Medical Records Release Authorization
Patient authorization form for transferring medical records between Swiss healthcare providers. Specify the scope of records, recipient details, purpose, and expiry date. Compliant with Swiss nFADP, KVG, and cantonal health data legislation.
An authorisation that says "release my records" is not much of an authorisation. It does not say which records, covering which years, to whom, for what, or for how long the permission lasts — and every one of those omissions is either a delay or an over-disclosure. This form exists to make a release specific enough to act on and narrow enough to be safe.
Your rights under the nFADP
You have the right to access the health data any provider holds about you and to have it transferred to a provider of your choosing. Providers are expected to respond within 30 days. The authorisation you give is specific and time-limited — that is a feature, not a restriction.
The four things a release has to pin down
- Who releases — the institution actually holding the file, which is rarely "my doctor" in the abstract
- Who receives — a named provider and address, so the file does not travel further than intended
- Which records, over which dates — lab results, imaging, discharge summaries, and the date range; "everything" is what produces a box of paper nobody reads
- Why, and until when — the purpose and an expiry date, so a permission given for a referral in March is not still open in December
What this form collects
- Patient full name, date of birth, and contact details
- Name and address of the releasing healthcare provider
- Name and address of the receiving healthcare provider
- Type of records to be released (lab results, imaging, discharge summaries, etc.)
- Date range of records requested
- Purpose of the transfer (continuity of care, specialist referral, insurance, second opinion)
- Expiry date of the authorisation
- Patient signature with date
Nobody holds "your" medical record
Records in Switzerland are held by the institution that created them — your GP practice, a hospital, a specialist clinic, a physiotherapy centre — and each one keeps its own independently. Patients have a fundamental right of access to their own health data under the Federal Constitution (Art. 13) and the nFADP, which includes receiving a copy and, on written authorisation, having it sent onward.
What follows from that structure is the part people are caught out by: nothing transfers automatically. Changing GP or moving canton does not move the file. Someone has to ask, in writing, per institution. A patient who has seen four providers over a decade is making four requests, not one.
The EPD is not a substitute for this
The Electronic Patient Dossier (EPD / Elektronisches Patientendossier / DEP) is a voluntary national platform into which participating providers can upload key documents — discharge letters, vaccination records, medication lists. It makes those documents easier to share. It does not replace the individual provider record, and it is not a route to the full file, so a formal release is still what moves a complete history.
Ten years — and the exception for childhood records
Cantonal health legislation generally requires records to be kept for at least ten years from the last treatment for adults, and records created during childhood until the patient's 25th birthday. Some cantons set longer periods for specific types, such as operative reports or radiology images. The practical consequence for a transfer request is that older material may legitimately no longer exist, and it is worth knowing that before assuming a provider is stalling.
What can actually be transferred
Typically: GP consultation notes and referral letters, laboratory and pathology reports, radiology reports and imaging (DICOM files), hospital discharge summaries and operative reports, medication lists, vaccination records, physiotherapy and rehabilitation reports, and specialist consultation letters. Psychotherapy notes are treated more restrictively under some cantonal laws — if the request covers them, expect the releasing provider to apply a narrower reading.
When a provider says no
A provider cannot refuse a patient's written request for access to or transfer of their own records except on narrow therapeutic-privilege grounds, and a refusal on that basis has to be justified in writing. An unjustified refusal is a matter for the cantonal health authority, and saying so — calmly, in the follow-up — resolves most of them.
Running the request
Use this template
Copy it into your dashboard — the scope, date range and expiry fields are already structured.
Pre-fill your own details
If the form sits on your practice website, pre-fill the releasing or receiving provider field so patients are not transcribing your address by hand.
Send it to the patient
Share the link by email or SMS; they complete and sign it on any device.
Forward it as the formal authorisation
The signed submission is what goes to the releasing provider.
Track it
Log the authorisation and expiry dates, and follow up if records have not arrived within ten working days.
Questions patients ask
Is there a fee for transferring medical records?
Access to your own personal data is generally free under the nFADP. Providers may charge a reasonable fee for physically copying and sending large volumes; digital transfer should generally cost nothing. If you are billed, you are entitled to an itemised breakdown.
How long does it take?
Most providers process a transfer within ten to fifteen working days. If nothing has arrived after 30 days, the cantonal health authority or data protection officer is the escalation route.
See our use case for healthcare practices, the new patient intake template that usually triggers this request, and our guide to data export, portability and deletion.