Ownership and keeping of patient's records varies from country to country.
US law and customs In the
United States, the data contained within the medical record belongs to the patient, whereas the physical form the data takes belongs to the entity responsible for maintaining the record per the
Health Insurance Portability and Accountability Act. Patients have the right to ensure that the information contained in their record is accurate, and can petition their health care provider to amend factually incorrect information in their records. There is no consensus regarding medical record ownership in the
United States. Factors complicating questions of ownership include the form and source of the information, custody of the information, contract rights, and variation in state law. There is no federal law regarding ownership of medical records.
HIPAA gives patients the right to access and amend their own records, but it has no language regarding ownership of the records. Twenty-eight states and
Washington, D.C., have no laws that define ownership of medical records. Twenty-one states have laws stating that the providers are the owners of the records. Only one state,
New Hampshire, has a law ascribing ownership of medical records to the patient.
Canadian law and customs Under
Canadian federal law, the patient owns the information contained in a medical record, but the healthcare provider owns the records themselves. The same is true for both nursing home and dental records. In cases where the provider is an employee of a clinic or hospital, it is the employer that has ownership of the records. By law, all providers must keep medical records for a period of 15 years beyond the last entry. The precedent for the law is the 1992
Canadian Supreme Court ruling in McInerney v MacDonald. In that ruling, an appeal by a physician, Dr. Elizabeth McInerney, challenging a patient's access to their own medical record was denied. The patient, Margaret MacDonald, won a court order granting her full access to her own medical record. The case was complicated by the fact that the records were in electronic form and contained information supplied by other providers. McInerney maintained that she didn't have the right to release records she herself did not author. The courts ruled otherwise. Legislation followed, codifying into law the principles of the ruling. It is that legislation which deems providers the owner of medical records, but requires that
access to the records be granted to the patient themselves.
UK law and customs In the
United Kingdom, ownership of the
NHS's medical records has in the past generally been described as belonging to the Secretary of State for Health and this is taken by some to mean copyright also belongs to the authorities.
German law and customs In Germany, a relatively new law, which has been established in 2013, strengthens the rights of patients. It states, amongst other things, the statutory duty of medical personnel to document the treatment of the patient in either hard copy or within the
electronic patient record (EPR). This documentation must happen in a timely manner and encompass each and every form of treatment the patient receives, as well as other necessary information, such as the patient's case history, diagnoses, findings, treatment results, therapies and their effects, surgical interventions and their effects, as well as informed consents. The information must include virtually everything that is of functional importance for the actual, but also for future treatment. This documentation must also include the medical report and must be archived by the attending physician for at least 10 years. The law clearly states that these records are not only memory aids for the physicians, but also should be kept for the patient and must be presented on request. In addition, an electronic health insurance card was issued in January 2014 which is applicable in Germany (
Elektronische Gesundheitskarte or eGK), but also in the other member states of the European Union (
European Health Insurance Card). It contains data such as: the name of the health insurance company, the validity period of the card, and personal information about the patient (name, date of birth, sex, address, health insurance number) as well information about the patient's insurance status and additional charges. Furthermore, it can contain medical data if agreed to by the patient. This data can include information concerning emergency care, prescriptions, an electronic medical record, and electronic physician's letters. However, due to the limited storage space (32kB), some information is deposited on servers.
Accessibility United States In the
United States, the most basic rules governing access to a medical record dictate that only the patient and the health-care providers directly involved in delivering care have the right to view the record. The patient, however, may grant
consent for any person or entity to evaluate the record. The full rules regarding access and security for medical records are set forth under the guidelines of the
Health Insurance Portability and Accountability Act (HIPAA). The rules become more complicated in special situations. A 2018 study found discrepancies in how major hospitals handle record requests, with forms displaying limited information relative to phone conversations. ;Capacity :When a patient does not have
capacity (is not legally able) to make decisions regarding his or her own care, a
legal guardian is designated (either through next of kin or by action of a court of law if no kin exists). Legal guardians have the ability to access the medical record in order to make medical decisions on the patient's behalf. Those without capacity include the
comatose, minors (unless
emancipated), and patients with incapacitating
psychiatric illness or
intoxication. ;Medical emergency :In the event of a medical emergency involving a non-communicative patient, consent to access medical records is assumed unless written documentation has been previously drafted (such as an
advance directive) ;Research, auditing, and evaluation :Individuals involved in medical research, financial or management
audits, or program evaluation have access to the medical record. They are not allowed access to any identifying information, however. ;Risk of death or harm :Information within the record can be shared with authorities without permission when failure to do so would result in death or harm, either to the patient or to others. Information cannot be used, however, to initiate or substantiate a charge unless the previous criteria are met (i.e., information from illicit drug testing cannot be used to bring charges of possession against a patient). This rule was established in the
United States Supreme Court case
Jaffe v. Redmond Canada In the 1992 Canadian Supreme Court ruling in McInerney v. MacDonald gave patients the right to copy and examine all information in their medical records, while the records themselves remained the property of the
healthcare provider. Despite legal precedent for access nationwide, there is still some variance in laws depending on the province. There is also some confusion among providers as to the scope of the patient information they have to give access to, but the language in the supreme court ruling gives patient access rights to their entire record.
United Kingdom In the
United Kingdom, the
Data Protection Acts and later the
Freedom of Information Act 2000 gave patients or their representatives the right to a copy of their record, except where information breaches confidentiality (e.g., information from another family member or where a patient has asked for information not to be disclosed to third parties) or would be harmful to the patient's wellbeing (e.g., some psychiatric assessments). Also, the legislation gives patients the right to check for any errors in their record and insist that amendments be made if required.
Destruction In general, entities in possession of medical records are required to maintain those records for a given period. In the
United Kingdom, medical records are required for the lifetime of a patient and legally for as long as that complaint action can be brought. Generally in the UK, any recorded information should be kept legally for 7 years, but for medical records additional time must be allowed for any child to reach the age of responsibility (20 years). Medical records are required many years after a patient's death to investigate illnesses within a community (e.g., industrial or environmental disease or even deaths at the hands of doctors committing murders, as in the
Harold Shipman case).
Abuses in the case of intersex condition was to lie to the patient.] The
outsourcing of medical record transcription and storage has the potential to violate patient–physician confidentiality by possibly allowing unaccountable persons access to patient data. With the increase of clinical notes being shared as a result of the
21st Century Cures Act, the increase in sensitive terms used in the records of all patients, including minors, are increasingly shared amongst care teams making privacy more complicated.
Intersex people have historically had their medical records intentionally
falsified/concealed, to hide
birth sex, and
intersex medical procedures.
Christiane Völling became the first intersex person in Europe to successfully sue for
medical malpractice. Falsification of a medical record by a medical professional is a
felony in most United States jurisdictions. Governments have often refused to disclose medical records of military personnel who have been used as experimental subjects.
Data breaches Given the series of medical
data breaches and the lack of public trust, some countries have enacted laws requiring safeguards to be put in place to protect the security and confidentiality of medical information as it is shared electronically and to give patients some important rights to monitor their medical records and receive notification for loss and unauthorized acquisition of health information. The United States and the EU have imposed mandatory medical data breach notifications. Patients' medical information can be shared by a number of people both within the health care industry and beyond. The Health Insurance Portability and Accessibility Act (HIPAA) is a United States federal law pertaining to
medical privacy that went into effect in 2003. This law established standards for patient privacy in all 50 states, including the right of patients to access to their own records. HIPAA provides some protection, but does not resolve the issues involving medical records privacy. Medical and health care providers experienced 767 security breaches resulting in the compromised confidential health information of 23,625,933 patients during the period of 2006–2012. ==Privacy==