How to Get Your Medical Records in Malaysia: A Patient's Guide

Do you have a right to your medical records in Malaysia?

Yes, a qualified one. The hospital or doctor owns the physical record. Regulation 44(1) of the Private Healthcare Facilities and Services Regulations 2006, made under the Private Healthcare Facilities and Services Act 1998 (Act 586), says a patient's record is the property of the private facility, and the Malaysian Medical Council (MMC) takes the same view. But owning the record is not the same as controlling access to it.

In Nurul Husna Muhammad Hafiz & Anor v Kerajaan Malaysia & Ors [2015] 1 CLJ 825, the High Court held that a patient has a qualified right of access to the records, and that the doctor or hospital has a matching duty to disclose them to the patient, or to the patient's agents, medical advisers or lawyers. The judge criticised the practice of refusing copies until a court orders it.

Disclosure may be refused only in limited cases, such as where it is likely to cause serious harm to the patient's physical or mental health, or would reveal information about another identifiable person. Otherwise, a reasonable request should be met on payment of reasonable copying charges.

The MMC guideline Medical Records and Medical Reports (MMC Guideline 002/2006) points the same way. It describes withholding information on the care, diagnosis, treatment and advice given to a patient, and copies of the relevant records, as unethical.

Medical records or a medical report: which do you need?

They are different documents, and if you are considering a claim you usually need both.

A medical report is useful for insurance, EPF, SOCSO or employer purposes, but it is one doctor's account of events. Where something may have gone wrong, the report may be written with that in mind, so anyone considering a claim should ask for the complete records as well.

Be specific. Ask for the complete records for named dates and departments, including observation, fluid and medication charts, and imaging in digital form. These are often left out of a first bundle. Our guide on proving medical negligence explains why each of them matters.

How do you request records from a private hospital?

Write to the hospital's medical records department with a copy of your identity card or passport and details of the admission or treatment. Many private hospitals have their own forms. Keep proof of the date you made the request.

You can also make a data access request under section 30 of the Personal Data Protection Act 2010 (Act 709). Information about your physical or mental health is sensitive personal data under the Act, and a private hospital is a data controller, the term that replaced data user from 1 April 2025.

• The request must be in writing, with the prescribed fee.
• Under section 31, the hospital must generally comply within 21 days. If it cannot, it must tell you in writing before then, and comply within a further 14 days.
• Under the Personal Data Protection (Fees) Regulations 2013, the maximum fee for a request for sensitive personal data is RM30 with a copy and RM5 without.
• Under section 32, the hospital may refuse only on listed grounds, for example where it cannot verify your identity or disclosure would reveal another person's data without consent.

A hospital may charge separately for a doctor's medical report, because a report is a new document, not a copy of existing data. Ask for the charges in writing before you pay.

How do you get records from a government hospital?

Apply to the hospital's medical records unit, usually on its own form, with identification and proof of treatment such as an appointment card, discharge note or bill. The PDPA does not help here, because section 3(1) says the Act does not apply to the Federal and State Governments, which covers Ministry of Health hospitals and clinics.

Government hospitals follow the Ministry of Health guideline on handling patients' medical records (Garis Panduan Pengendalian dan Pengurusan Rekod Perubatan Pesakit di Fasiliti KKM). In practice they usually supply a medical report, and release of the full records may need the consent of the hospital director or a court order.

Hospital Kuala Lumpur's published procedure is a useful example. It accepts applications from the patient, a parent or guardian of a patient under 18, the heirs of a deceased patient, and representatives such as lawyers or insurers with the required consent letters. Its listed fee for a regular medical report is RM40 for Malaysian citizens and RM80 for foreigners, and a second copy costs half the original charge. Forms and fees differ between hospitals and types of report, so check with the hospital concerned.

The Nurul Husna case was itself brought against the Government of Malaysia, so its reasoning on access applies directly to government hospitals.

Can family members get the records of a child or a patient who has died?

Yes, through the proper person. For a child under 18, a parent or guardian applies, usually with the child's birth certificate and the parent's identity card. For an adult patient, a family member or lawyer needs the patient's written authorisation, because the MMC guideline requires the consent of the patient, or of the next of kin, before records are released to a third party.

When the patient has died, the next of kin or the executor or administrator of the estate applies. Hospital Kuala Lumpur, for example, asks heirs for a consent letter from the legal heir, the death certificate or burial permit, and documents proving the relationship.

Since 1 April 2025, the Personal Data Protection (Amendment) Act 2024 (Act A1727) has excluded deceased individuals from the meaning of data subject. Families therefore cannot use a PDPA data access request for a deceased patient's records, and rely instead on the MMC guideline, the hospital's procedure and, if needed, a court order.

Families considering a claim after a death should keep the time limits in view. A dependency claim must generally be brought within three years of the death, and a claim against a government hospital within 36 months of the act or neglect complained of. Our article on medical negligence time limits explains them.

What can you do if the hospital refuses or delays?

Escalate in writing first, then go to court if you must.

1. Write again, citing the MMC guideline on medical records and, for a private hospital, your PDPA data access request and its 21-day deadline.
2. Ask the hospital to give its reasons for any refusal in writing.
3. Complain to the Malaysian Medical Council about the doctor concerned, and, for a private hospital that ignores a PDPA request, to the Personal Data Protection Commissioner.
4. Apply to the High Court for pre-action discovery under Order 24 rule 7A of the Rules of Court 2012, which allows a person to obtain relevant documents from a likely defendant before suing.

Pre-action discovery is not automatic. The court decides whether to order it, and the application takes time and money. But in Nurul Husna the High Court said that a hospital which unreasonably withholds records, and so forces a patient to court, may be ordered to pay costs on a solicitor-client basis, a higher scale than usual.

Asking for records does not stop the time limit for a claim running. If the deadline is close, take advice on filing the claim and seeking the records through discovery in the action itself.

NZSK does not advise on a description alone. We review the records you already have, and the requests made, at a consultation, online or in person, before advising on next steps. More on our medical negligence work.