When a hospital refuses to give you your medical records

A patient's right to a copy of his or her own indoor case-record is fixed by Regulation 1.3.1 and Regulation 1.3.2 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, framed under Section 20A of the Indian Medical Council Act, 1956 and continued in force under Sections 25 and 26 of the National Medical Commission Act, 2019. The regulation fixes a hard timetable — supply within seventy-two hours of a written request. Refusal is "professional misconduct" actionable before the State Medical Council under Regulation 7. Against a Government hospital, Section 6 of the Right to Information Act, 2005 supplies a parallel route — the records belong to the applicant, the Section 8(1)(j) personal-information exemption read by the Supreme Court in Central Public Information Officer, Supreme Court of India v Subhash Chandra Agarwal, (2020) 5 SCC 481 cannot defeat disclosure of the patient's own data. Against a private hospital, the medical-service definition settled in Indian Medical Association v V P Shantha, (1995) 6 SCC 651 brings the relationship within Section 2(42) of the Consumer Protection Act, 2019; the records-refusal claim was recognised by the NCDRC in Pravat Kumar Mukherjee v Ruby General Hospital, III (2005) CPJ 35 (NC). This guide maps the law.

The refusal pattern is familiar — a patient or a deceased patient's next of kin asks a hospital for a copy of the discharge summary, the operative notes, the investigation reports and the daily progress sheets, and the hospital either delays the supply for weeks or refuses outright on the ground that the records are the hospital's property, that an internal committee has to "clear" the release, or that only the treating consultant can authorise the disclosure. None of those grounds is a defence in Indian law. The patient's right to a copy of the indoor case-record is a statutory and quasi-statutory entitlement, the hospital's role is custodial, and the seventy-two-hour clock under Regulation 1.3.2 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 runs from the moment the written request is received. The three doctrinal anchors — the 2002 Ethics Regulations, the Right to Information Act, 2005 (for Government hospitals), and the Consumer Protection Act, 2019 (for private hospitals) — together close every refusal route. The Supreme Court in Samira Kohli v Dr Prabha Manchanda, (2008) 2 SCC 1, while deciding informed consent, restated the rule that the records of treatment are the patient's, not the doctor's, and that the doctor's possession is fiduciary.

The first anchor — Regulations 1.3.1 and 1.3.2 of the 2002 MCI/NMC Ethics Regulations

The Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 were framed by the Medical Council of India under Section 20A read with Section 33(m) of the Indian Medical Council Act, 1956. The 1956 Act was repealed by the National Medical Commission Act, 2019, but Section 31 of the 2019 Act saved every Regulation made under the repealed Act so far as it was not inconsistent with the 2019 Act — the 2002 Regulations therefore continue in force, now read with the Ethics Board constituted under Sections 25 and 26 of the 2019 Act. Two regulations matter here.

Regulation 1.3.1 — the duty to maintain records. The regulation reads that every physician shall maintain "the medical records pertaining to his / her indoor patients for a period of 3 years from the date of commencement of the treatment". The duty is on the practitioner and, by extension and through the doctrine of vicarious liability restated in Indian Medical Association v V P Shantha, (1995) 6 SCC 651, on the hospital which employs the practitioner. The form of the record is fixed by an Appendix to the Regulations — a standard template covering complaint, history, examination, investigations, diagnosis, treatment, daily progress and discharge summary.

Regulation 1.3.2 — the seventy-two-hour rule. The text is short and operative — "if any request is made for medical records either by the patients / authorised attendant or legal authorities involved, the same may be duly acknowledged and documents shall be issued within the period of 72 hours". The clock is seventy-two hours from the receipt of the written request. The recipient is the patient himself or an "authorised attendant" — typically a spouse, parent, child, or a person holding a written authorisation. The duty is to "issue" the documents, which has been read by State Medical Councils and by the NCDRC as a duty to supply a complete photocopy or certified electronic copy at the patient's cost; the hospital is entitled to recover reasonable photocopy charges but cannot withhold the records pending payment of treatment dues, the lien claim having been rejected wherever it has been raised.

Regulation 7.21 — refusal as professional misconduct. Chapter 7 of the Regulations lists acts amounting to professional misconduct that render a practitioner liable to disciplinary action by the State Medical Council under Regulation 8. Regulation 7.21 covers refusal to maintain the records under Regulation 1.3.1 and refusal to supply them under Regulation 1.3.2; the entry is read together with the Council's power to award reprimand, suspension of registration up to two years, or permanent removal from the register depending on the gravity of the misconduct. The 2019 Act vests the disciplinary jurisdiction in the State Medical Council in the first instance, with appeal to the Ethics and Medical Registration Board of the National Medical Commission under Section 30, and a further appeal to the Commission itself.

The second anchor — RTI against Government hospitals

Where the hospital is a "public authority" within Section 2(h) of the Right to Information Act, 2005 — a Central or State Government hospital, an All India Institute of Medical Sciences, a Postgraduate Institute, a Government Medical College hospital, an Employees' State Insurance Corporation hospital, a Railway hospital, a Central Government Health Scheme dispensary, or a hospital substantially financed by the appropriate Government — the patient may, in parallel to the Regulation 1.3.2 route, file an application under Section 6 of the RTI Act. The Section 7 timetable runs alongside the Regulation 1.3.2 clock — thirty days in the ordinary case, forty-eight hours where the information bears on the life or liberty of the patient (a continuing course of treatment, an ongoing emergency, a deteriorating prognosis).

The Section 8(1)(j) carve-out and Subhash Chandra Agarwal. Public Information Officers occasionally refuse medical-records requests on the strength of Section 8(1)(j) — the personal-information exemption — on the theory that medical records are "personal information" disclosure of which would cause "unwarranted invasion of privacy". The argument fails on its own terms when the applicant is the patient himself. Section 8(1)(j) protects the privacy of the data subject; when the applicant is the data subject, there is nothing to protect against. The Supreme Court in Central Public Information Officer, Supreme Court of India v Subhash Chandra Agarwal, (2020) 5 SCC 481 read Section 8(1)(j) through a balancing test of public interest against the privacy interest of the third party — the test is not in play where the privacy interest belongs to the applicant. The point has been settled at the Commission level for years and the operative rule is that a Government hospital cannot refuse a patient's own records under Section 8(1)(j).

Third-party records and Section 11. Where the request is made by a person other than the patient — say, by an adult child for the records of a deceased parent, or by a spouse in a matrimonial dispute for the records of an estranged spouse — the Section 11 third-party procedure kicks in. The PIO must notify the patient (or the legal heir) and invite representations; the decision turns on the Section 11 balancing of public interest in disclosure against possible harm to the third party. The Supreme Court's Section 8(1)(j) balancing test in Subhash Chandra Agarwal (2020) — which weighs privacy heavier for purely personal matters and lighter where the discharge of public functions is implicated — supplies the analytical frame.

The deemed-refusal route under Section 7(2). The Section 7(1) thirty-day failure converts to a deemed refusal under Section 7(2) and opens the first appeal route to the officer senior in rank to the PIO under Section 19(1), with a second appeal to the Central or State Information Commission under Section 19(3) within ninety days. The Commission's penalty power under Section 20 — two hundred and fifty rupees per day up to twenty-five thousand rupees — is the enforcement spine. The forty-eight-hour life-or-liberty rule under the proviso to Section 7(1) has been read by Information Commissions to cover hospital records sought during a continuing course of treatment.

The third anchor — Consumer Protection Act 2019 against private hospitals

For private hospitals — those not "owned, controlled or substantially financed" by Government within Section 2(h) of the RTI Act — the Consumer Protection Act, 2019 is the operative route, alongside the Regulation 1.3.2 disciplinary track. The Supreme Court in Indian Medical Association v V P Shantha, (1995) 6 SCC 651 settled that medical services rendered for consideration fall within the definition of "service" under Section 2(1)(o) of the Consumer Protection Act, 1986 — now reproduced as Section 2(42) of the Consumer Protection Act, 2019 — and that the patient is a "consumer" with locus to maintain a complaint of "deficiency in service". Free services in a Government hospital were excluded; paid services, whether in Government or private hospitals, were included; the exclusion has narrowed further as Government hospitals have moved to a paying-bed and reimbursement model under CGHS and ECHS.

Refusal of records as "deficiency in service". The NCDRC in Pravat Kumar Mukherjee v Ruby General Hospital, III (2005) CPJ 35 (NC) — better known for its holding on emergency hospital duty after a road accident — observed that the refusal to supply medical records to a patient or his legal heir is itself a "deficiency in service" within Section 2(1)(g) of the 1986 Act, now Section 2(11) of the 2019 Act, attracting an award of compensation under Section 39 (formerly Section 14) of the consumer fora's remedial powers. The NCDRC and the State Commissions have routinely awarded compensation under this head, ranging from a few thousand rupees as nominal damages for the breach to substantial sums where the refusal frustrated a downstream negligence claim. The pecuniary jurisdiction under Section 34 of the 2019 Act — District Commission up to one crore, State Commission up to ten crore, National Commission above ten crore — fixes the forum.

The Samira Kohli overlap with informed consent. The Supreme Court in Samira Kohli v Dr Prabha Manchanda, (2008) 2 SCC 1 — which laid down the informed-consent rules for surgical procedures — restated that the patient's relationship with the hospital is fiduciary; the consent given by the patient is for the treatment, not for the hospital to acquire ownership of the records of that treatment. The records are the patient's by entitlement; the hospital's possession is for safe-keeping. The proposition is sometimes treated in the case-law as a default that requires no specific statutory anchor; it sits behind the Regulation 1.3.2 timetable and the consumer-protection rule.

The DPDP Act 2023 overlay

The Digital Personal Data Protection Act, 2023 — to be operationalised through the DPDP Rules, the draft of which was published in 2025 — adds a layer over the existing record-access regime, not a substitute. Section 11 of the Act confers on a "Data Principal" — the patient — the right to obtain a summary of the personal data being processed, the identities of all Data Fiduciaries with whom it has been shared, and any other information related to the processing. Section 12 confers the right to correction, completion, updating and erasure of personal data; in the medical-records context, this is the route to correct factual errors in the discharge summary or in the recorded history.

Health data is "sensitive personal data" in the global regulatory taxonomy, and the draft DPDP Rules carry specific provisions on consent management, retention periods and breach notification for health-data fiduciaries (hospitals, diagnostic centres, telemedicine providers). The 2023 Act does not displace the seventy-two-hour rule under Regulation 1.3.2 — it supplements it with a statutory access right exigible from any Data Fiduciary, with the Data Protection Board of India under Section 18 of the Act as the adjudicatory forum and penalties under Section 33 read with the Schedule going up to two hundred and fifty crore rupees per breach. The two regimes run in parallel; the patient may use whichever route is faster.

Documentary protection in court proceedings

Medical records, once obtained, are admissible as documentary evidence under Sections 64 and 65 of the Bharatiya Sakshya Adhiniyam, 2023 [Sections 74 and 76 of the Indian Evidence Act, 1872] — Government-hospital records are "public documents" under Section 64 and the patient is entitled to a certified copy; private-hospital records are private documents whose contents are proved through the maker of the entry. Where the records cannot be obtained voluntarily and the matter is in litigation, the Order XI Rule 12 of the Code of Civil Procedure, 1908 discovery-and-inspection route, and the corresponding subpoena-duces-tecum power under Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023 [Section 91 CrPC], supply a coercive route — the court orders the hospital to produce the records and the hospital's refusal becomes contempt.

The doctrinal point is that the patient's records are foundational evidence in every downstream proceeding — a medical-negligence claim under Jacob Mathew v State of Punjab, (2005) 6 SCC 1 and V P Shantha requires the records to establish the standard of care and the deviation; a personal-injury or motor-accident claim requires them to prove the injuries; an insurance dispute requires them to prove the diagnosis and the line of treatment; a workplace-injury claim under the Employees' Compensation Act, 1923 requires them to prove the occupational link. The seventy-two-hour rule under Regulation 1.3.2 exists because every other claim hinges on the records being available; a refusal at the records stage forecloses the substantive claim downstream.

The remedial sequence — what to do when records are refused

The remedial sequence runs in five tracks, of which the practitioner usually pursues two or three in parallel.

The written request under Regulation 1.3.2. The first step is a written request signed by the patient (or by the authorised attendant with documentary evidence of authorisation), delivered to the hospital's medical-records department or to the medical superintendent, demanding the records under Regulation 1.3.2 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 and offering to pay reasonable photocopy charges. The request must specify the patient's name, the registration / IPD number, the period of admission and the documents sought (discharge summary, operative notes, daily progress, investigation reports, consent forms, anaesthesia chart, nursing notes). Acknowledgement of the request starts the seventy-two-hour clock.

The complaint to the State Medical Council under Regulation 7.21. If the seventy-two-hour clock expires without supply, a complaint to the State Medical Council under Regulation 7.21 read with Regulation 8 of the 2002 Regulations is the disciplinary route. The Council inquires into the conduct of the registered medical practitioner in charge — typically the medical superintendent or the treating consultant — and can award reprimand, suspension of registration, or permanent removal. The Council's order is appealable to the Ethics and Medical Registration Board of the National Medical Commission under Section 30 of the 2019 Act, with a further appeal to the Commission itself.

The RTI application under Section 6 (Government hospital). Where the hospital is a "public authority" within Section 2(h) of the RTI Act, the Section 6 application, paying the ten-rupee fee under the Right to Information (Regulation of Fee and Cost) Rules, 2012, brings in the Section 7 thirty-day timetable, the Section 7(2) deemed refusal, the Section 19 two-tier appellate route, and the Section 20 penalty power.

The consumer complaint under Section 35 (private hospital). Where the hospital is private, a complaint under Section 35 read with Section 39 of the Consumer Protection Act, 2019 — to the District, State or National Consumer Commission depending on the value of the claim under Section 34 — seeks (a) a direction to supply the records, (b) compensation for the deficiency in service, and (c) costs. The court fee is modest; the limitation is two years under Section 69 of the 2019 Act from the date of refusal.

The writ jurisdiction. Against a Government hospital that refuses both the Regulation 1.3.2 request and the RTI application, a writ petition under Article 226 of the Constitution to the High Court — for breach of the right to health and the right to information read into Article 21 by the Supreme Court in Justice K S Puttaswamy v Union of India, (2017) 10 SCC 1 — is the final route. The Court usually disposes of such petitions with a direction to the medical superintendent to release the records within a specified period, often without going into the merits of any downstream negligence claim.

The outcome and the residual contested questions

The architecture is closed. Regulation 1.3.2 of the 2002 Ethics Regulations fixes the seventy-two-hour rule against every hospital, public or private; Section 6 of the RTI Act, 2005 supplements it for Government hospitals; Section 35 of the Consumer Protection Act, 2019, read with the medical-service definition settled in V P Shantha (1995), supplements it for private hospitals; Sections 11 and 12 of the DPDP Act, 2023 add a parallel statutory access right exigible from any Data Fiduciary handling health data. The records belong to the patient — the hospital's possession is custodial. A refusal is professional misconduct under Regulation 7.21, a deemed refusal of information under Section 7(2) of the RTI Act, a deficiency in service under Section 2(11) of the Consumer Protection Act, and a breach of the Section 11 access right under the DPDP Act, simultaneously.

The contested questions — whether a private hospital can lawfully condition the release of records on the prior settlement of outstanding bills (the lien claim, consistently rejected at the State Commission level but never authoritatively settled by the Supreme Court); whether a deceased patient's records can be released to a single legal heir without notice to the others (the Section 11 RTI third-party procedure assumes a discrete data subject); whether telemedicine consultations under the Telemedicine Practice Guidelines, 2020 generate records subject to the seventy-two-hour rule (the Guidelines reference but do not extend Regulation 1.3.2 expressly) — are working themselves out at the Commission and High Court levels. None of them affects the central rule. The patient asks in writing, the hospital supplies in seventy-two hours, and every refusal route is foreclosed by one or more of the four statutory anchors.