Guide

Chart ownership: the practice holds it, the patient reaches it

Summary

State law, not HIPAA, decides who legally holds title to a medical record, and states frame that differently — some by statute, some by board rule, some not at all. HIPAA never addresses ownership; it addresses access. Whoever operates the practice typically holds the record, but the patient (or their personal representative) has a federal right to inspect or obtain a copy regardless of who holds title, and that right doesn't change from state to state.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

Ownership and access are two different rights

Ownership of a medical record and the right to access it are governed by two entirely different bodies of law, and conflating them is the most common mistake solo clinicians make on this question. Who holds legal title to the record — the physical chart or the EHR entry — is a matter of state law, and states are genuinely inconsistent about it: some statutes name the treating professional or the practice entity as owner, some regulate custody without ever using the word, and some say nothing directly at all.

HIPAA does not resolve this, because it was never written to. The privacy and security rule, 45 CFR Part 164, defines who counts as a covered entity and what a covered entity must do with the record — retain it, secure it, produce it — but it is silent on who holds title to the record itself 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.That HIPAA's Privacy and Security Rule defines covered-entity duties over the record but is silent on who holds title to it.. That gap is filled entirely by state law, which is why the honest first answer to "who owns the medical record" is: check your state, because HIPAA won't tell you, and no single state's rule generalizes to the rest of the country.

What HIPAA actually guarantees, regardless of who owns the record

Whatever your state says about title, HIPAA guarantees the patient something ownership can't override: the right to inspect or obtain a copy of the designated record set within 30 days of a request, with one permitted 30-day extension for cause, at a reasonable cost-based fee 2Ref 2HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The 30-day access timeline, extension, cost-based fee, and psychotherapy-notes exclusion that apply regardless of who owns the record.. Psychotherapy notes kept separately from the rest of the chart are the one carved-out exception to that access right, and the carve-out applies no matter who legally holds the underlying record.

This is the practical reason the ownership question matters less day to day than it sounds like it should: a patient's ability to get their own record doesn't turn on who "owns" it. It turns on whether the holder is a covered entity honoring §164.524, full stop. Clinicians who treat ownership as the operative question sometimes end up delaying or restricting access on a theory HIPAA doesn't recognize.

Why the ownership question surfaces hardest at a transition

The ownership question is mostly academic during active practice — whoever holds the record also has full access to it, so the distinction never gets tested. It surfaces hard at a transition: a clinician leaving employment at a group practice, selling a solo practice, or a solo clinician relocating and closing one location to open another. The employer or buyer typically retains the records as a business asset of the practice, while the departing clinician's professional obligations to those patients continue regardless of who holds title going forward.

These practice-transitions scenarios are exactly where the ownership question earns its keep, because the minimum-necessary standard and the rest of the Privacy Rule's use-and-disclosure limits don't reset at the boundary either — whoever ends up holding the record after a transition inherits the same disclosure discipline the original practice carried, not a fresh, looser set of rules just because the record changed hands 3Ref 3HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That minimum-necessary and use-and-disclosure limits continue to bind whoever holds the record after a practice transition..

When a patient dies, the ownership question doesn't disappear

A patient's death doesn't resolve who owns their chart — if anything it adds a second layer, because someone now has to determine who may request access on the deceased patient's behalf. HIPAA treats a deceased patient's personal representative, typically the executor or administrator of the estate, as standing in the patient's shoes for access purposes, and state law (not the practice's own judgment) determines who that representative actually is 4Ref 4HHS Office for Civil Rights (2026).Personal Representatives.That a deceased patient's personal representative, defined by state law, stands in the patient's shoes for access purposes..

This is one of the scenarios where clinicians most often confuse ownership with authority to act. The practice may still hold title to the record exactly as it did the day before the patient died; what changes is who is now entitled to request it, and that question runs through the same personal-representative analysis a living patient's family member would face, not through ownership at all. Documenting how a solo practice will identify and verify that representative belongs in the same professional-ethics planning as the rest of a wind-down plan.

Closing the practice: title doesn't answer who's on the hook

A practice-closure plan makes ownership of the records almost beside the point next to a more urgent question: who is now responsible for keeping them secure and producing them on request. That responsibility is what the custodian arrangement exists to answer, and it is a separate written designation from whatever the practice's title to the record happens to be. A clinician can retain nominal ownership of the record while handing custodial responsibility to a covering colleague or a records-storage vendor for the remainder of the records-retention period.

What is a records custodian, in practice, is the more useful question to have answered before closure than who owns the record — because custody, not title, is what determines whether a patient's access request six years from now actually gets a response.

Destruction closes the ownership question, not just the file

Once the retention period a record is subject to has run — commonly framed as several years after the last date of service for adults, longer for records of minors, always deferring to whatever the clinician's state sets as the floor 5Ref 5American Psychological Association (2007).Record Keeping Guidelines.The retention-period norm that determines when destruction, and with it the ownership question, is appropriate. — destruction is the point where the ownership question genuinely ends: there is no record left for anyone to hold title to. Getting there responsibly means keeping destruction logs, so the practice can show what was destroyed, when, and by what method, rather than relying on memory if a request or an audit arrives afterward.

If destruction runs through a third-party document-disposal vendor rather than the clinician directly, remember that a vendor outside HIPAA's covered-entity definition may still fall under the FTC's Health Breach Notification Rule for any health data it handles in the process, which is a separate compliance question from anything about who legally owned the record before it was shredded 6Ref 6Federal Trade Commission (2026).Health Breach Notification Rule.That a non-covered-entity destruction vendor may still fall under FTC breach-notification obligations for health data it handles..

Common questions

No. HIPAA defines what a covered entity must do with a record — retain, secure, and produce it on request — but never addresses who holds legal title. That question is left entirely to state law, and states differ in how, or whether, they answer it directly. Treat any claim that HIPAA settles ownership as incorrect.

No. Ownership and access are separate rights. Regardless of who holds title under state law, HIPAA still requires the covered entity to let the patient inspect or obtain a copy within the federal timeline, with only the psychotherapy-notes carve-out excluded. State-law ownership never overrides the federal access right.

Typically the practice entity retains the records as a business asset, since the employment relationship — not the individual clinician — usually holds title under most arrangements. The departing clinician's professional obligations to those patients continue regardless, which is why the specifics belong in the employment or practice agreement, not assumed.

The deceased patient's personal representative, usually the estate's executor or administrator, has the same access rights the patient held in life. State law determines exactly who qualifies as that representative, so the ownership question matters less here than verifying the requester actually holds that legal status before releasing anything.

Generally yes, records are treated as a business asset that transfers with a sale, but the buyer inherits the same retention and access obligations the seller carried rather than a clean slate. A written agreement specifying who is now the records custodian protects both the seller and the patients whose charts changed hands.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Office of the Federal Register (2026). 45 CFR Part 164 — Security and Privacy. eCFR. link ✓That HIPAA's Privacy and Security Rule defines covered-entity duties over the record but is silent on who holds title to it.
2.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkThe 30-day access timeline, extension, cost-based fee, and psychotherapy-notes exclusion that apply regardless of who owns the record.
3.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkThat minimum-necessary and use-and-disclosure limits continue to bind whoever holds the record after a practice transition.
4.HHS Office for Civil Rights (2026). Personal Representatives. U.S. Department of Health and Human Services. linkThat a deceased patient's personal representative, defined by state law, stands in the patient's shoes for access purposes.
5.American Psychological Association (2007). Record Keeping Guidelines. American Psychological Association. link ✓The retention-period norm that determines when destruction, and with it the ownership question, is appropriate.
6.Federal Trade Commission (2026). Health Breach Notification Rule. Federal Trade Commission (FTC). link ✓That a non-covered-entity destruction vendor may still fall under FTC breach-notification obligations for health data it handles.

https://www.gale.care/for-providers/rr-records-ownership · 6 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers