A patient asks for a complete chart before moving to another state. A physician leaves the group. Your EHR vendor raises its export fees. Suddenly, a question that seemed administrative becomes urgent: who owns records in a medical practice?
The practical answer is rarely as simple as “the doctor” or “the patient.” In the United States, medical-record ownership, custody, access, and control are separate concepts. State law, employment agreements, organizational structure, payer requirements, and technology contracts can all affect the result. Practice leaders need to understand those distinctions before a transition, dispute, sale, or closure puts patient care at risk.
Who Owns Records? Start With Four Separate Questions
Many record disputes happen because people use the word “owns” when they mean something else. A better approach is to separate the issue into four questions.
First, who is the legal custodian of the record? In many states, the physician, medical group, hospital, or healthcare entity that created and maintains the record is the custodian. That party generally carries the duty to protect it, retain it, and make it available when required.
Second, who has the right to access it? Patients have broad rights under HIPAA to inspect or obtain copies of their protected health information, subject to limited exceptions. Access rights are not the same as ownership. A patient can receive a copy of the chart without taking possession of the practice’s original record.
Third, who controls the systems and workflows around the record? A clinic may use a cloud-based EHR platform, but the vendor should not control whether the practice can retrieve usable patient data. This is a contractual and operational issue, not merely a technology issue.
Fourth, who is responsible when something goes wrong? The party responsible for privacy, security, retention, and continuity of care may not be the individual clinician who entered every note. For an employed physician, that distinction is especially significant.
Patients Have Strong Rights, Even When They Do Not “Own” the Chart
HIPAA gives patients the right to request access to their medical information held in a designated record set. In most cases, practices must respond within required time frames and provide records in the requested format when readily producible. State law may provide additional rights or stricter deadlines.
For a practice, the operational lesson is clear: do not treat patient requests as a debate over ownership. Treat them as an access and continuity-of-care responsibility. Delays, excessive fees, incomplete exports, or unclear procedures can damage patient trust and create regulatory exposure.
Your team should know how to process requests consistently. That includes verifying identity, documenting the request, determining what information is responsive, applying any lawful exceptions, and tracking the deadline. Patients should not have to negotiate with front-desk staff to obtain records needed for a specialist visit, insurance appeal, or relocation.
A useful internal rule is this: the practice retains and safeguards the official record, while the patient has enforceable rights to access and receive copies of their health information.
The Practice Entity Usually Matters More Than the Individual Physician
In an independent solo practice, the physician may be both the clinician and the legal entity responsible for records. Even then, state law determines the precise duties for retention, transfer, and closure.
In a group practice, records are often maintained by and for the practice entity. A physician who leaves the organization may have a legitimate clinical interest in certain information for patient care, defense of a claim, or continuity planning. That does not automatically mean the departing physician can copy an entire patient panel or remove records from the practice.
Employment and shareholder agreements should address this directly. Agreements should clarify whether patient records remain with the group, how patients are notified when a physician departs, what access the departing clinician retains, and how transfer requests will be handled. Without clear language, a professional departure can become a disruptive dispute that patients experience as abandonment or confusion.
For hospital-employed physicians, the hospital or affiliated health system is commonly the record custodian. Clinicians should understand their access rights before leaving, particularly if they need records to respond to a malpractice claim or board inquiry. Access for legal defense should be appropriately limited, documented, and coordinated with compliance or legal counsel.
EHR Vendors Do Not Automatically Own Your Patient Data
A common mistake is assuming that because an EHR vendor hosts the platform, the vendor owns the clinical data. A properly structured arrangement should distinguish between the vendor’s software and the practice’s patient information.
However, a vendor can create serious practical barriers if the contract is weak. Data export charges, limited file formats, delayed retrieval, incomplete audit logs, and unclear termination procedures can leave a practice unable to move records efficiently. The issue becomes acute during a sale, merger, vendor change, cyber incident, or unexpected closure.
Before signing or renewing an EHR agreement, review these operational points:
- Who may request a full data export and under what circumstances.
- Which data elements are included, such as notes, documents, images, billing data, audit logs, and patient communications.
- Whether the export is delivered in a usable, structured format or only as static files.
- What fees, deadlines, and support obligations apply at termination.
- How long the vendor retains backup data after the contract ends.
- How the vendor supports HIPAA obligations, security incident response, and business associate requirements.
The lowest subscription price can become expensive if the practice cannot retrieve its own data when it needs it. Clinic owners should treat data portability as a business-continuity requirement, not an optional contract detail.
Retention Duties Continue After a Practice Changes Hands
Ownership questions become more complicated when a practice is sold, merged, or closed. The purchasing entity may acquire records or assume custodianship, but the transaction documents must clearly assign responsibility for retention, release requests, privacy compliance, and patient notification.
Retention periods vary by state and may differ for adults, minors, deceased patients, Medicare and Medicaid records, diagnostic images, controlled-substance documentation, and litigation-related materials. A general retention policy is not enough if it does not account for these categories.
Closing a practice requires particular care. Patients need reasonable notice, a practical method to request or transfer records, and clear information about who will serve as custodian after closure. The physician or entity cannot simply shut down an office, cancel the EHR subscription, and assume the obligation has ended.
Practice leaders should also place a legal hold on records when litigation, an audit, or an investigation is reasonably anticipated. Normal destruction schedules should pause for affected records until the matter is resolved. Deleting information too early can create greater risk than the original dispute.
Build a Record Governance Policy Before You Need One
The best time to resolve record ownership is before a physician departure, acquisition offer, or patient complaint. A short, well-maintained governance policy can prevent expensive confusion.
Start by identifying the formal record custodian for each site and legal entity. Then document who can authorize releases, approve exports, change EHR permissions, and communicate with patients during a transition. Include a retention schedule that reflects applicable federal and state requirements, with a process for reviewing it annually.
Your policy should also address role-based access. Staff members need the information necessary for their work, not unrestricted visibility into every patient chart. When an employee or clinician leaves, promptly remove access, preserve relevant audit logs, and confirm that no local downloads or unsecured copies remain.
Finally, test the process. Request a sample patient export, confirm that it contains clinically useful information, and measure how long it takes. A record-release policy that works only on paper will fail at the moment patients and clinicians are under the most pressure.
When Legal Advice Is Necessary
General guidance cannot answer every ownership question. State medical-record laws differ, and contracts can change the analysis. Seek healthcare legal counsel when a practice is being sold or closed, a physician is leaving with a disputed patient panel, a patient request involves sensitive information, or an EHR vendor restricts access to data.
The goal is not to win an abstract argument about who owns the chart. It is to ensure that the practice protects confidential information, meets its legal duties, and allows patients to continue receiving care without unnecessary friction. Clear custodianship, reliable access procedures, and portable data are part of good patient service as much as good practice management.
