Your file is not written for you

In 2018 I helped build the thing that would eventually save me

I was part of a group of programmers who worked on the first draft of GDPR compliance in Europe. It was an extraordinary thing to be part of and, at the time, it was mostly very boring. It was documentation. Pages and pages of it, and I read all of it, because that was the job.

I have a memory that works almost photographically. Those articles went in and they stayed in. I could tell you what Article 15 says. I have been able to tell you for eight years.

It never once occurred to me that it applied to me.

I am not that smart after all.

I thought of it as something I built for other people, the way you build anything for a client. A right that users have. A thing a company has to honour. Not a door I could walk through myself, in my own life, as a patient, in a hospital in Vienna.

That is the part I have had to make peace with, and it took most of this year.

What it cost to find out my own results

Before any of the rest of it, there is this, and it set the shape of everything.

Every scan, every test, every evaluation connected to my cancer was done in a public hospital, on public hospital paper, paid for by my insurance. And then, to find out what the result of it was, I paid. Two hundred euros for fifteen minutes, to be told one of three things: you are cancer free, you are getting worse, or nothing at all.

Nothing at all was common. The arrangement, said out loud, was that if he did not find anything different he did not have to contact me. So silence meant everything is fine, and I learned to read silence that way for years.

I also had to pay to get copies of my own documents. From a public hospital. I have never understood that, and I still do not.

And the thing silence was hiding, for fourteen months, was that my cancer was progressing. There were earlier evaluations saying it was possible. They existed. I was not told, and I was being encouraged to go private and pay for it instead.

The year I stopped being treated and started being managed

Last year I was getting better. That is the detail nobody knows and it is the one that matters most to me.

I had a nerve injury and it was healing. My fingers worked. I could drive. I could put a brace on and type, and program, and build the thing I had been building. I was happy. After sixteen years of this I was genuinely, uncomplicatedly happy to be alive and working.

And the doctor treating me kept telling me that the injury belonged to the cancer.

I did not know why he said it. I trusted him. My first consultation with him was in January 2013, and he was still my doctor this year. Thirteen years. He was the last doctor in that system I still trusted, and after everything that had already happened, that counted for a great deal.

Then came a year I can describe but would rather not relive. Pain I do not have a good word for. Lymphoedema through my hand and arm. Nerves completely inflamed. Around twelve medications a day for pain.

At one point I asked him, plainly, to tell me what he had injected me with the previous summer, because whatever it was had numbed me to the point that I could no longer feel what was happening inside my own body, and I did not want it any more. I wanted to know what was in me.

What I got back was an explanation. The pain was permanent. It was the result of the cancer and the radiation. The fibrotic tissue was in my plexus. I would live with this for the rest of my life.

So I believed him, because that is what the sentence is designed to do. And the prescriptions increased. More sedation. More painkillers. More.

There was a night, around two in the morning, when the pain went past anything I have a word for, and I had a thought about my own hand that frightened me.

Instead of being taken seriously, I was left alone with the pain. What I was offered was benzodiazepines, painkillers, and a private number.

What happened after that I cannot disclose, for legal reasons.

So I used Article 15

I asked for my data more than once, the ordinary way, and I did not get it.

Then I stopped asking as a patient and asked as what I actually am. I invoked Article 15, in writing, the way I had helped teach other people's companies to answer it eight years earlier.

And it came.

What was in it

I was being read as a dying person.

Not treated. Read. Everything written about me was written in the register you use for somebody whose outcome has already been decided, and every decision made about my body followed from that register rather than from my scans.

Because my scans were fine. Stable. No visible or detectable cancer, from December 2024 until today. That is not my hope, it is what the imaging says.

And I was being managed, through that entire period, on very large doses of benzodiazepines. I am sitting here writing this and I still do not know exactly how my own brain works now. I was made dependent on something I did not need.

What I actually had was treatable. It was treated as something else, for comfort, for sedation, for the management of a person on their way out. And the thing that is left behind is a hand that is paralysed and a life that changed shape permanently.

I want to be exact about the next part, because it is the correction I would make to almost every article ever written about medical records.

“The file was complete. It was not correct. And it was never written for me to read.”

Yes, it was hard to read. It is written in a language nobody taught me and I had to work at it. But I do not want that to be the headline, because too technical is a comfortable story and it lets everybody off.

Everything was in there. The file was complete. It was simply not correct, and it was never written with me as the reader. It is written about you, for other people, and passed between them, and what it says decides what happens to your body.

I grieved my hand for a year

I am not going to be graceful about this part.

I was bitter. I was angry. I could not believe it had happened to me, of all people.

Nearly thirty years of reading specifications. Manuals for machines I would never own. Other people's code at two and three in the morning, hunting one wrong character. I keep my papers in chronological order because that is simply how I am built. And I never once dug into my own medical records.

The person who built a recovery protocol. The person who had been running her own health data through an API she wrote herself, in JSON, analysing it for months before it was ever an application. The person who read the law that would have opened the door, in 2018, and remembered every word of it.

And I did not look. I trusted a person, which is the thing we are all told to do, and by the time I looked the hand was already gone.

I have made peace with it. Not with them. With myself.

What Article 15 actually gives you, in plain words

This is the part I want people to keep, so it is written as plainly as I can write it.

In the European Union, Article 15 of the GDPR gives you the right to see the personal data an organisation holds about you, and a hospital is an organisation. Recital 63, which is the regulation explaining its own intention, names health records directly: “the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided.”

Assessments by treating physicians. The opinion somebody forms about you, writes down, and never says to your face. Named in the law, as yours.

The first copy is free. Further copies can carry a reasonable administrative charge. You do not have to explain why you want it, and there is no special wording. It is a request, not a favour.

Alongside the data itself, Article 15 also entitles you to be told:

• <b>Why</b> they are processing it. The purposes.
• <b>What categories</b> of data they hold about you.
• <b>Who they have given it to</b>, or will give it to. The recipients.
• <b>How long</b> they intend to keep it.
• <b>Where they got it</b>, if it did not come from you.
• Whether any <b>automated decision-making or profiling</b> is involved, and the logic behind it.
• That you have the right to ask for <b>correction or erasure</b>, and the right to <b>complain to a supervisory authority</b>.

One thing I will not overstate

Article 15 gives you who your data was disclosed to. That is not quite the same as a log of every individual who opened your record. Some health systems keep such a log and will give it to you, but Article 15 by itself guarantees recipients, not readers.

I would rather tell you that now than have you quote me at a hospital desk and be contradicted.

If you are not in Europe

Most of the people reading this are in the United States and Australia, so the European article is no use to you on its own. The right exists where you are. It has a different name.

United States

The HIPAA Privacy Rule gives you the right to inspect, review and receive a copy of your medical and billing records held by covered providers and health plans. The rule is 45 CFR 164.524.

They cannot refuse you a copy because you have an unpaid bill. They may charge reasonable costs for copying and postage, but they cannot charge you for searching for or retrieving your records.

And there is something Europe's Article 15 does not spell out as plainly. If you think something in your record is wrong, you can request an amendment, and they must respond. If they refuse, you have the right to file a statement of disagreement that they must add to your record. Your objection then travels with the file, to everybody who reads it afterwards.

One exception to know about: psychotherapy notes kept separately by a mental health professional are not covered by the access right.

Australia

Australian privacy law gives you a general right to request access to the health information a provider holds about you, under Australian Privacy Principle 12 of the Privacy Act. For public hospitals it is your state or territory law that applies instead, so check which one you are dealing with.

A provider should respond within a reasonable period, and the regulator says it generally considers thirty days reasonable. They may charge a fee, but it cannot be excessive, and it cannot be used to put you off asking.

What I am not saying

My last conventional treatment was radiation, in 2024, and I decided then that I would not go back to conventional treatment unless somebody tells me that without it I die tomorrow. That is my decision, about my body, made with everything I now know about what was done to me.

It is not a recommendation, and I am not telling anybody to refuse treatment. I have no idea what is in your file or what is happening in your body, and anybody who tells you they do, from the internet, is lying to you.

And I am not telling you to stop trusting your doctor. You are allowed to trust your doctor. That is the entire point of having people who help you, and a person who trusts nobody does not get well either.

What I am saying is narrower than that, and I think it is true for almost everybody reading this.

“Sometimes we simply are not told that we have the right to know more.”

Why this is the thing I am building

My NEDPath did not start with a business plan. It started with a folder about my own body that I had every right to read, eight years of knowing exactly which article opened it, and fifteen years of never thinking to use it.

Sometimes the answer to your illness, or the path out of it, is sitting in a document you have never seen. Mine was. It was in there the whole time, saying something about me that nobody was ever going to say to my face, and shaping every prescription I was handed.

I read it two years late. I would like you to read yours earlier than I read mine.

Sources

The parts of this post that are about the world rather than about me carry their sources.

Article 15 GDPR, Right of access by the data subject. The right to a copy, what you must be told alongside it, and the fee for further copies.

Recital 63 GDPR, Right of Access. The passage naming medical records, diagnoses, examination results and assessments by treating physicians.

Your Medical Records, US Department of Health and Human Services. The HIPAA right of access, the limits on charges, and the right to request an amendment and to file a statement of disagreement.

Access your health information, Office of the Australian Information Commissioner. Australian Privacy Principle 12, the thirty day expectation, and the rule that a fee cannot be excessive.