Your Medical Record: Access Rights, Copies & Objection: 2026 Guide

The essentials in 30 seconds

Introduction

Access to one’s own health information is a cornerstone of patient empowerment and quality care. In France, the right to obtain, copy, and, when necessary, oppose the sharing of a medical record is enshrined in law, yet many patients still encounter opaque procedures, long waiting times, and fragmented data delivery.

Hospitals today manage millions of records across legacy systems that often lack the agility to meet these statutory obligations efficiently. According to the Ministry of Health, more than 3 million electronic health records (EHRs) are stored in French public hospitals, but only a fraction are readily searchable and exportable on demand.

Galeon has been building an intelligent, AI-boosted DPI (Digital Patient File) with clinicians since 2016. Deployed in 19 hospitals, including two university medical centers, its platform currently supports over 10 000 caregivers and safeguards more than 3 million patient dossiers. The system’s decentralized Swarm Learning® architecture ensures that data never leave the hospital’s premises while still enabling collaborative AI improvements.

"Patients must be able to retrieve their health data within days, not months, and any denial must be transparently justified," notes Dr. Camille Moreau, Chief Medical Officer at Galeon.

Who can request my medical record and what can they ask for?

The right to access a medical record is universal for the patient themselves. A legally-authorized representative, such as a parent, legal guardian, or a person holding a power of attorney, may also request the file. Health-care professionals can obtain the record when it is necessary for treatment, research, or quality-improvement activities, provided they respect the principle of proportionality.

Requests must be submitted in writing (demande dossier médical) and include the requester’s identity, the patient’s identifier (e.g., social security number), and the specific purpose of the request. For third-party clinicians, an accompanying medical justification is required.

What is the legal procedure and deadline to obtain a copy of my medical record?

Under Article L1111-7 of the French Public Health Code, hospitals must acknowledge a written request within 8 working days and deliver the requested copy within the same period, unless the case is exceptionally complex.

When a request involves large imaging files, genetic data, or aggregated longitudinal records, the deadline can be extended up to two months. The hospital must inform the requester of any extension in writing, stating the reason and the new expected delivery date.

What does a medical record actually contain?

A complete dossier médical includes administrative data (admission dates, insurance information), clinical notes, laboratory results, imaging studies, prescriptions, and any consent forms. In modern DPI systems like Galeon’s, metadata are also captured to enable traceability and auditability.

Importantly, not all ancillary documents (e.g., internal administrative memos) are considered part of the patient’s right-to-access record. The law distinguishes between “medical information” and “administrative data” that may be withheld if it does not affect the patient’s care.

How can I exercise my right of opposition to data sharing?

Patients may oppose the secondary use of their health data, for research, statistical analysis, or AI training, by filing an objection (opposition partage données santé). The objection must be explicit, signed, and submitted to the hospital’s data protection officer.

If the hospital believes the data are necessary for public health research, it must provide a written justification, citing the legal basis (e.g., public interest, consent). The patient can appeal the decision to the CNIL (Commission Nationale de l'Informatique et des Libertés) within two months.

What must a hospital provide to meet these obligations efficiently?

Hospitals need a secure, interoperable EHR platform that supports rapid export in standard formats (PDF, HL7 FHIR, DICOM). The system should automate request logging, identity verification, and deadline tracking, while guaranteeing HDS (Health Data Hosting) compliance and audit trails.

Galeon’s AI-enhanced DPI offers built-in workflow automation, fine-grained access controls, and a decentralized Swarm Learning® engine that lets hospitals improve predictive models without moving data off-site: preserving both patient privacy and data sovereignty.

Traditional EHR vs. Galeon’s Smart DPI (Comparative Table)

Limits and challenges to be aware of

• Legal interpretation varies by region. While the French Code de la santé publique defines clear timelines, local hospital policies can add procedural steps that lengthen the process.
• Data quality impacts accessibility. Incomplete or incorrectly coded entries may delay extraction, especially for legacy records not yet mapped to standard terminologies.
• AI risk classification. Under the EU AI Act, not every clinical AI tool is deemed “high-risk”; hospitals must assess each model individually, which can complicate Swarm Learning deployments.
• Resource constraints. Smaller facilities may lack the IT staff to configure and maintain advanced audit logs or to integrate with national health data exchanges.
• Patient awareness. Many patients are unaware of their right to object to secondary use, leading to unintentional data sharing.

FAQ

Can I get my medical record in any language?
Hospitals must provide the copy in French; translations are optional and may incur additional fees.

Do I need to sign a waiver to receive my record?
No waiver is required; the law guarantees free access, though a modest handling fee may be charged.

What if I lose the copy I received?
You may request a replacement at any time, and the hospital must treat it as a new request.

Is electronic access secure?
Yes, provided the EHR complies with HDS certification and uses encrypted channels (TLS 1.3 or higher).

How does Swarm Learning protect my data?
It trains AI models on-site; only model parameters, not raw patient data, are shared between hospitals.

Can a hospital refuse my request?
Only for narrowly defined reasons (e.g., ongoing investigations) and the refusal must be fully justified in writing.

What recourse do I have if my objection is ignored?
You can lodge a complaint with the CNIL, which can impose fines up to €300 000 for non-compliance.

In summary

French patients enjoy a robust legal framework that guarantees timely access, copy, and the right to oppose inappropriate data sharing. However, implementing these rights efficiently demands an EHR that is both compliant (HDS 2024, GDPR) and capable of rapid, auditable data export. Galeon’s Smart DPI merges AI-enhanced workflow automation with decentralized Swarm Learning®, enabling hospitals to meet statutory deadlines, reduce operational costs, and preserve data sovereignty: all while delivering a transparent, patient-centric experience.

Discover how a Smart EHR can transform patient-record access in our in-depth comparison.

Sources

• Article L1111-7 of the French Public Health Code (EUR-Lex)
• Galeon: Smart EHR vs Traditional EHR
• Galeon: GDPR & Health Data 2026

‍