Who Owns Medical Records: Patient or Hospital?

Key Takeaways

• A patient does not ordinarily become the owner of the hospital’s original case file merely because the records concern that patient. Hospitals and doctors generally retain custody of the original clinical records created and maintained during treatment.
• Patients have a recognised right to access their medical information and obtain copies of medical records. Regulation 1.3.2 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 requires requested records to be issued within 72 hours.
• A hospital cannot ordinarily refuse records merely because the patient may use them in a medical negligence case. The Kerala High Court has specifically rejected this justification.
• The distinction between ownership, custody and access is important. Hospitals may preserve the original record, while patients have rights relating to access, confidentiality and use of the health information contained in it.
• The patient can normally receive copies of the complete relevant case records, not merely a short discharge summary. This can include diagnosis, investigation reports, treatment details and other documents forming part of the case sheet.
• Medical information remains confidential even though the hospital holds the records. Possession of medical records does not give a hospital unrestricted freedom to disclose sensitive health information.
• Digital health systems increasingly place control over health information with the individual. Under the Ayushman Bharat Digital Mission framework, health records remain stored with healthcare providers while consent plays a central role in linking and sharing them.

What Are Medical Records?

Medical records are documents containing information about a patient’s health, diagnosis, investigations, treatment and medical care. They may exist in physical or electronic form and are generally created by doctors, hospitals, laboratories and other healthcare providers during the course of treatment.

Medical records may include:

Add LawBhoomi as your preferred source on Google.

Add Now →

• registration and admission details;
• case sheets and clinical notes;
• diagnosis and provisional diagnosis;
• prescriptions and medication charts;
• laboratory and diagnostic reports;
• X-rays, scans and other investigation reports;
• operation notes;
• consent forms;
• nursing records;
• treatment and progress notes;
• discharge summaries; and
• referrals and specialist opinions.

Medical records serve several purposes. They help doctors provide continuity of care, enable patients to understand their treatment, assist in obtaining a second medical opinion and may become important evidence when a dispute concerning medical negligence or treatment arises.

This makes the question of who owns medical records particularly important.

Who Owns Medical Records in India?

There is no simple rule under Indian law stating that every medical record belongs exclusively either to the patient or to the hospital.

The legally more accurate position is that the hospital or medical practitioner generally retains custody of the original medical records, while the patient has a recognised right to access the information and obtain copies of records relating to treatment.

Learn at your own pace with LawBhoomi's recorded law courses.

View Recorded Courses →

This distinction was recognised by the Kerala High Court in Rajappan v Sree Chitra Tirunal Institute for Medical Sciences and Technology. The Court directed the hospital to provide photocopies of the complete medical records while recognising that the hospital could retain the originals for its own purposes.

Therefore, asking who “owns” medical records may sometimes create confusion. Three separate concepts have to be understood:

Custody of the Original Record

The hospital or doctor generally maintains and preserves the original clinical record created during treatment.

Right to Access the Information

The patient has the right to obtain medical records concerning the treatment received, subject to the applicable legal and regulatory framework.

Confidentiality and Control of Health Information

Medical information relates directly to the patient and is protected by duties of confidentiality and privacy. A hospital’s custody of records does not create an unrestricted right to disclose that information.

Does the Hospital Own the Original Medical Records?

Hospitals generally retain the original case sheets and clinical records created during the treatment of patients.

This is necessary because healthcare institutions are required to maintain treatment records for professional, regulatory, administrative and legal purposes.

Regulation 1.3.1 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 provides that every physician shall maintain medical records concerning indoor patients for a period of three years from the commencement of treatment.

Join live law courses and learn directly from legal professionals.

View Live Courses →

The same regulatory framework requires medical records to be provided when requested by the patient, authorised attendant or legal authorities.

Therefore, retention of original records by the hospital does not mean that the patient has no rights over the information contained in those documents.

Does a Patient Have a Right to Medical Records?

Yes. A patient has a recognised right to obtain medical records relating to treatment.

Regulation 1.3.2 of the 2002 Medical Ethics Regulations provides that where medical records are requested by a patient, authorised attendant or legal authority, the request should be duly acknowledged and the documents should be issued within 72 hours.

The Charter of Patients’ Rights and Responsibilities approved by the National Council for Clinical Establishments also recognises the right of a patient or representative to access copies of:

• case papers;
• patient records;
• investigation reports; and
• detailed itemised bills.

It also recognises the right to seek a second medical opinion with the necessary records and information being provided by the treating hospital.

The right of access is therefore an important part of patient autonomy and transparency in healthcare.

What Is the 72-Hour Rule for Medical Records?

The 72-hour rule comes from Regulation 1.3.2 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002.

Where a valid request for medical records is received from a patient, authorised attendant or legal authority, the records are required to be issued within 72 hours.

Join live law courses and learn directly from legal professionals.

View Live Courses →

Failure to comply can also have professional consequences. Regulation 7.2 treats failure to maintain indoor-patient medical records for the prescribed period and refusal to provide those records within 72 hours as professional misconduct.

An important regulatory development must also be noted. The National Medical Commission issued new Registered Medical Practitioner (Professional Conduct) Regulations in August 2023. However, those regulations were subsequently kept in abeyance through a notification dated 23 August 2023. The NMC continues to list the 2002 Code of Medical Ethics on its regulatory framework.

Can a Patient Demand the Original Medical Records?

A patient can demand access to medical records and copies of relevant documents, but that does not ordinarily mean that the hospital must surrender its original case file permanently.

This issue was directly addressed in Rajappan v Sree Chitra Tirunal Institute for Medical Sciences and Technology.

The Kerala High Court held that the patient or representative was entitled to photocopies of the entire medical record. At the same time, it recognised that the hospital was entitled to retain the original documents.

Therefore, the usual legal position may be stated simply:

The hospital retains the original record, while the patient is entitled to obtain copies of the relevant medical records.

This arrangement protects both sides. The hospital can fulfil its record-keeping obligations, while the patient retains meaningful access to information concerning diagnosis and treatment.

Is a Discharge Summary Enough?

Not always.

A discharge summary provides an overview of the patient’s condition, treatment and advice at the time of discharge. However, it does not necessarily contain every detail recorded during the period of hospitalisation.

The Kerala High Court considered this issue in Rajappan. The hospital argued that providing a summary containing relevant treatment information was sufficient.

The Court rejected this narrow approach and interpreted the applicable regulations as recognising a patient’s right to receive copies of the complete case records relevant to diagnosis and treatment. It noted that the case sheet shows the progression of investigation, diagnosis and treatment during hospitalisation.

Accordingly, depending on the circumstances, records may extend beyond the discharge summary and include case sheets, investigation reports and treatment-related documents.

Can a Hospital Refuse Medical Records Because a Case May Be Filed?

A hospital cannot ordinarily refuse to provide medical records merely because the documents could later be relied upon in legal proceedings.

This argument was expressly considered in Rajappan. The hospital expressed concern that the records might be used as evidence against the hospital and its doctors.

The Kerala High Court did not accept that apprehension as a valid basis for withholding medical records. The Court emphasised transparency in medical treatment and held that patients or their representatives are entitled to know the treatment that was provided.

This principle is particularly important in cases involving suspected medical negligence.

Medical records may help establish:

• what symptoms were reported;
• what investigations were ordered;
• when a diagnosis was made;
• what medicines were prescribed;
• whether consent was obtained;
• what surgical procedure was performed;
• whether complications occurred;
• what action was taken after complications; and
• whether accepted standards of medical care were followed.

Refusal to provide records can therefore seriously interfere with the ability to obtain an independent medical opinion or pursue a legitimate legal remedy.

Who Can Request Medical Records?

Regulation 1.3.2 expressly refers to requests from:

• the patient;
• an authorised attendant; or
• legal authorities involved.

Where someone other than the patient requests the records, hospitals may legitimately require proof showing that the person is authorised to receive them.

This becomes particularly important because medical information is confidential.

Where the patient has died, questions regarding access by family members or legal representatives may depend on the relationship of the applicant, the purpose for which records are sought and the circumstances of the case.

In Rajappan, for example, the proceedings concerned a father’s request for the medical records relating to the treatment of his deceased daughter. The Kerala High Court directed the hospital to provide copies of the complete records.

Are Medical Records Confidential?

Yes. Medical records contain highly personal health information and are subject to confidentiality and privacy protections.

The fact that a hospital possesses a case file does not mean that the information can be freely disclosed to employers, insurers, relatives, commercial entities or other third parties.

Confidentiality forms an important part of the doctor-patient relationship. The Patient Rights Charter also recognises the patient’s right to confidentiality, human dignity and privacy during treatment.

Therefore, two legal principles operate simultaneously:

First, healthcare providers must preserve and maintain medical records.

Second, they must protect the confidentiality of the personal medical information contained in those records.

Disclosure may nevertheless be permitted or required in certain legally recognised circumstances, such as where disclosure is required by law or directed by a competent authority.

What About Electronic Health Records?

The same distinction between storage and patient control becomes even clearer in digital healthcare.

Under the Ayushman Bharat Digital Mission, healthcare providers continue to create and store health records at the place where those records originate. ABDM provides an interoperable system through which health information can be linked and exchanged rather than operating as one central repository containing every medical record.

The ABDM framework places significant emphasis on consent.

According to the National Health Authority, health records should be linked to the individual’s health account with consent for the relevant purpose. The Personal Health Record framework also enables individuals to view health records and manage consent relating to their health information.

This reflects an important modern principle: although healthcare institutions may store the record, the individual’s ability to control access to personal health information remains central.

Why Is the Difference Between Ownership and Custody Important?

The distinction becomes important whenever there is disagreement between a hospital and a patient.

If hospital custody were treated as absolute ownership, it could wrongly suggest that the patient has no right to see treatment records.

On the other hand, saying that the patient owns every original hospital document could incorrectly suggest that hospitals have no right or obligation to retain their own clinical records.

The more accurate position recognises both interests.

Hospitals Need Records for Continuity of Care

Medical records allow doctors to understand previous diagnoses, medications, investigations and treatment decisions.

Hospitals Have Record-Keeping Obligations

Professional regulations require certain records to be maintained for prescribed periods.

Patients Need Access to Their Own Treatment Information

Patients may require records for future treatment, insurance claims, second opinions or legal proceedings.

Medical Information Requires Confidentiality

Hospital possession of records does not eliminate the privacy rights connected with personal health information.

What Can Be Done if a Hospital Refuses to Give Medical Records?

If a hospital refuses a legitimate request for medical records, the first practical step is generally to submit a written request identifying the records required and preserve proof that the request was received.

Depending on the circumstances, further remedies may include:

• approaching the hospital’s grievance redressal authority;
• complaining to the appropriate medical regulatory authority where professional misconduct by a registered medical practitioner is involved;
• approaching authorities regulating the clinical establishment, where applicable;
• seeking appropriate relief before a consumer forum where the dispute forms part of a deficiency in healthcare services; or
• approaching a competent court where judicial intervention is necessary.

The exact remedy depends on factors such as the type of hospital, applicable State law, nature of treatment, reason for refusal and purpose for which the records are required.

The Consumer Protection Act, 2019 may also become relevant where the facts support a consumer dispute concerning medical services.

Who Ultimately Owns Medical Records: Patient or Hospital?

The most accurate answer is that Indian medical law does not treat the issue as a simple choice between exclusive patient ownership and exclusive hospital ownership.

The hospital or healthcare provider generally retains custody of the original clinical record and has professional responsibilities to preserve it.

At the same time, the patient has a substantial right to access medical information and obtain copies of treatment records. A hospital cannot ordinarily treat medical records as its private property and deny access merely because it possesses the originals.

The Kerala High Court’s decision in Rajappan v Sree Chitra Tirunal Institute for Medical Sciences and Technology captures this distinction particularly well: the hospital may retain the original records, but copies of the complete relevant records must be made available to the patient or entitled representative.

Conclusion

Medical records in India involve more than a question of physical ownership. Hospitals and medical practitioners generally remain custodians of the original records they create and maintain, while patients have legally recognised rights relating to access, confidentiality and use of their medical information.

The Medical Ethics Regulations require requested medical records to be issued within 72 hours, and withholding records without a valid legal basis may amount to professional misconduct. The Patient Rights Charter similarly recognises access to case papers, patient records and investigation reports.

Digital healthcare is strengthening this patient-centric approach further. Under ABDM, healthcare providers continue to store medical records, but consent and individual control play an important role in the sharing of health information.

Therefore, the clearest answer to the question “Who owns medical records: patient or hospital?” is that the hospital ordinarily retains the original record as custodian, while the patient has a strong right to access and obtain copies of the medical information concerning their treatment.