Yes, the medical record is a confidential document and its handling requires strict confidentiality. The institution may be required to limit access to what is strictly necessary, to adopt data protection measures and to correct practices that expose sensitive information.