Under federal and State law, patients have legal privacy, security and accuracy rights related to their health information, but once that information is memorialized in written or electronic form the healthcare provider becomes the legal custodian of that healthcare record and is given specific legal rights and duties relating to possession and protection of that healthcare record.
The Washington legislature has said that healthcare information is “personal and sensitive” and that patients “need access to their own healthcare information as a matter of fairness . . . .” See, RCW 70.02.005 (set forth in full, below). One way of conceptualizing this is to say that the information, in the abstract, belongs to the patient. If the information never were recorded, it would belong only to the patient.
But during the course of a patient encounter that abstract, personal information gets memorialized in “the healthcare record.” Since the healthcare provider owns the media in which the information is recorded and stored (e.g. the paper chart or the electronic data file), the healthcare provider has the property right of possession. But just because the provider has the right of physical control over the media in which the information is recorded, that does not mean the provider has the unfettered right to control the use of or access to that information.
Custody of the information is a fiduciary responsibility, and the Uniform Healthcare Information Act (Chapter 70.02 RCW) and HIPAA establish the rules governing how the information must be be maintained, protected, utilized and disclosed, and those laws give significant non-custodial rights to the patient. For example, the patient has a right to view the healthcare record and request changes to the information. The patient also has broad — but not unlimited — rights to control disclosure of information from the healthcare record to third parties.
So, patients do not have possessory property rights over the healthcare record, but they do have privacy rights protecting access to and accuracy of the information contained in the healthcare record.
Who legally has the right of physical control over the data files maintained by your doctor in her electronic medical records system? The doctor does. But the right to possess those data files is circumscribed by the fiduciary obligation to protect the privacy, security and accuracy of the patient’s personal and sensitive information as required by State and federal law.
If you have additional questions related to this topic, please contact us to schedule a consultation appointment to discuss them in detail. Whatever your specific circumstances may be, Anderson Hunter attorneys are ready and equipped to provide you with sound legal advice based on your specific situation and needs.