Who Owns Patient Records? Ownership, Access and Sale

Who owns medical records?

The health care provider or practice that creates and keeps a medical record generally owns the record itself, while the patient owns rights in it: to see it, to get a copy and to have it sent to another doctor. Under HIPAA "an individual has a right of access to inspect and obtain a copy of protected health information about the individual", for "a reasonable, cost-based fee" (45 CFR 164.524).

This page is general information, not legal or medical advice; state law varies, so confirm each rule with your counsel, your malpractice carrier or your state board.

Who has ownership of a patient's medical records, state by state?

Most states do not say who owns the record in so many words; their rules assign duties to the provider. These do speak to ownership:

New Hampshire's statute reaches records "in the possession of any third-party vendor with whom a health care provider contracts to store, handle, and issue copies of such medical records" (RSA 332-I:1). A New Hampshire practice should have counsel review any plan to use records beyond patient care, de-identified or not.

Who owns dental x-rays?

In Texas the dentist does: "Dental records are the sole property of the dentist who performs the dental service", and patients receive copies (22 TAC 108.8). Other dental boards make the dentist keep the originals, which comes to the same in practice: Massachusetts requires the licensee to keep "original radiographs (x-rays)" for seven years (234 CMR 5.13), and New Jersey keeps records "including all radiographs" for seven years (N.J.A.C. 13:30-8.7). A patient is entitled to copies, not the originals.

Who keeps the records when a physician leaves a group?

Your employment or shareholder agreement decides who keeps the charts and what access a departing physician keeps to answer a claim, so read it before you give notice. The patient decides where care continues: the AMA's ethics code says physicians should make records available "to the succeeding physician or other authorized person when the physician discontinues their practice (whether through departure, sale of the practice, retirement, or death)" and "Never refuse to transfer the record on request by the patient" (AMA Opinion 3.3.1).

Some boards also require notice. New Hampshire requires a physician who stops treating a group of patients to notify them and ensure records can be transferred, "at least 30 days prior to cessation of treatment" whenever possible (N.H. Med 501.02).

Who owns the records when a practice is sold or closes?

In a sale, the records commonly pass to the buyer with the practice. HIPAA does not treat that as a sale of patient data: the definition excludes disclosures "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence" (45 CFR 164.502). The purchase terms are covered in practice valuation and records in a sale. Arizona adds that a provider who "retires or sells" must make sure the records are still retained (A.R.S. 12-2297).

When a practice closes, the owner, the estate or a custodian keeps them. Maryland lists "another health care provider, the administrator of the physician's estate, or a designee who has agreed to maintain the records" (Maryland Board of Physicians). Georgia's dental board adds that records should never go "to an unlicensed party" (Georgia Board of Dentistry). The custodian guide covers the handoff.

Who owns Epic electronic medical records?

Epic owns its software, not your patients' records. Epic, the EHR company, describes "maintaining employee ownership", and its founder's trusts are set up to vote against Epic going public or being acquired; its founder's trust is set to hold "more than 70% of all Class A voting stock of Epic" (Epic). The records in an Epic system, or any EHR, are the provider's records, and what the vendor may do with them is set by your contract.

Those contracts matter. The federal health IT office (ONC) warns that "Many standard form EHR contracts grant vendors very broad rights to use and commercialize data captured in or created by an EHR", and that a vendor "may claim the right to de-identify and sell your patients" information (ONC, EHR Contracts Untangled). ONC offers example language making the customer "the sole and exclusive owner of all PHI", while noting it "is not a legal pronouncement about any claim of ownership your patients may have under law" (ONC).

Epic's own research dataset shows how pooled EHR data is used. Epic says its Curiosity models were "trained on deidentified records from more than 300 million patients in Cosmos" (Epic), a dataset that exists because "a community of health systems using Epic software agreeing to collaborate", and "Access to Cosmos and Cosmos data cannot be purchased." (Epic Cosmos).

Can a practice sell or license patient records?

Not identifiable ones without each patient's authorization. HIPAA says "a covered entity or business associate may not sell protected health information", where a sale is a disclosure for which the practice "directly or indirectly receives remuneration from or on behalf of the recipient" (45 CFR 164.502), and "a covered entity must obtain an authorization for any disclosure of protected health information which is a sale" (45 CFR 164.508).

• De-identified means information with "no reasonable basis to believe that the information can be used to identify an individual", reached by removing listed identifiers or by an expert's determination (45 CFR 164.514).
• Professional ethics go further than HIPAA. The AMA says "Disclosing information to third parties for commercial purposes without consent undermines trust", and that physicians who allow such access should "Only provide data that has been de-identified" and "Fully inform each patient whose record would be involved" (AMA Opinion 3.2.4).
• State law can add limits, as New Hampshire's patient-property statute shows, and so can your EHR and payer contracts.

What ownership means for a practice considering a data licence

Before any conversation about licensing, a practice should be able to answer four questions:

• Does our EHR contract give the vendor rights to de-identified data, or an exclusive licence, that would conflict with a licence of our own?
• Does our state treat any part of the record as the patient's property, or add consent rules for research use?
• Who will de-identify the records, by which HIPAA method, under a business associate agreement?
• If we are selling or closing, does the purchase or custodian agreement keep our right to make a de-identified copy?

De-identified patient records do get licensed. Tempus AI reported in its SEC filing for the quarter ended 30 September 2026 that a licensee will pay data license fees of $100 per delivered record, up to $50 million, for 500,000 de-identified records of patients with Alzheimer's disease or other specified neurological conditions (Tempus 10-Q). That deal is between large companies, not a single practice.

Most small practices will not qualify on volume alone. The one priced deal above covers 500,000 records, far more than a solo office holds, and Origin has found no published sale by a single small practice. A specialty, a long history or imaging linked to signed reports can still make a set worth a look (what makes patient records licensable), which is why a check before records go to storage is worth a few minutes.

The buyer side is covered in licensing patient records and licensing medical imaging data; the contract terms in what a data licensing agreement should include.

Next step

For how long the owner must keep each record, see how long to keep patient records.

Does your company hold records like these? See what your data is worth.