Normative Juridical Study of Patient Storage Obligations and Access Rights to Medical Records

Abstract

Introduction: Medical records are not merely administrative documents, but legal instruments that guarantee continuity of care, patient autonomy, and protection of sensitive health data. The expansion of electronic medical records in Indonesia has intensified the need to reconcile record-retention obligations, patient access rights, medical confidentiality, and personal data protection. Objective: To analyze the legal construction governing the storage of medical records and patient access rights, and to assess whether the current regulatory framework is adequate from the perspectives of human rights, proportionality, and personal data protection. Method: This study uses normative juridical research with statutory and conceptual approaches. Legal materials were analyzed prescriptively using a human rights approach, the proportionality principle, and data-protection principles, particularly confidentiality, purpose limitation, security, and accountability. Result and Discussion: The study finds that Indonesian law already recognizes the obligation of healthcare facilities to retain medical records and the right of patients to access their health information; however, implementation remains fragmented. Normative tension arises because regulations affirm patient access, yet do not sufficiently detail the limits, procedures, classification of accessible information, and safeguards for sensitive clinical notes in electronic systems. This ambiguity creates inconsistent practice, bureaucratic barriers, and legal uncertainty. Conclusion: Regulatory harmonization is needed through derivative rules that define the scope of patient access, role-based access control, retention governance, complaint mechanisms, and digital security standards so that patient rights are fulfilled without undermining confidentiality and data protection.