.

6. Preserve request evidence

Save the signed request, attachment list, sent message, delivery confirmation, reference number, payment notice and responses. Record when the correct office received it. A draft email or telephone promise does not prove what was delivered.

7. Reconcile what arrives

Create a received-items register before assessing the treatment. Record the provider, category, service dates, page or file count, receipt date and source filename. Compare it with the request and follow up neutrally on missing categories, illegible pages, date gaps or omitted images.

8. Escalate through the right access route

Many providers will answer an ordinary patient-record request. If that route fails, POPIA section 23 and PAIA may provide a formal route. The Information Regulator publishes the current PAIA guide and Form 2 for an access request. A public hospital and a private practice are not treated identically under PAIA, so address the form to the correct body and follow its current manual.

For a formal PAIA request, the Act generally requires a decision within 30 days, subject to third-party procedures and a permitted extension of no more than a further 30 days in specified circumstances. A fee may apply for access, reproduction, search or preparation, depending on the route and applicable regulations. POPIA requires a written estimate before a responsible party charges for the service contemplated in section 23.

If a PAIA request is refused, the response should identify the legal ground and the available challenge route. No response within the statutory decision period may amount to a deemed refusal. If a record cannot be found or is believed not to exist, PAIA provides for an affidavit or affirmation describing the search. Depending on the body and decision, the next route may be an internal appeal, a complaint to the Information Regulator or a court application. Once civil proceedings have commenced, PAIA section 7 may exclude a litigation-purpose request where another law provides the production route; the litigation team should then manage discovery or another applicable process.

How to build a reliable treatment timeline

Keep the chronology separate from the source documents. The timeline is an index and working summary, not a replacement medical record and not an expert opinion.

Use one row per material event with these fields:

• event date and time, including whether it is exact or approximate;
• facility, ward or practice;
• event type, such as consultation, test, procedure, medication, discharge or follow-up;
• short factual description using the source's terminology;
• provider or author named in the record;
• source filename and page, image or entry reference;
• date the document itself was created or signed if different from the event date;
• any related request or result that can be linked; and
• status such as confirmed, unclear, missing source or disputed.

Distinguish at least three dates: when the clinical event occurred, when the entry was made, and when you received the copy. A late entry should remain linked to its actual creation date. Do not move it into the chronology as though it had been written contemporaneously.

Use neutral statements. "Record says antibiotics were administered at 14:10" is traceable. "The hospital ignored the infection" is a conclusion that may require clinical and legal assessment. Where two records conflict, capture both entries and their sources rather than choosing the version that supports a preferred outcome.

Unknown does not mean absent. Mark a time as "not recorded" or a document as "not supplied" unless an authoritative source establishes that the event did not happen or the record does not exist. Do not reconstruct a missing note from memory and insert it into the provider's file. Personal recollections can be kept in a separately dated witness note that clearly identifies who supplied them.

Preserve the source pack

Create a read-only originals folder, a requests-and-responses folder and a working folder. Keep the files exactly as delivered, including original names and metadata. Work from copies when highlighting, combining pages, adding bookmarks or running optical character recognition.

A practical working filename can contain the service date, provider and record type, but avoid placing a full identity number, diagnosis or other sensitive detail in a filename that may sync to shared systems. Keep an index that maps the working name back to the untouched source file.

Do not:

• write on the only paper original;
• delete blank-looking pages before checking whether they are the reverse of a form;
• crop signatures, timestamps, headers or page numbers;
• replace a low-quality scan with a retyped version;
• merge separate providers' files without preserving their provenance;
• remove duplicate copies before recording where each copy came from; or
• upload confidential records to a public file-sharing service or an unapproved AI tool.

The National Health Act prohibits unauthorised alteration, destruction and access to health records. The HPCSA also requires late entries and amendments to remain attributable. A patient-created working copy should make its additions obvious and leave the provider's source intact.

Check for gaps without inventing facts

Use cross-checks to locate a gap. A scheme statement may show a consultation for which no note was supplied. A radiology report may refer to images that were not delivered. A discharge summary may list a test result that is absent from the laboratory folder. These are prompts for a targeted follow-up, not proof of wrongdoing.

Ask the record-holder to confirm whether the missing category:

• is held in another department or by an independent entity;
• exists in paper, archive or electronic form;
• was included under a different filename;
• can be supplied after a lawful redaction;
• has been transferred to a successor practice; or
• cannot be found or no longer exists.

HPCSA's 2022 guidance recommends indefinite electronic retention where practical and, if that is not practical, at least six years after a record becomes dormant, with longer treatment for specified categories. That guidance does not guarantee that an old record is still available. Request older material promptly and preserve any formal explanation about its status.

Protect the patient's privacy

Health information is special personal information under POPIA and is confidential under the National Health Act. Store the pack in an access-controlled location, use encryption where available, share only with people who need it, and confirm the recipient before transferring files. A lawyer, new treating practitioner or expert may need the complete context; an employer, insurer or general complaint recipient may not.

Keep a disclosure log showing what was sent, to whom, for what purpose, on which date and by which channel. If a working extract is enough, disclose that rather than an unrelated lifetime history. Do not publish records, screenshots or allegations on social media while trying to resolve an access problem.

Do not let the records process hide a deadline

A records request is not treatment, a complaint, a statutory notice or court process. It does not by itself stop prescription.

The Prescription Act sets three years for many ordinary debts unless another Act provides otherwise, but the start, delay and interruption of prescription depend on facts and law. For a damages claim against an organ of state, the Institution of Legal Proceedings against Certain Organs of State Act generally requires written notice within six months after the debt became due. The Act contains a condonation route, but condonation is not automatic.

Obtain legal advice early if the treatment was at a provincial or other state facility, a child or person lacking capacity is involved, the event is old, a provider is closing, records may be destroyed, a formal refusal has arrived, or proceedings are already underway. A lawyer can advise on the correct defendant, notice, prescription, authority, expert evidence and access route without waiting for every requested page.

For continued care, tell the current treating team what information is missing and ask whether a discharge summary, medication list, result or direct provider-to-provider transfer is needed urgently. Do not delay emergency or necessary follow-up treatment while completing a legal chronology.

Related Lexuno resources

• Read the medical records glossary entry for the core term.
• Use the medical negligence records pack to structure a consultation file.
• Work through the medical negligence checklist before a first consultation.
• Review the medical negligence glossary entry before treating a poor outcome as proof of negligence.
• Compare medical negligence lawyers if access, deadline or expert issues require legal advice.

FAQs

Related Lexuno paths