It was not that long ago that nine out of ten U.S. doctors stored their patients’ records in color-coded files and updated them by hand. Now, approximately 85% of nationwide office-based physicians are using electronic health records (EHRs). Similarly, more than 90% of large, medium, small rural and critical access hospitals are currently using EHRs. If you visit a doctor today or are admitted to a hospital, there is a pretty good chance that your doctor will enter your medical record into an EHR, which you can subsequently view and download from a dedicated web portal. If you have ever wondered, “Does my health information belong to me or to my doctor?” you are not alone.

There are many people or entities who could claim ownership over a patient’s medical information. Does your physician own it? The medical institution? Some third party? In general, ownership of information belongs to the individual or company who created or authored that information. For example, intellectual property laws protect “original works of authorship.” Medical records represent professional medical opinions of a physician or a medical institution, and therefore may not necessarily be the patient’s property. 

Why shouldn’t individuals own their medical records? After all, these medical records contain their personal health information and were created for them. Lab work is literally a part of the patient — why should other people own that?

Every state has different laws (registration required) about who owns medical records. New Hampshire is the only state that explicitly gives patients ownership of their health data, and most states don’t have any law delineating the custody of records. However, today most systems provide patients access to information through a web portal. It shows a list of person’s health conditions in easy to understand terms, lists medications she is currently taking and includes lab and imaging study results, as well as recommended health measures.

Under federal and state law, patients have legal privacy, security and accuracy rights related to their health information. However, once that information is captured and documented in written or electronic form (e.g., paper chart or electronic data file), and since the health care provider owns the media in which the information is recorded and stored, the health care provider gains the property right of possession of data. In essence, the health care provider becomes the legal custodian of your health care record and is given specific legal rights and duties relating to possession and protection of that health record.

If you don’t “own” your medical data, then what does all this talk of “patient’s data ownership” really mean? Rather than ownership, it’s the idea of having access and control over your data that you should be focusing on.

For example, the patient has a right to view and get copies of her health information, as well as request changes to the information. Patients also have a right to get their health records in the format they choose — some patients may want electronic copies of medical records, others might want to download them from a web portal and still others may use standard interfaces to access their information in EHRs. This is really important because it allows individuals to retain a copy of their health records in their custody and this has profound implications for how consumers finally become active participants in their health and wellness. Regardless of who owns their medical records, when patients have a copy of their health records that are readily accessible on their phones, for instance, they become more aware and engaged. What’s more, engaged patients are healthier patients.