There is no single answer to “who is legally liable for a patient medical record?” Responsibility depends on what happened, which organization and individuals were involved, their roles and agreements, and the laws that apply. In the United States, HIPAA assigns duties to covered entities and business associates for protected health information (PHI), while state law and other federal rules may add requirements.
It is also important to distinguish responsibility for safeguarding records from ownership of the record or a patient’s right to access information. HIPAA gives individuals important access rights; it does not create one simple nationwide rule that patients “own” or “do not own” every record in every sense. This article is general information, not legal advice.
Who has responsibilities under HIPAA?
Covered entities
HIPAA covered entities include health plans, healthcare clearinghouses, and healthcare providers that conduct certain electronic transactions. Covered entities must follow applicable Privacy, Security, and Breach Notification Rule requirements for PHI. Depending on the situation, organizational responsibilities include maintaining policies, using reasonable safeguards, handling individual rights requests, and assessing and reporting breaches as required.
Business associates
A business associate performs certain services for a covered entity that involve creating, receiving, maintaining, or transmitting PHI—for example, some billing, hosting, or data-support services. A covered entity generally needs a written business associate agreement (BAA) that specifies permitted uses and disclosures and requires appropriate safeguards. Business associates also have direct HIPAA obligations in specified areas and must report breaches of unsecured PHI to the covered entity as required.
A vendor’s involvement does not automatically remove the covered entity’s responsibilities. Contracts and the facts matter. Review which party performs each function, how an incident must be reported, and how records will be returned, retained, or destroyed when a service ends.
Workforce members and clinicians
Employees and other workforce members must follow their organization’s privacy and security policies. An organization may investigate inappropriate access or disclosure and apply its policies and applicable law. Whether an individual worker, clinician, employer, vendor, or another party has legal liability in a particular case depends on the facts and governing law; a blog post cannot determine that outcome.
What can trigger legal or regulatory responsibility?
- Accessing or disclosing PHI without a permitted purpose or proper authorization.
- Failing to use safeguards appropriate to the organization and information.
- Not having required agreements or failing to address a known material breach of a business associate agreement.
- Not following breach assessment and notification duties after a reportable breach.
- Failing to meet applicable record access, amendment, retention, or professional requirements.
- Errors in handling records during a practice transition, closure, vendor change, or system migration.
Not every privacy incident is automatically a reportable breach, and not every error has the same legal consequences. Organizations should promptly involve their privacy officer, security lead, and counsel to assess the facts, contain the event, preserve evidence, and determine required next steps.
HIPAA breach notification: a shared process
When a business associate discovers a breach of unsecured PHI, it must notify the covered entity under the applicable rule and agreement. The covered entity generally has notification obligations to affected individuals and HHS, with additional requirements depending on the circumstances and number of people affected. The parties may allocate operational tasks by contract, but that does not justify delaying escalation or assuming someone else has completed a required assessment.
Use a written incident-response process with named contacts, timelines for internal escalation, preservation of relevant logs, and a method for documenting decisions. Only the responsible privacy/security and legal teams should determine whether notification is required.
Ownership, custody, and access are different questions
- Custody and maintenance: Which provider or organization keeps and manages the record?
- Access rights: What can the patient inspect or obtain under HIPAA and applicable state law?
- Ownership: Who has a property interest in the physical or electronic record under the relevant jurisdiction?
- Control and permitted use: Who may use, disclose, correct, or maintain the information, and for what purposes?
These questions can have different answers. HHS explains that individuals generally have a right to inspect and obtain copies of their PHI in a designated record set, subject to specific exceptions and procedures. State laws may provide additional access rights or govern record custody, retention, fees, and transfer. Check the jurisdiction and record type rather than relying on a universal ownership statement.
