Editorial Archive · DITAP Health
Digital patient record and Law 25.326: what your center needs to comply with
Jhonatan Matias · Published 2026-09-14
Article retrieved from the previous site. Its figures, prices, and references describe the context of the publication; the current scope is confirmed through business consultation. This does not replace professional advice.
Moving a patient’s clinical record from a paper notebook to a screen doesn’t just change the format—it changes what the law requires. Law 25.326 on the Protection of Personal Data, which has been in effect since 2000 and remains the standard in Argentina, classifies health data as… sensitive data... with rules that are stricter than those applied to common data, such as a name or phone number.
What constitutes sensitive health data?
Article 2 of the law defines data as sensitive when they reveal, among other things, a person’s health status. Article 7 goes further: it prohibits creating files that reveal sensitive data, unless there is a legitimate public interest authorized by law, and requires the data holder’s prior consent for its processing, except for the exceptions specified within the law itself (for example, when the data is necessary for providing healthcare services to the individual).
In practice, for a consulting office, this translates into two specific obligations:
- Informed consentdocumented, before recording a patient’s medical history.
- Enhanced security measures Regarding the safeguarding of that data, beyond what a commercial contact database would require.
The patient’s rights regarding their own medical record.
The law recognizes what is known as… Habeas dataEveryone has the right to access their own data, to request that it be corrected if it is inaccurate, and to request its deletion when appropriate. Applied to a digital patient record:
| Right | What does that mean in a doctor's office? |
|---|---|
| Access | The patient can request a complete copy of their medical history. |
| Rectification | You may request that a personal detail that is incorrect be corrected (but not a medical diagnosis, which is a separate professional act). |
| Suppression | You may request that your data be deleted, except where there is a legal obligation to maintain patient records. |
| Confidentiality | Access to her file should be restricted to those who have a professional reason to view it. |
The authority responsible for Law 25,326 is the… Public Access to Information Agency (PAIA)The entity to which database providers register and where claims are filed when these don’t meet expectations. This obligation of registration falls on the center, as the responsible party for the database, not on the software provider—although a well-organized system makes completing the process significantly easier.
What exactly does a clinical record system need to be able to do?
Complying with the law isn’t a task that’s completed just once. For a center that digitizes its patient records, this means, at a minimum:
- Signed consent. Before the initial upload of health data, which is saved as part of the patient’s record.
- Encryption Regarding the clinical data, whether stored or being transmitted between the office and the server.
- Access logWho accessed a patient’s record and when, not just who edited it.
- Limited access by roleAn administrative employee shouldn’t need to see the same level of clinical detail as the treating professional.
- Retention definedThe medical record has legal retention periods that vary depending on the jurisdiction and specialty, and which generally extend far beyond the duration of the patient’s relationship with the healthcare provider.
A notebook made of paper, stored in a drawer, almost fails at all of these points – there’s no record of who opened it, there’s no encryption, and consent is rarely documented separately from the rest of the consultation.
How does DITAP Clínica solve it?
In DITAP ClinicThe clinical data are stored encrypted, and every access to a patient record is logged, with access limited to the authorized professional at the center during the consultation. This is a pilot program: no certification is promised – as it doesn’t yet exist – and we prefer to state it directly to avoid a center assuming something that hasn’t been confirmed.
For a center that currently uses paper or a shared spreadsheet via WhatsApp, transitioning to a system with these controls isn’t just an operational improvement—it’s a move toward fulfilling the requirements of Law 25,326, which has been in effect for over two decades, and which, in the healthcare sector, is rarely fully met with manual methods.