An audiology patient record is the set of documents that captures each patient’s hearing health: case history, examinations, audiograms, fittings and follow-ups. In Spain, a hearing clinic must keep it, retain it for at least 5 years after each episode of care, give patients access when they ask, and protect it as health data.
This guide covers what Spain’s Patient Autonomy Act (Law 41/2002) requires, what the GDPR adds, and what changes from one region to another. Every point links to its official source, checked in October 2026.
Important: this guide is for information only and is not legal advice. It describes Spanish and EU rules. Spanish regions have their own rules on clinical documentation, and other countries have different retention periods. Confirm the rules that apply to you with your adviser or data protection officer.
Why a hearing clinic must keep clinical records
In Spain, a hearing clinic is a healthcare establishment. Royal Decree 1277/2003 classifies it as “E.5 Hearing aid establishments”, because it fits medical devices to each individual patient.
Law 41/2002 sets the clinical documentation duties of public and private healthcare centres and services (art. 1). Its Article 2.6 requires every professional involved in patient care to meet the duties of information and clinical documentation.
If you work on your own, the responsibility is yours: under Article 17.5, health professionals who practise individually are responsible for managing and safeguarding the records they create.
Clinical record vs. case history
The case history (anamnesis) is the first interview: reason for the visit, medical history, noise exposure, tinnitus, previous hearing aid use. The clinical record is the whole file, and the case history is only one part of it (art. 15.2.d of Law 41/2002).
What the record must contain
Article 15.1 of Law 41/2002 sets the general rule: the record must include the information that is essential for an accurate, up-to-date picture of the patient’s health.
Article 15.2 lists minimum content designed mainly for hospitals. Several items (admission, emergency, surgery, anaesthesia, discharge) are only required for hospital stays or where specifically ordered. These are the items that apply to a hearing clinic:
| Minimum content (art. 15.2) | What it means in a hearing clinic |
|---|---|
| d) Case history and physical examination | First interview and otoscopy |
| e) Progress notes | Check-ups, adjustments and changes in hearing |
| g) Referral sheet | Referral to an ENT specialist and their reply |
| h) Reports of complementary tests | Pure-tone and speech audiometry, tympanometry and other tests |
Article 14.1 adds that the record must identify the professionals involved in each episode of care.
Beyond the legal minimum, good practice is to record:
- Identification and contact details, plus a contact person if the patient is a minor or needs support.
- The fitted device: manufacturer, model, serial number, ear and delivery date.
- Adjustments and fitting sessions, or a link to them if you keep them in NOAH.
- Signed consent forms and their dates.
- Repairs and warranties for each hearing aid.
The serial number has its own legal basis too. Royal Decree 192/2023 (art. 19.2) requires retail points of sale of medical devices to keep a documented record of the products they supply.
Personal notes. Professionals may write subjective impressions in the record, and Article 18.3 lets them withhold those notes when the patient requests access. Keep them separate from the rest of the record so you can do that.
How long to keep it
The national minimum: 5 years
Article 17.1 of Law 41/2002 requires clinical records to be kept for as long as the patient’s care requires and, at a minimum, 5 years from the discharge date of each episode of care.
In audiology the relationship is ongoing: fitting, check-ups, repairs, a new hearing aid. That makes “discharge” hard to pin down. The prudent approach is to keep the record while you still see the patient and count retention periods from the last visit.
Regional rules may extend it
Several Spanish regions have their own clinical documentation laws, and some set longer periods. For example:
- Catalonia: Law 21/2000, as amended by Law 16/2010 (art. 12.4), requires keeping consent forms and reports of complementary tests, among others, for 15 years after discharge. The rest may be destroyed after 5 years (art. 12.6).
- Basque Country: Decree 38/2012 covers public and private care, including professionals working individually. It keeps the 5-year minimum from each discharge (art. 19.1) and allows longer periods where specific rules require them.
Check your region’s rules before destroying any record, and keep anything that may be needed for legal proceedings.
Patients cannot force early deletion
The GDPR right to erasure (art. 17) does not apply when processing is necessary to comply with a legal obligation. While the retention period runs, you can refuse erasure, explaining why.
Health data: what the GDPR requires
A special category
Article 9 of the GDPR prohibits processing health data except in the cases it lists. One of them is medical diagnosis and the provision of health care (art. 9.2.h), when the data is handled by a professional bound by professional secrecy (art. 9.3).
In Spain, the Data Protection Act (Organic Law 3/2018), in its seventeenth additional provision, expressly lists Law 41/2002 among the laws that cover this processing.
In practice, you do not need patient consent to open and use the clinical record for care. You must still inform the patient about the processing (GDPR, art. 13). You will need consent for other purposes, such as marketing messages or sharing data with third parties. See the 7 costly GDPR mistakes in hearing clinics.
The obligations most often missed
| Obligation | Source | What to do |
|---|---|---|
| Record of processing activities | GDPR, art. 30.5 | The exemption for organisations under 250 employees does not apply if you process health data. Always keep one. |
| Security measures | GDPR, art. 32; Law 41/2002, art. 17.6 | Access control, encryption and backups. |
| Data breaches | GDPR, art. 33 | Notify the supervisory authority within 72 hours if there is a risk. |
| Contract with the software vendor | GDPR, art. 28 | Sign a data processing agreement with whoever hosts your data. If it is not offered, ask for it. |
| Data protection officer | Organic Law 3/2018, art. 34.1.l | Mandatory in Spain for healthcare centres that must keep clinical records. Professionals working individually are exempt. |
| Active custody | Law 41/2002, art. 19 | Patients are entitled to “active and diligent” custody of their records. |
Who has access. The record is for the people treating the patient (Law 41/2002, art. 16.1). Front desk needs the calendar and contact details, not audiograms. Set permissions by role.
The patient’s right of access
Patients have the right to access their clinical record and get a copy (Law 41/2002, art. 18.1, and GDPR, art. 15). Article 18.1 also requires healthcare centres to set a procedure for handling these requests.
According to Spain’s data protection authority, the AEPD:
- Access covers paper and electronic records.
- It is free, unless more than one copy is requested or requests are excessively repeated. Spanish law (Organic Law 3/2018, art. 13.3) treats more than one request within 6 months as repetitive, unless there is a legitimate reason.
- You must respond within one month, extendable by two more months depending on complexity and the number of requests.
- Access does not include the names of professionals who viewed the record, unless a law allows it.
There are limits (Law 41/2002, art. 18):
- Access cannot breach third parties’ right to confidentiality of data in the record.
- Professionals may withhold their subjective notes.
- Patients may act through an accredited representative.
- For deceased patients, only relatives or people linked by a de facto relationship may access the record, unless the deceased expressly forbade it.
Write down who receives requests, how identity is verified, who reviews the copy and how it is delivered. And keep proof of your reply.
Checklist
- Keep one record per patient, with case history, examination, tests, progress notes and identified professionals.
- Keep subjective notes separate.
- Record each fitted hearing aid with its serial number.
- Retain records for at least 5 years from the last visit, and longer if your region requires it.
- Inform patients about the processing and only ask for consent where it is required.
- Keep a record of processing activities.
- Check whether you must appoint a data protection officer.
- Restrict access by role, encrypt data and make backups.
- Sign a data processing agreement with your software vendor.
- Write a procedure to answer access requests within one month.
How practice management software helps
With paper or several spreadsheets, this checklist is hard to meet. Software built for hearing clinics keeps the whole record in one patient file and controls who sees it. With Audyum:
- Patients fill in the case history online and their answers are saved to their file.
- Audiograms, fitted products, prescriptions and follow-up sit in the same history.
- Each hearing aid is linked to its serial number through the inventory.
- Data is encrypted, with daily backups and roles and permissions per user.
- Consent forms are signed electronically and stored in the patient file.
- On request, we sign a data processing agreement with your clinic.
Want to see how to organise your clinic’s records in Audyum? Request a free demo. And if you are still comparing systems, read what a CRM for audiology clinics must include first.