Last updated on Tuesday, 20, October, 2026
Table of Contents
Punjab Healthcare Commission MSDS Rules for Patient Record Access and Confidentiality
Under the Punjab Healthcare Commission (PHC) MSDS, a hospital meets Indicator 155 when care providers can access current and past medical records, the record is accessible only to authorized, concerned persons, and confidentiality is ensured.
The MSDS (Minimum Service Delivery Standards) is the PHC’s framework for hospitals, and Indicator 155 sits in its Information Management Systems (IMS) area. This guide explains the balance the indicator strikes between access and privacy, shows where hospitals usually slip, and gives you an access matrix and a confidentiality checklist your quality team can start using this week.
| Regulator | Punjab Healthcare Commission (PHC) |
| Standard | 29 (IMS-2): the medical record reflects continuity of care |
| Indicator | 155 |
| Priority | Non-critical |
| Applies to | Every hospital that keeps patient records, paper or electronic |
Indicator 155 is part of the PHC Information Management Systems standards. For all 19 indicators, see our guide to PHC Information Management Standards (IMS 28-30).
What the PHC MSDS requires for record access and confidentiality (Indicator 155)
The indicator says care providers have access to current and past medical records. The PHC’s compliance requirements add two conditions:
- The medical record is accessible only to authorized, concerned persons.
- Confidentiality is ensured. Read together, the indicator pulls in two directions, and a hospital must satisfy both:
- Open enough for care. A doctor or nurse treating a patient must be able to see the patient’s current record and earlier ones, such as a previous admission or a past visit.
- Closed enough for privacy. People with no part in the patient’s care, or in the review of records, must not be able to see it.
A non-critical indicator that connects to others
Indicator 155 is marked non-critical (yellow). It links closely to two other indicators: the written list of people authorized to make entries (145), and the review SOP that states who has access, what information they can access and confidentiality (158). If you have already built those, this one follows naturally.
What good access control looks like
The PHC states the principles but not the design. The table below is practical guidance for turning them into a working system.
| # | Principle | What it means in practice | Example |
|---|---|---|---|
| 1 | Care providers can see current records | The treating team can reach the record whenever the patient is under care | Ward notes available at the nursing station when needed |
| 2 | Care providers can see past records | Earlier admissions, visits and reports can be retrieved quickly by record number | Previous discharge summary found using the MRN |
| 3 | Only authorized, concerned persons | Access is limited to people involved in the patient’s care or in an authorized review | A billing clerk sees billing data, not clinical notes |
| 4 | Confidentiality ensured | Patient information is not disclosed or discussed outside those who need it | Locked record room; staff confidentiality undertaking |
Define “concerned” by role. A simple access matrix lists each role and what it may see. A consultant treating a patient needs the full clinical record. A pharmacist needs prescriptions. A registration clerk needs demographic details. A reviewer needs the sampled records and nothing more (Indicator 158).
Protect paper and screens alike. For paper files: locked rooms, a sign-out register and no files left on desks or trolleys. For electronic records: named logins, role-based permissions, automatic screen lock and an access log.
Be careful with copies and messaging apps. Photographs of records, or records forwarded over personal messaging apps, leave the hospital’s control. Set a clear rule on whether this is ever allowed, and who decides when a copy of a record is released to someone outside the hospital.
Remember the other half. Strict privacy must not stop a treating doctor from seeing a patient’s history. Test both directions.
Where hospitals usually fail on access and confidentiality
These are the gaps to look for in your own wards and record rooms. Each maps to the indicator’s wording.
- Files left on desks, trolleys or at the nursing station where anyone can read them.
- An unlocked or open record room, with no sign-out register.
- No written list of who may see which records.
- Shared logins in electronic systems, so no one can tell who opened a record.
- No access log, so a breach of confidentiality could never be traced.
- Past records hard to retrieve, so the treating team cannot see an earlier admission when they need it.
- No confidentiality undertaking signed by staff, reviewers and trainees.
- Staff opening records out of curiosity, with no rule against it and no check.
- Records photographed or forwarded through personal messaging apps.
- No clear rule on releasing copies to patients, families or outside bodies.
If your wards show more than a few of these, a simple walk-through with a checklist is the fastest way to see where to start.
How to comply with Indicator 155 in six steps
- Build an access matrix. List each role and what it may see, covering current and past records.
- Restrict physical and electronic access to match the matrix: locked rooms and a sign-out register for paper, named logins and permissions for screens.
- Make past records easy to find for treating teams, using the unique record number (Indicator 144) and a clear retrieval process.
- Get confidentiality in writing. Every staff member, reviewer and trainee with access signs a confidentiality undertaking and receives training.
- Set a rule for copies and sharing. Say who may release a copy of a record, to whom, and whether photographs or messaging apps are ever allowed.
- Audit regularly. Walk through wards and the record room with the checklist below, review the access log if you have one, document what you find and fix (Indicators 156 to 162).
Access matrix
Adapt the roles and entries to your hospital.
| Role | Current records | Past records | Parts of the record | Conditions |
|---|---|---|---|---|
| Treating doctor | ||||
| Nurse on the ward | ||||
| Pharmacist | ||||
| Registration and reception | ||||
| Billing and accounts | ||||
| Record reviewer | ||||
| Medical records department |
Confidentiality checklist
| Check | Yes / No | Notes |
|---|---|---|
| Access matrix written and approved | ||
| Record room locked, with a sign-out register | ||
| No records left unattended on desks, trolleys or counters | ||
| Electronic access uses named logins and roles | ||
| Past records can be retrieved quickly for treating teams | ||
| Confidentiality undertaking signed by all staff, reviewers and trainees | ||
| Rule on copies and messaging apps written and communicated | ||
| Access log or sign-out register checked this month | ||
| Reviewed by (name and title), signature, date |
How InstaCare Hospital software helps with access and confidentiality
On paper, access control depends on locked doors and good habits. An electronic record can build the rules into the system and leave a trail.
With CoreMedix hospital management software and the Electronic Medical Record from InstaCare:
- Each staff member has a named login, so every access is tied to a real person.
- Role-based permissions limit what each role can see, which mirrors your access matrix.
- A patient’s past records sit under the same unique record number, so treating teams can find earlier admissions in seconds.
- An access trail shows who opened a record and when.
- There are no loose files to leave on a desk or lose in a record room.
Want to see how roles and access work in a live record? Request a demo.
Frequently Asked Questions
What does the Punjab Healthcare Commission MSDS require for patient record access and confidentiality?
Care providers must have access to current and past medical records, the record must be accessible only to authorized, concerned persons, and confidentiality must be ensured.
Is Indicator 155 critical?
No. The PHC marks it as non-critical under Standard 29 (IMS-2).
Who counts as an authorized, concerned person?
The PHC does not give a list. In practice, it means people involved in the patient’s care or in an authorized review of records. Define it by role in a written access matrix.
Does the indicator cover past records as well as current ones?
Yes. Care providers must be able to access current and past medical records, so earlier admissions and visits need to be retrievable.
How is this different from the list of people who can make entries?
Indicator 145 is about who may write in the record. Indicator 155 is about who may read it. Both should be written down, and they will overlap.
How can we check that our access controls work?
Walk through your wards and record room with a checklist, review the sign-out register or access log, and test that a treating doctor can reach a patient’s history while an unrelated person cannot. Record the gaps and the corrective action taken.
Request a demo to see how CoreMedix handles access, confidentiality and the rest of the medical record.
