Should patients own their health records?

It’s my body and my health so why can’t I be the legal owner of my medical record? This important question was debated during a series of webinars run by The BMJ on patient access to medical records.1 Most of those involved agreed that we should be able to access all data that’s held on us, including our full medical records, but the ownership question was more contentious.

Many webinar participants saw record ownership as key to rebalancing healthcare in a more person centred direction, empowering patients to take more control of their health and data. They argued that ownership would deliver benefits in terms of the ability to control access, to check and correct errors, to record health goals and concerns, and to monitor usage through an electronic audit trail.

Others asserted that most people don’t want the responsibility of holding, managing, and maintaining their records, as long as they can access them when they need to. Some felt that defining ownership of electronic data are impossible anyway and must not be used as a ploy to derail patient access to their records, which is more important.

Patients in the UK have had a right to view, but not own, their medical records since 1998, but a special request had to be made to a data controller—usually a general practice or hospital—to effect this and very few patients did so.2 Access became slightly easier in April 2015 when all GPs were contractually obliged to offer patients online access to certain sections of their primary care record, but not all of it.3 GP software providers made record access facilities available and many practices activated these, but little was done to advertise them, with the result that uptake was slow to develop—by 2021 only 7% of patients in England had accessed their medical records online.4

Meanwhile the law in relation to record ownership remains unreformed, with legal ownership vested in the organisation that owns the paper or database on which the record is stored. This leaves records in a highly fragmented state, with no central place where patients can access their full medical record, including hospital and other specialist notes, as well as those held by general practices. Each data controller can in theory allow access to the data they themselves hold but not that held by other bodies. In practice this leads to huge confusion about how and when records can be shared.

The government’s recent attempt to clarify the situation announced the vaguely worded intention to “bring citizens closer to their data,” but offered no means of giving them more control, relying instead on assurances that personal data will be shared between professionals working in different settings securely in a way that protects patients’ privacy.5 While privacy and data security is of utmost importance, the report completely fails to recognise that people may want to have more control so they can use their records to manage their own healthcare and to determine who can access it.