Ownership of patient's record

Ownership and keeping of patient's records varies from country to country.

US law and customs

In the United States, the data contained within the medical record belongs to the patient, whereas the physical form the data takes belongs to the entity responsible for maintaining the record per the Health Insurance Portability and Accountability Act.Patients have the right to ensure that the information contained in their record is accurate, and can petition their health care provider to amend factually incorrect information in their records.

UK law and custom

In the United Kingdom, ownership of the NHS's medical records has in the past generally been described as belonging to the Secretary of State for Health  and this is taken by some to mean copyright also belongs to the authorities.

German law and customs

 Germany, a relatively new law,which has been established in 2013, strengthens the rights of patients. It states, amongst other things, the statutory duty of medical personnel to document the treatment of the patient in either hard copy or within the electronic patient record (EPR). This documentation must happen in a timely manner and encompass each and every form of treatment the patient receives, as well as other necessary information, such as the patient’s case history, diagnoses, findings, treatment results, therapies and their effects, surgical interventions and their effects, as well as informed consents. The information must include virtually everything that is of functional importance for the actual, but also for future treatment. This documentation must also include the medical report and must be archived by the attending physician for at least 10 years. The law clearly states that these records are not only memory aids for the physicians, but also should be kept for the patient and must be presented on request.

In addition, an electronic health insurance card was issued in January 2014 which is applicable in Germany (Elektronische Gesundheitskarte or eGK), but also in the other member states of the European Union (European Health Insurance Card). It contains data such as: the name of the health insurance company, the validity period of the card, and personal information about the patient (name, date of birth, sex, address, health insurance number) as well information about the patient’s insurance status and additional charges. Furthermore, it can contain medical data if agreed to by the patient. This data can include information concerning emergency care, prescriptions, an electronic medical record, and electronic physician’s letters. However, due to the limited storage space (32kB), some information is deposited on servers.

Accessibility

United States

In the United States, the most basic rules governing access to a medical record dictate that only the patient and the health-care providers directly involved in delivering care have the right to view the record. The patient, however, may grant consent for any person or entity to evaluate the record. The full rules regarding access and security for medical records are set forth under the guidelines of the Health Insurance Portability and Accountability Act (HIPAA). The rules become more complicated in special situations.

Capacity

When a patient does not have capacity (is not legally able) to make decisions regarding his or her own care, a legal guardian is designated (either through next of kin or by action of a court of law if no kin exists). Legal guardians have the ability to access the medical record in order to make medical decisions on the patient’s behalf. Those without capacity include the comatose, minors (unless emancipated), and patients with incapacitating psychiatric illness or intoxication.

Medical emergency

In the event of a medical emergency involving a non-communicative patient, consent to access medical records is assumed unless written documentation has been previously drafted (such as an advance directive)

Research, auditing, and evaluation

Individuals involved in medical research, financial or management audits, or program evaluation have access to the medical record. They are not allowed access to any identifying information, however.

Risk of death or harm

Information within the record can be shared with authorities without permission when failure to do so would result in death or harm, either to the patient or to others. Information cannot be used, however, to initiate or substantiate a charge unless the previous criteria are met (i.e., information from illicit drug testing cannot be used to bring charges of possession against a patient). This rule was established in the United States Supreme

United Kingdom

In the United Kingdom, the Data Protection Acts and later the Freedom of Information Act 2000 gave patients or their representatives the right to a copy of their record, except where information breaches confidentiality (e.g., information from another family member or where a patient has asked for information not to be disclosed to third parties) or would be harmful to the patient's wellbeing (e.g., some psychiatric assessments). Also, the legislation gives patients the right to check for any errors in their record and insist that amendments be made if required.

Destruction

In general, entities in possession of medical records are required to maintain those records for a given period. In the United Kingdom, medical records are required for the lifetime of a patient and legally for as long as that complaint action can be brought. Generally in the UK, any recorded information should be kept legally for 7 years, but for medical records additional time must be allowed for any child to reach the age of responsibility (20 years). Medical records are required many years after a patient’s death to investigate illnesses within a community (e.g., industrial or environmental disease or even deaths at the hands of doctors committing murders, as in the Harold Shipman case)