Who actually owns your medical records? It depends where you live

Walk into the medical records office of an American hospital and ask for your chart. After a form, sometimes a fee, and a wait, you will receive a copy. The original stays in the building — because in most of the United States, it was never yours.

That sentence offends people the first time they hear it. It deserves a precise hearing, because what it does not say matters more than what it does.

The American answer: their record, your rights

In the United States, the record as an artifact — the paper folder, the rows in the hospital's database — generally belongs to the provider or institution that created it. HIPAA, the federal law most people assume settles this, is deliberately silent on ownership. What HIPAA does instead is more useful: it grants every patient a federal right of access — the right to inspect the record and obtain copies, in the form and format you request when that is readily producible. The HHS guidance on the right of access is unambiguous that this right belongs to you no matter whose name is on the filing cabinet.

State law fills in the ownership question, where it answers it at all. In the states that address the matter, statutes and regulations typically assign the record to the provider or hospital. Most states simply say nothing — the question was settled by custom in the era of paper, when the chart was a physical thing that could only be in one place, and that place was the clinic.

The practical translation: you do not own the object, but you hold rights against whoever does. We walk through exactly how to exercise them in your right to a copy under HIPAA and GDPR.

The New Hampshire exception

One state breaks the pattern. New Hampshire law deems the medical information contained in a patient's record the property of the patient — the only US state to say so outright.

Notice what changed for patients in New Hampshire when that law passed: almost nothing visible. Providers still maintain the charts. Patients still request copies the same way, through the same offices. The ownership declaration is philosophically satisfying and practically thin — which is the most instructive fact in this whole debate. A property label without machinery behind it is a sentence in a statute book. Access rights with deadlines and enforcement are what actually move paper.

The European answer: no owner at all

The EU resolved the question by refusing to ask it. The General Data Protection Regulation never says anyone owns personal data. Instead it builds a structure of rights that attach to the person the data describes: the right of access and a copy under Article 15, rectification of errors, erasure in defined circumstances, and portability of data you provided. Health data sits in a special category that demands extra justification before anyone may process it at all.

The frame is fundamental rights, not property. You do not own your health data the way you own a car; the data is about you, and that fact alone generates obligations in everyone who holds it. The UK kept the same architecture after Brexit under UK GDPR, with the Information Commissioner's Office enforcing it. And the European Health Data Space regulation now layers on rights of electronic access and rules for research use across the EU — we unpack that in the European Health Data Space, explained.

Ownership is the wrong question

A bicycle has one owner because only one person can ride it at a time. Data does not work that way: it copies rather than moves, and a hospital, an insurer, and a registry can all hold the same lab result simultaneously without taking it from each other. Property law was built for rivalrous things, which is why every legal system that looks hard at health data ends up regulating conduct — who may access, use, and share — rather than assigning title.

So the question that decides your real position is not "who owns it?" It is three questions:

Read down the middle rows and the lesson is plain: the jurisdictions differ far less on access than the ownership rhetoric suggests. Where they genuinely diverge is control over what happens next — the secondary uses, the research copies, the de-identified extracts that flow into a market most patients never see. That market is its own story, and we tell it in how health data gets bought and sold.

What to do with the rights you have

Whatever your jurisdiction calls the bundle, exercising it looks the same. Request your complete record, in writing, citing the law that applies to you. Prefer machine-readable copies over PDFs — structured data is the version of your history that can actually be searched, plotted, and contributed to research, and getting it is easier than most people think; the route is in how to download your own health data as FHIR. Keep what you receive. For anyone managing a chronic condition across multiple providers, that accumulated copy is frequently the only complete version of the story in existence.

This is the reading of "ownership" that Mithras Health is built on. On our platform — a patient-mediated research-data platform for chronic disease, currently pre-launch — patients own their records in the operative sense: the record sits under the patient's control, and each research study gets a separate, scope-limited consent that the patient can revoke at any time. No study sees data without that grant; no grant is permanent.

And because the broker economy thrives precisely in the gap between formal ownership and practical control, we closed the gap structurally: Mithras never buys or sells data. Access is granted by patients, study by study, and the platform's job is to make that grant — and its withdrawal — real.

Here is the thought worth keeping. For two centuries the chart belonged to the clinic because the chart was paper and paper can only be in one place. The paper constraint is gone. What remains is the question the ownership debate was always circling: not whose file is it, but who decides what it is used for. Laws on both sides of the Atlantic now agree more than they disagree — the deciding voice belongs, increasingly, to the person in the record.