The purpose of this article is to present selected legal provisions regulating the issue of keeping medical records in medical care providers – its scope and principles, as well as to indicate the legal aspects of the security of data aggregated as part of medical records. Specially that medical records are increasingly being kept in digital form. Assuming that the legal conditions in the national legislation are sufficiently defined, the key is- sue is, on the one hand, to indicate the practical conditions for ensuring the optimal (under given conditions) level of computerization of medical care providers and on the other hand – the related level of data security – from the IT point of view. This article, in addition to the conclusions from the analysis of the applicable legislation, presents practical observations related to the application of legal provisions in medical care providers, which are based on the knowledge and professional experience of the author. The point of reference is the assumption that the overriding element of activities for data security, especially about the health of patients, is the awareness of the “key user”, which is always almost every person in the medical facility staff.