Between Confidentiality and Justice: The Ethical and Legal Limits of Using Medical Records

Available online at www.rajournals.in RA JOURNAL OF APPLIED RESEARCH ISSN: 2394-6709 DOI:10.47191/rajar/v11i10.15 Volume: 11 Issue: 10 October 2025 International Open Access Impact Factor8.553 Page no.- 939-943 939 Tatiane Mendes Sanches1, RAJAR Volume 11 Issue 10 October 2025 Between Confidentiality and Justice: The Ethical and Legal Limits of Using Medical Records Tatiane Mendes Sanches1 , Simone Camargo de Oliveira Rossignolo2 , Agnaldo Henrique Esteves3 , Luis Eduardo Miani Gomes4 1PhD candidate in Comparative Civil Law at the Pontifical Catholic University of São Paulo. Professor of Law at the Faculty of Americana/SP – Brazil and lawyer. 2PhD in Health Sciences from the State University of Campinas (Unicamp). Professor of Nursing at the Faculty of Americana/SP – Brazil. 3Undergraduate student in Law at the Faculty of Americana. Americana/SP – Brazil. 4Doctorate in Health Sciences from the State University of Campinas (Unicamp).Professor of Law at the Faculty of Americana/SP –Brazil. ARTICLE INFO ABSTRACT Published Online: 30 October 2025 Corresponding Author: Tatiane Mendes Sanches This article analyzes medical records as an essential document at the interface between professional ethics, legislation, and the patient's right to privacy. The research discusses the impact of the General Data Protection Law (Law No. 13,709/2018) on the handling of sensitive information in the health sector, highlighting its relevance in data protection and strengthening doctor-patient confidentiality. The study addresses the dual role of medical records—as a clinical tool and as a legal means of defense for professionals—emphasizing their probative importance in legal and ethical-disciplinary proceedings. Based on an analysis of current legislation, such as the Code of Medical Ethics, the Federal Constitution of 1988, and the Resolutions of the Federal Council of Medicine, the study shows that medical confidentiality is an ethical and legal duty, which may only be breached in specific situations, such as by court order or to exercise the right of defense. The text also emphasizes the challenges posed by the digitization of medical records, which, although it facilitates access to information, increases the risks of data breaches and requires greater responsibility from professionals. It concludes that the balance between the protection of privacy and the right to a full defense must be achieved through careful consideration and strict observance of the ethical and legal standards applicable to the health sector. KEYWORDS: Medical records, Professional confidentiality, General Data Protection Law, Ethics and justice, Technical defense. I. INTRODUCTION Undoubtedly, patient medical records received even stricter protection when the General Data Protection Law (Law 13.709/2018) came into force. The same protection also came from the Consumer Protection Code (Law 8,078/1990) and the respective Codes of Ethics for professionals who work with and care for patients. It is worth emphasizing that this set of rules, which is not limited to the aforementioned citations, provides, for example, for the prohibition of photographing or scanning, in whole or in part, without prior written authorization from the patient or their legal representative, in situations provided for by law. Furthermore, the aforementioned document recording the actions of healthcare professionals in providing patient care is extremely important. In this sense, the importance of the seriousness of the records (Gomes, et al., 2020). The medical record, also known as the patient record, comprises a collection of organized, standardized, and clear documents, which are intended to record all information related to the medical and paramedical care provided to the patient. Notes in the clinical record or medical record must be made in such a way that they can be easily read, which includes the possibility of identifying the health professionals who participated in the care of the woman. In addition, the physician has the duty to sign and stamp, or alternatively, sign and provide a clear name and their registration number with the Regional Medical Council, which must be easily legible (Castro, 2024). “Between Confidentiality and Justice: The Ethical and Legal Limits of Using Medical Records” 940 Tatiane Mendes Sanches1, RAJAR Volume 11 Issue 10 October 2025 The use of this document is widely used in the defense of healthcare professionals when they are sued. It is important to note that it is legitimate and legal for the healthcare institution to provide a copy of the patient's medical records to the physician involved in the care, as it is in their interest to present their statement in their defense, as provided for in the constitutional text (contradictory and full defense). The provision of medical records must be limited to the provision of medical history, when there is adequate justification and for the sole purpose of defense in judicial or administrative proceedings, exempting the need for patient approval. This action does not violate medical confidentiality, according to articles 73, 74, and 89 of the Code of Medical Ethics, in addition to Federal Medical Council Resolution 1.605/00. It is extremely prudent to require a written request from the requesting physician, and the request must indicate the number of the judicial or administrative proceeding, with the receipt duly signed by the requesting professional, who undertakes to maintain confidentiality and use the information only for the specific purpose stated (Silva, 2025). In this regard, this article aims to analyze the importance of medical records from the perspective of personal data protection, highlighting the ethical and legal foundations that guarantee the confidentiality of patient information and the limits of its use in judicial and administrative situations. II. DEVELOPMENT Considering the elements and objectives described, with a focus on the legal and ethical protection of medical records, the application of the General Data Protection Law, and the legitimate use of this document in professional defense, three topics of discussion were formulated based on a didactic perspective, presenting critical reflection and interdisciplinary analysis. When addressing the topic of medical records in the context of health in Brazil, it is essential to consider Articles 6 and 196 of the Federal Constitution of 1988, which establish health as an essential right of citizens and an obligation of the government. A topic that, until 1988, was essentially technical and political in nature, also took on a legal and constitutional character (Brazil, 1988). III. MEDICAL RECORDS AS LEGAL AND ETHICAL DOCUMENTS At this point in the debate, it is important to highlight the role of medical records not only as a clinical record-keeping tool, but also as a document of legal and ethical relevance. It is important to reflect on how the quality and accuracy of notes can influence both the continuity of patient care and professional defense in possible legal proceedings. In the daily routine of hospitals, whether public or private, it is common for administrators to encounter requests for medical records made by public authorities. Often, these entities, which do not have the proper authorization for such a request, pressure the institution to provide the medical records of a particular patient, claiming that this document is necessary for conducting legal proceedings, investigations (both civil and criminal), filing lawsuits, among other purposes (Castro, 2024). The medical record is a confidential document that documents the entire course of the patient's stay in the hospital. Its primary functions include facilitating the exchange of information between professionals, enabling research, supporting audits and accounting records, and ensuring continuity of patient care. This record includes procedures, case progress, and notes made during the patient's stay at the healthcare institution (Castro, 2024). To ensure its legal effectiveness, the medical record must comply with the requirements of authenticity, integrity, and legitimacy, as well as contain essential elements such as identification form, medical history form, progress and prescription, as well as specific reports such as surgical intervention forms (Rosa, 2024). In addition, this document is a key piece in legal practice as an instrument for reconstructing the patient's care history. Considering that medical records are documents that enjoy a presumption of veracity and have administrative, medicallegal, and health value, erasures of any kind are not permitted. In addition, physicians are prohibited from failing to prepare legible medical records for each patient (Article 87 of Resolution 2.217/2018), and are also prohibited from releasing copies of medical records, except to comply with a court order or for their own defense, as well as when authorized in writing by the patient or when requested by the court. the medical records shall be forwarded to the requesting court. When the medical records are presented in their own defense, physicians must request that professional confidentiality be observed (Art. 89 of Resolution 2.217/2018) (Federal Council of Medicine, 2018). When correctly completed, the medical record is the main documentary evidence in the physician's defense in judicial or administrative proceedings, demonstrating the technical and ethical conduct adopted (Prestes, et al., 2007). In cases of suspected medical error, detailed documentation is essential to clarify facts and protect the professional (Santeramo, et al., 2021). Finally, given the importance of this medical document, it must be kept for a period of 20 (twenty) years after the last entry (Brazil, 2018). IV. THE APPLICATION OF THE GENERAL DATA PROTECTION LAW (LGPD) IN HEALTHCARE Brazil instituted Law No. 13,709/2018, known as the General Data Protection Law (LGPD), which regulates how personal data can be processed, both in physical and digital formats, by individuals or entities, whether public or private. According to the first article of the LGPD, its purpose is to preserve the essential rights to freedom and privacy, as well as to ensure the full development of a person's identity. Thus, its focus is to ensure the protection of data and information “Between Confidentiality and Justice: The Ethical and Legal Limits of Using Medical Records” 941 Tatiane Mendes Sanches1, RAJAR Volume 11 Issue 10 October 2025 that enable the identification of individuals. It is important to highlight the provisions of Article 5 of this law: "For the purposes of this Law, the following definitions apply: I - personal data: information related to an identified or identifiable natural person" (Brazil, 2018). In addition, the Superior Court of Justice has already ruled on the administration of databases, with strict compliance with requirements, emphasizing that "Database management requires strict compliance with the requirements contained in the respective governing rules - CDC and Law 12.414/2011 – among which the duty to inform stands out, which includes the duty to communicate in writing to the consumer the opening of a file, record, and personal and consumption data, when not requested by them” (Superior Court of Justice, 2019). The LGPD recognizes the presence of personal data classified as sensitive, including those related to ethnic or racial origin, religious beliefs, political positions, associations with unions or organizations of a religious, philosophical, or political nature, as well as information about health, sex life, genetic or biometric data, when associated with an individual. In this context, it should be noted that health-related information is considered sensitive, requiring appropriate treatment by the LGPD due to the relevance of this category of data. There is a regulation on the use of sensitive health-related data in item f, subsection II, of Article 11 of the LGPD, which allows processing without consent when it is essential for health protection, carried out by health professionals or institutions, or by health authorities (Botelho, Camargo, 2021). With the implementation of the LGPD, healthcare workers, medical offices, hospitals, and healthcare facilities, among others, who deal with the handling of sensitive personal health information need to take steps to align their operations with the rules established by the LGPD, or they run the risk of finding themselves in disagreement and being exposed to penalties stipulated by the legislation, ranging from financial fines to restrictions on the use of sensitive personal data (Botelho, Camargo, 2021). The LGPD emerged as a reaffirmation of privacy protection, which is an essential right of the patient. Similar to professional confidentiality, this law serves as an instrument created to safeguard a person's privacy. Both operate on the same logic: the use of personal information is intended to benefit its owner, i.e., the patient, and any sharing must occur only with their prior authorization, being permitted exceptionally in situations defined by law (Weston, et al., 2023). The LGPD also requires extra care with regard to data handling, establishing principles of good faith and respect for citizens' rights. These concepts are already familiar and closely linked to the code of ethics. It is the responsibility of professionals to familiarize themselves with current legislation, ensuring the protection of the information belonging to users (Weston, et al., 2023). Not to mention that this legislation reinforces the patient's right to medical records, so that in its article 18 it lists the rights that data subjects have in relation to data processing, in addition to the very idea of consent, as a legal basis, as a form of exercising informational self-determination and freedom itself (SANCHES, 2023). The digitization of medical records brings benefits for information management and access, but increases challenges related to security, privacy, and confidentiality. The LGPD imposes strict liability on physicians for the protection of sensitive patient data, requiring rigorous technical measures to prevent leaks (D’Agostino, et al., 2020; De Souza Lamblet, 2020). The privacy of medical records is a patient's right and a physician's obligation, with limited exceptions. A wellmaintained record is the professional's main defense. Digitization increases the demand for information protection, making the physician's responsibility even more intense in relation to current legislation (D'Agostino, et al., 2020). V. BOUNDARIES BETWEEN MEDICAL CONFIDENTIALITY AND THE RIGHT TO A FULL DEFENSE Medical records can be legitimately shared without violating professional confidentiality, especially when the physician uses the document in their legal defense. Promoting debate about the balance between confidentiality of information and constitutional rights to adversarial proceedings and full defense is extremely relevant given the importance of professional confidentiality and the professional's right to their defense (full defense). Medical confidentiality is guaranteed by Brazilian law and codes of ethics, protecting patient information from unauthorized disclosure. The medical record belongs to the patient, but its custody is the responsibility of the physician and the institution, and it should only be accessed for professional purposes or with legal or judicial authorization (Santos, et al., 2020). Violation of confidentiality can result in criminal, civil, and administrative liability (Destro, 2020). Medical confidentiality is protected by ethical and legal standards, such as the Penal Code, the Code of Medical Ethics, and the Constitution, and is considered essential for trust in the doctor-patient relationship. However, the Brazilian Code of Medical Ethics provides for three situations in which confidentiality may be breached: legal duty (express requirement in law), just cause (relevant social interest), and written consent from the patient. Outside of these circumstances, confidentiality is mandatory. In criminal investigations, the attending physician is prohibited from disclosing information that could expose the patient to criminal prosecution, except in cases provided for by law or with the patient's authorization (De Aragão, 2020). Furthermore, when medical confidentiality conflicts with the right to defense, case law and doctrine indicate that confidentiality should only be breached by court order and “Between Confidentiality and Justice: The Ethical and Legal Limits of Using Medical Records” 942 Tatiane Mendes Sanches1, RAJAR Volume 11 Issue 10 October 2025 when strictly necessary to ensure fundamental rights, such as the life or defense of the accused. The legal right protected by confidentiality must be weighed against the public interest and the need for justice (Destro, 2020). When properly completed, medical records are considered the most important document to support the professional's defense in cases of legal or ethical questioning, as they may be the only evidence of the patient's condition and the procedures performed. It assists experts and judges in making judicial decisions and is essential for demonstrating the professional's seriousness and technical skill (Prestes, 2007), providing retrospective information, sometimes relating to events that occurred a long time ago. The judicialization of health, especially in lawsuits involving medications, highlights the importance of medical records as documentary evidence to justify prescriptions and medical conduct before the courts. However, the lack of communication between professionals and managers can increase litigation, reinforcing the need for detailed and transparent records (Da Silva; Pereira, 2020), in order to corroborate the elements of the defense, in the administrative or judicial sphere. Thus, the defense may be impaired due to a strict lack of technical elements, making it essential to have an expert—a professional technical expert trusted by the court, with specific training (Silva, 2025). In a study conducted by Bitencourt et al. (2007), the characteristics of negligence (67.3%), recklessness (23.3%), and malpractice (8.8%) were evident in the complaints received, and 20.1% did not present any of the three forms of fault presented. In addition, 90.6% of physicians reported that the medical record was used as evidence during the proceedings. Regarding the trial verdict, 76.1% (n = 121) of the physicians were found not guilty, of which 31.4% (n = 50) were acquitted due to lack of evidence, while 44% (n = 70) were acquitted due to proof of their innocence (Bitencourt, et al., 2007). V. CONCLUSIONS The medical record is a crucial document that compiles the patient's entire health history and acts as one of the main defenses for healthcare professionals in legal and ethicaldisciplinary matters. Its administration must follow the principles of the LGPD and the standards of the Code of Medical Ethics, ensuring the protection of information and the safeguarding of the essential rights of both the patient and the professional. The proper way to fill it out and organize it is essential to ensure the legal security of the physician and the validation of their professional actions. In addition, medical confidentiality is a fundamental right, but it can be relativized in exceptional situations to ensure a full defense, always under strict judicial control. The balance between privacy and justice is achieved through careful consideration, respecting both the dignity of the patient and the procedural guarantees of the accused. The correct way to create, store, and use these documents demonstrates not only the excellence of the care provided, but also a dedication to the values of confidentiality, clarity, and professional responsibility. The study shows that strict compliance with the rules set forth in the General Data Protection Law (Law No. 13,709/2018), the Code of Medical Ethics, and the Federal Constitution of 1988 is essential to ensure a balance between the patient's right to privacy and the healthcare professional's right to a full defense. Furthermore, the digitization of medical records poses new ethical and security challenges, requiring institutional data governance policies and ongoing training of teams to prevent violations and ensure the legitimate use of information. Thus, respect for medical confidentiality must be understood as an expression of professional ethics, protection of human dignity, and the enforcement of justice, ensuring mutual trust between patient and professional, which are fundamental pillars of responsible and humanized healthcare practice. ACKNOWLEDGMENT The heading of the Acknowledgment section and the References section must not be numbered. REFERENCES 1. Gomes L. E. M.; Gomes J. T.; Negreiros L. M. V. de; Leal R. F. Patient records and the legal and ethical duty of healthcare professionals to keep records: a literature review. Revista Eletrônica Acervo Saúde, v. 12, n. 7, p. e3615, May 21, 2020. 2. Castro, P. T. (2024). Legal aspects of the provision of medical records. Jusbrasil. 3. Silva, A. L. (2025) Medical records: do doctors have the right to access them for their defense? Migalhas. 4. Rosa, V. (2024). Medical records: how to protect doctors from legal risks. Migalhas. 5. FEDERAL COUNCIL OF MEDICINE. Resolution No. 2,217, of September 27, 2018. Approves the Code of Medical Ethics. Brasília, DF: CFM, 2018. Available at: https://sistemas.cfm.org.br/normas/visualizar/resolu coes/BR/2018/2217. 6. BRAZIL. Law No. 13,787, of December 27, 2018. Provides for the digitization and use of computerized systems for the safekeeping, storage, and handling of patient records. Brasília, DF: Presidency of the Republic, 2018. Available at: https://www.planalto.gov.br/ccivil_03/_ato20152018/2018/lei/l13787.htm. 7. SUPERIOR COURT OF JUSTICE – STJ. Special Appeal 1.758.799/MG, Third Panel, Rapporteur Nancy Andrighi, Judgment: 11/12/2019. Available at: https://processo.stj.jus.br/processo/revista/documen to/mediado/?componente=ITA&sequencial=18882 “Between Confidentiality and Justice: The Ethical and Legal Limits of Using Medical Records” 943 Tatiane Mendes Sanches1, RAJAR Volume 11 Issue 10 October 2025 67&num_registro=201700065219&data=20191119 &formato=PDF. 8. Botelho, M.C. and Camargo, E.P. do A. 2021. The application of the General Data Protection Law in healthcare. Health Law Journal. 21, (Dec. 2021), e0021. DOI: https://doi.org/10.11606/issn.23169044.rdisan.2021.168023. 9. Weston, F. C. L., Paglioli A. C. B., Mesquita, M, W. General Personal Data Protection Law and its applicability to nursing. Rev. Bras Enferm. 2023;76 (Suppl. 3): e20230126. 10. SANCHES, Tatiane Mendes. Processing of personal data for the implementation of public policies in smart cities. Rio de Janeiro: Lumen Juris, 2023. 11. De Aragão, S. (2020). Criminal abortion, criminal evidence, and medical confidentiality: a transdisciplinary analysis. Ibero-American Journal of Health Law.,9,182-207. https://doi.org/10.17566/ciads.v9i2.591. 12. Destro, P. (2020). Professional medical confidentiality in the context of Brazilian medical criminal law., 115, 165-208. Faculty of Law – University of São Paulo https://doi.org/10.11606/t.2.2019.tde-31072020135936. 13. BRAZIL. (Constitution - 1988). Constitution of the Federative Republic of Brazil of 1988. Brasília, DF: Presidency of the Republic. Available at: http://www.planalto.gov.br/ccivil_03/constituicao/c onstituicao.htm 14. Prestes, L., Rangel, M., & Rangel, M. (2007). Medical records and their medico-legal implications in the routine of the coloproctologist. Brazilian Journal of Coloproctology, 27, 154-157. https://doi.org/10.1590/S010198802007000200004. 15. Da Silva Maduro, L., & Pereira, L. (2020). Legal proceedings to obtain medicines in Ribeirão Preto. 28, 166-172. Bioethics Journal. https://doi.org/10.1590/1983-80422020281379. 16. Silva, W. (2025). Expertise as a defense tool in the judicialization of public works: analysis of the role of technical expertise in the defense of companies contracted by public agencies in legal proceedings. RCMOS - Multidisciplinary Scientific Journal O Saber. https://doi.org/10.51473/rcmos.v1i1.2025.925. 17. Bitencourt, A., Neves, N., Neves, F., De Sousa Brasil, I., & Santos, L. (2007). Analysis of medical error in ethical-professional proceedings: implications for medical education. , 31, 223-228. https://doi.org/10.1590/S010055022007000300004. 18. Santos, M., Mota, F., & De Araujo, N. (2020). Preservation and conservation of medical records from the medical archive and statistics service of the Professor Alberto Antunes University Hospital. Brazilian Journal of Information Science Education, 7, 4-23. https://doi.org/10.24208/rebecin.v7iespecial.184. 19. Santeramo, J., Rocha, T., & De Paula Cardoso Siqueira, A. (2021). Technical, ethical, and legal aspects in the preparation of veterinary medical records. 19. https://doi.org/10.36440/RECMVZ.V20I1.38094. 20. D'Agostino, M., Medina, F., Martí, M., & Saisó, S. (2020). Patient medical records: digitization is no longer an option and should be a requirement. , 14. https://doi.org/10.29397/RECIIS.V14I3.2137. 21. De Souza Lamblet, I., Sanglard, J., & Lazarin, N. (2020). Doctor-patient confidentiality and end-toend encryption. https://doi.org/10.5753/ERRC.2020.15206.