In short: you can ask any hospital or clinic which people or organisations your data was disclosed to (GDPR Article 15). Under the EHDS you will also have the right to see which healthcare providers accessed your electronic health data. For the record you keep yourself, a good app shows who has access, records the openings in a log and lets you stop access at once.
Checking who looked is the "audit" part of health transparency. Without it, control is only a promise.
At a glance
| Ask a provider | Under the GDPR, in writing: the recipients your data was disclosed to, the purposes and the period. Answer within one month (up to two more for complex requests). |
|---|---|
| From 2029 (EHDS) | Information on which providers accessed your electronic health data, through national services |
| A good access log shows | Who, when, what (which part of the record), and why or under which permission |
| If something is wrong | Ask the provider's data protection officer; complain to your national data protection authority |
How to ask a hospital or clinic
Write to the provider (or its data protection officer) and ask, under Article 15 of the GDPR, for a copy of your data and the list of recipients or categories of recipients to whom it was disclosed; you can ask for the actual names of the organisations that received your data (EU Court of Justice, case C-154/21, 2023). Keep proof of sending. They have one month to answer, which the provider can extend by up to two more months for complex requests, if it tells you why. Staff who consulted your record inside the hospital are usually not “recipients” under the GDPR (EU Court of Justice, C-579/21); national health laws or the hospital's own rules may still give you their names or the log. Many hospitals keep internal access logs; ask specifically whether they can tell you who accessed your record in a given period. Template and steps for the request: your medical data in the EU.
What a useful access log looks like
- Who: the person or organisation, not only "system".
- When: date and time.
- What: which part of the record (results, medications, documents).
- Why: the permission or purpose the access relied on.
- What you can do: stop the access from the same screen.
In the record you keep yourself
In Anpheros Daily, everyone who can read your record appears in Settings › Connections: family members you shared a profile with, doctors with a time-limited link, clinics whose access request you approved, apps and AI assistants you connected. For each one you see what they may read, until when and when they last read it, and you can stop it immediately. Openings through doctor links, clinic access and AI assistants are recorded in your access log.
Every connection, listed
Family, doctors, clinics, apps, AI assistants: who has access, to what, until when.
Access that expires
Doctor links that expire in 7, 30 or 90 days; clinic access for the period you approve.
One tap to stop
Withdraw access from Connections; it stops on the next request.
This covers the record in Anpheros only. Hospital and national systems keep their own logs; for those, use the request above.
Frequently asked questions
Can I find out who accessed my medical records?
Yes. Under GDPR Article 15 you can ask a provider to whom your data was disclosed. Under the EHDS you will be able to see which healthcare providers accessed your electronic health data. Apps that hold your record should show who has access and record the openings in a log.
Do hospitals have to tell me who looked at my record?
They must tell you the recipients or categories of recipients of your data on request (GDPR), and you can ask for the actual names of the organisations (EU Court of Justice, C-154/21). Staff inside the hospital are usually not “recipients” (C-579/21), but national health laws or the hospital's rules may still give you their names or the access log; ask explicitly for a given period.
What can I do if someone accessed my record without a reason?
Contact the provider's data protection officer in writing, and if you are not satisfied, file a complaint with your national data protection authority.
Where do I see who accessed my record in Anpheros?
In the app, under Settings › Connections. Each connection shows what it may read and until when; openings through doctor links, clinic access and AI assistants are recorded in your access log, and you can stop any access there at once.
Try it in Anpheros Daily
In Anpheros Daily you share your record by link or QR code, see whether it was opened, and switch it off at any time.
How it works in the app →
Anpheros builds a medical record that the patient controls and can share with any clinic, on an HL7 FHIR R4 platform, based in the EU. These guides help you understand and organise your health; they do not replace your doctor.
About Anpheros →
AnpherosThe more you log, the clearer your record
Your health history in one place, under your control.
Free · Works in your browser · No card
