Short answer: there is no single answer that applies to every medical record in every U.S. state. “Ownership” can refer to the physical or electronic record, the information inside it, or the legal responsibility to keep and protect it. HIPAA primarily establishes privacy protections and individual rights to access protected health information; it is not a simple nationwide rule saying that every patient or every provider owns every record.
Ownership, custody, and access are different questions
- Ownership: who has a property interest in the record or information. State statutes, regulations, and court decisions may affect this, and details can vary by jurisdiction and record type.
- Custody and maintenance: which provider, facility, or other organization keeps the record and is responsible for handling it under applicable law and policy.
- Access and privacy rights: who may inspect, receive, use, or disclose the information. These rights are governed by HIPAA for covered entities and by other applicable federal and state rules.
HHS has explained that the HIPAA Privacy Rule does not settle who owns an individual’s medical record. So statements such as “the patient owns the chart” or “the hospital owns all the information” are too broad without considering the relevant state law, record type, and context.
What access rights do patients generally have under HIPAA?
With limited exceptions, the HIPAA Privacy Rule gives individuals the right to inspect and receive a copy of protected health information about themselves in a covered entity’s designated record set. This can include more than the provider’s main medical chart—for example, billing and payment records or other information used to make decisions about the individual. The right applies to records maintained on paper or electronically and may include directing an electronic copy to a chosen third party.
There are specific rules, exceptions, and procedures. For example, psychotherapy notes maintained separately receive special treatment under HIPAA, and certain narrow grounds may permit denial of access. State law may provide greater access rights or additional requirements. Patients can start by asking the provider’s medical-records or privacy office how to submit a request and what format is available.
Can a patient correct information in a record?
Patients can request an amendment to information they believe is inaccurate or incomplete. That does not mean every request must result in deleting or changing the original entry. Under HIPAA, a covered entity may accept or deny an amendment request under the applicable rules; if it denies the request, the patient generally has options to submit a statement of disagreement that is associated with the record. Ask the organization about its amendment process and deadlines.
