A patient asks the front desk: "Did I agree to let you send my results to my employer's doctor?" The receptionist looks at the screen. There is a free-text note that says "ok'd verbally". No date, no name, no idea what exactly was agreed. Everyone in the room is acting in good faith, and nobody can prove anything.

This is the everyday reality of consent and privacy in many small practices. This article is about what a system should record so that the question has an answer. It is about software and process, not legal advice. What applies to you depends on your country, your profession and your patients, so confirm it with a qualified professional.

A tick in a box says "yes" and nothing else. When someone later asks what they agreed to, a bare yes is not much use. A useful consent record answers five small questions:

  • Who agreed: the patient, or someone acting for them, and in what capacity.
  • To what exactly: treatment, sharing data with a third party, receiving reminders, being contacted by email. These are separate things and should be recorded separately.
  • When, down to the date and time.
  • Which version of the notice or form they were shown. If your text changes next year, you need to know what this person actually read.
  • How it was given: signed on paper and scanned, on a tablet, verbally and noted by a staff member, and by whom.

Withdrawal matters as much as giving

People change their minds. A system that records "consented" but has no clear way to record "withdrew on this date" will keep acting on an old yes. Good design treats consent as a history, not a single flag: each grant and each withdrawal is a dated entry, and the current state is whatever the latest entry says. Nothing is overwritten, so you can always reconstruct what was true on a given day.

Withdrawal also has to do something. If a patient says they no longer want reminders by message, the reminder feature must check the record before sending, not rely on staff remembering.

Access and correction, at a plain level

Patients can generally ask to see what you hold about them and to have mistakes fixed. The details vary by country, so here is only what I could confirm in the official texts for Argentina, as an example.

Ley 25.326 (personal data protection) lists information about health among sensitive data, requires, as a general rule, free, express and informed consent for processing (with exceptions), and gives people a right to request and obtain information about their data and to have it rectified, updated and, where appropriate, deleted. Ley 26.529 (patients' rights) requires informed consent for medical-health actions in general, and says a copy of the clinical history must be provided on the patient's simple request.

I'm mentioning them only to make a point about software: these are not rare edge cases. They are ordinary requests that will reach your front desk. If the answer to "can you give me everything you have on me?" is a two-day hunt through three programs, the system is the problem.

Practically, that means being able to:

  • find everything linked to one person, in one search;
  • export it in a readable form;
  • correct a record while keeping a note of what was changed, when and by whom (the correction should not erase the history);
  • see who has looked at a record, which also helps with the next section.

Who can see what

Privacy is not only about the patient asking. It is also about your own staff. Not everyone needs every record. A good system gives each role access to what the job requires, and keeps an access log: who opened which record, and when. That log is what lets you answer a patient who asks "who saw my file?", and it discourages curiosity about a neighbour or a celebrity.

Retention: how long to keep, and when to let go

There are two opposing pressures. Some records must be kept for a minimum period. In Argentina, Ley 26.529 sets a minimum of ten years for the clinical history, counted from the last recorded entry. Other data, such as a contact detail for a marketing list, should not be kept forever just because storage is cheap.

The system can help in a very concrete way. Each type of record gets a retention rule, the software flags what has reached the end, and a person reviews it before anything is deleted or archived. Whether a particular rule applies to your records is a question for your professional adviser, not your developer.

What a custom system does about it

Off-the-shelf software often has a consent checkbox and not much else. A custom system can model consent the way your practice actually works: the specific forms you use, the services you offer, the people who can consent for others, and the languages you operate in. It can version your notices, store the signed copy next to the record, apply withdrawal automatically across reminders and sharing, and produce the "everything about this person" export without a manual hunt.

A first step

Take one real situation, such as "a patient asks who has seen their file and what they agreed to". Try to answer it today, using your current tools, and time it. The gaps you hit are your starting list. Share that list, rather than a vague wish for "GDPR-type compliance", with a developer and with your adviser.

Let's talk through your situation.