Health Record Rights Index · country brief · this country's data as of October 1, 2026

Who holds the health record in Sri Lanka?

In 2026, Sri Lanka scores 32 out of 100 for how much say a person has over their own health record. It is tied for 151st of 198 countries and territories, and could rank anywhere from 116th to 174th allowing for scoring error, in the Weak band (25 to 44). Who holds the keys: doctors, hospitals and insurers. Source: Health Record Rights Index, SuperTruth, this country's data as of October 1, 2026.

Doctors, hospitals and insurers decide. No right is above the typical country. The closest is rules for AI in your care (30 out of 100, against 30 for the typical country). The furthest behind is getting your full record (30 out of 100, against 40 to 45 for the typical country).

Sri Lanka has a data protection law and regulator, but core duties start in 2027 and the national health record is still a plan.

Published · updated · this country's data as of October 1, 2026 · research tool, not legal advice

overall score · Weak band, 25 to 44
32/100
rank among 198 countries and territories; likely 116th to 174th, allowing for scoring error
Tied for 151st
confidence in our evidence
Low
strength of our evidence (DTI™)
86/100 (Gold)

Low confidence. Thin evidence on 4 of the 8 rights: your copy, sale and ads, doctors see it and research. The evidence grade rates all our sources together; confidence looks at each right. Neither changes the score.

Questions people ask

Can I see my health record in Sri Lanka?

In 2026, getting your full record scores 30 out of 100 in Sri Lanka; the typical country scores 40 to 45. The Medical Council says patients may see and copy their records, but this rests on professional rules. The general data access right in the PDPA (Part II) is still not in force, and there is no national patient portal. Source: Sri Lanka Medical Council, and the other sources below.

Who controls health records in Sri Lanka?

In 2026, doctors, hospitals and insurers hold the keys to your health record in Sri Lanka. Control over who sees it scores 25 out of 100 in Sri Lanka; the typical country scores 30. Patients have no working consent controls or access log for shared records today. The 2023 Digital Health Blueprint plans consent, opt-out directives and audit trails, but the national record behind them is still only proposed. Source: Ministry of Health, November 1, 2023, and the other sources below.

How does Sri Lanka compare?

In 2026, Sri Lanka scores 32 out of 100, against 39 for the typical country. This brief compares it with Tajikistan (32 out of 100), Nepal (31 out of 100) and Laos (29 out of 100). Source: the ranking of all 198 countries and territories.

Eight rights, compared with Tajikistan, Nepal, Laos and the typical country

Scores out of 100, by right
Getting your full record20%3040 · 28 · 25
Control over who sees it20%2528 · 30 · 28
Privacy and security15%3530 · 35 · 35
One record across your care15%3530 · 28 · 26
Protection from sale and ads10%3535 · 38 · 35
Doctors see it when treating you10%3025 · 25 · 20
Your say over research use5%4346 · 50 · 45
Rules for AI in your care5%3028 · 25 · 35

Black dot: Sri Lanka. Hollow dots: Tajikistan, Nepal, Laos (scores out of 100 on the right, same order). Gray line: the typical country of all 198. Overall: Sri Lanka 32 out of 100. Scores move in steps of about 5 points, so read a rank with its likely range.

What would Sri Lanka need to change to score higher?

Sri Lanka sits in Weak (25 to 44); Mixed starts at 45. Its two weakest rights, compared with the typical country and weighted by how much each counts, are getting your full record (30 out of 100, against 40 to 45 for the typical country) and privacy and security (35 out of 100, against 45 for the typical country). Our scoring rules give more points for:

  • Getting your full record: A national portal that shows most people at least part of their record (a summary, prescriptions, lab results) puts this right at 60 to 75 out of 100. A near-full record that you can download, with a long history and used by most people, puts it at 76 to 90.
  • Privacy and security: A health data regulator that is independent and actually acts: it decides cases about health records, breaches must be reported, and fines are applied.

Which laws give health record rights in Sri Lanka?

  • Personal Data Protection Act, No. 9 of 2022: Health is a special category; sets rights, Authority and penalties. Core parts in force 1 January 2027.
  • Personal Data Protection (Amendment) Act, No. 22 of 2025: Removed fixed start dates; minister sets operative dates by gazette.
  • National Medicines Regulatory Authority Act, No. 5 of 2015: Regulates medical devices including software, and clinical trials with recognised ethics committees.

Doctors, waits and private care context, not part of the score

Doctors per 10,000
11.4 2023
Nurses and midwives per 10,000
22.6 2023
Private insurance + out-of-pocket
56.8% 2023
Record reaches private care?
unknown

Real cases

  • August 13, 2025 · ReadMe Nearly 400,000 records from a national health website offered for sale online
  • November 29, 2024 · ReadMe Doctor booking website let anyone look up patient details by name

Compare Sri Lanka

Cite this brief

In 2026, Sri Lanka scored 32 out of 100 for how much say a person has over their own health record, tied for 151st of 198 countries and territories (could be 116th to 174th), in the Weak band. Who holds the keys: doctors, hospitals and insurers. Source: Health Record Rights Index, SuperTruth, this country's data as of October 1, 2026, https://healthrecordrights.com/brief/sri-lanka/

The 15 sources for Sri Lanka

Each source appears once, under the first right it supports. Titles are shown as our research agents recorded them, usually in the page's own language; text in square brackets is our machine translation. Links were checked on the date shown.

Getting your full record (4 sources)

  1. “Patient Rights”

    Sri Lanka Medical Council (regulator) · Title in English

    No date recorded · Link checked October 2, 2026 (opened)

    Used for: Getting your full record

    https://slmc.gov.lk/en/services/public/patient-rights

  2. “Legal experts flag unique compliance landscape in staggered PDPA rollout”

    Daily Mirror (news) · Title in English

    Dated July 27, 2026 · Link checked October 2, 2026 (opened)

    Used for: Getting your full record; Privacy and security; Protection from sale and ads

    https://www.dailymirror.lk/breaking-news/Legal-experts-flag-unique-compliance-landscape-in-staggered-PDPA-rollout/108-346685

  3. “Aspects of patient rights in a developing country: a qualitative study”

    BMC Medical Ethics (other) · Title in English

    Dated May 28, 2025 · Link checked October 2, 2026 (opened)

    Used for: Getting your full record

    https://pmc.ncbi.nlm.nih.gov/articles/PMC12121050/

  4. “President calls for internationally recognised healthcare standards”

    Ada Derana (news) · Title in English

    Dated July 9, 2026 · Link checked October 2, 2026 (opened)

    Used for: Getting your full record; Control over who sees it

    https://adaderana.lk/news/cmrd4n38j000k356p1ngjlibv

Control over who sees it (2 sources)

  1. “Sri Lanka Digital Health Blueprint”

    Ministry of Health (government guidance) · Title in English

    Dated November 1, 2023 · Link checked October 2, 2026 (opened)

    Used for: Control over who sees it; One record across your care; Doctors see it when treating you; Your say over research use

    https://www.health.gov.lk/wp-content/uploads/2023/11/Digital-Health-Blue-Print-Full-Book-01.11.2023-Final.pdf

  2. “Personal Data Protection Act, No. 9 of 2022”

    Parliament of Sri Lanka (law or regulation) · Title in English

    Dated March 19, 2022 · Link checked October 2, 2026 (opened)

    Used for: Control over who sees it; Privacy and security; Protection from sale and ads; Your say over research use

    https://www.parliament.lk/uploads/acts/gbills/english/6242.pdf

Privacy and security (2 sources)

  1. “Data protection laws in Sri Lanka”

    DLA Piper (other) · Title in English

    No date recorded · Link checked October 2, 2026 (opened)

    Used for: Privacy and security; Protection from sale and ads

    https://www.dlapiperdataprotection.com/index.html?t=law&c=LK

  2. “Data Protection Authority of Sri Lanka”

    dpa.gov.lk (regulator) · Title in English

    No date recorded · Link checked October 2, 2026 (opened)

    Used for: Privacy and security

    https://www.dpa.gov.lk/

One record across your care (3 sources)

  1. “Hospital Health Information Management System (HHIMS)”

    ICTA (government guidance) · Title in English

    Dated September 30, 2025 · Link checked October 3, 2026 (opened)

    Used for: One record across your care; Doctors see it when treating you

    https://www.icta.lk/projects/digital-government/hospital-health-information-management-system-hhims

  2. “Health Ministry to launch Cluster Health Information System tomorrow”

    Daily Mirror (news) · Title in English

    Dated June 4, 2025 · Link checked October 2, 2026 (opened)

    Used for: One record across your care; Doctors see it when treating you

    https://www.dailymirror.lk/breaking-news/Health-Ministry-to-launch-Cluster-Health-Information-System-tomorrow/108-310651

  3. “Concerns raised over Rs. 3 billion HIQI digital health procurements”

    Daily Mirror (news) · Title in English

    Dated May 14, 2026 · Link checked October 2, 2026 (opened)

    Used for: One record across your care

    https://www.dailymirror.lk/breaking-news/Concerns-raised-over-Rs-3-billion-HIQI-digital-health-procurements/108-340259

Your say over research use (1 source)

  1. “Clinical trials”

    National Medicines Regulatory Authority (regulator) · Title in English

    No date recorded · Link checked October 2, 2026 (opened)

    Used for: Your say over research use

    https://www.nmra.gov.lk/pages/clinical-trials

Rules for AI in your care (3 sources)

  1. “Medical devices”

    National Medicines Regulatory Authority (regulator) · Title in English

    No date recorded · Link checked October 2, 2026 (opened)

    Used for: Rules for AI in your care

    https://www.nmra.gov.lk/pages/medical-devices

  2. “Artificial Intelligence (AI) governance is a concern Sri Lanka must address now”

    LIRNEasia (other) · Title in English

    Dated January 2, 2026 · Link checked October 2, 2026 (opened)

    Used for: Rules for AI in your care

    https://lirneasia.net/2026/01/artificial-intelligence-ai-governance-is-a-concern-sri-lanka-must-address-now/

  3. “Push for AI-integrated health records sparks debate”

    The Morning (news) · Title in English

    Dated March 8, 2026 · Link checked October 2, 2026 (opened)

    Used for: Rules for AI in your care

    https://www.themorning.lk/articles/hRB94HjdAVDrWSLR337z

Something wrong on this page? Tell us.

Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI · Follow changes

SuperTruth Inc. · 24 S. 24th St., Philadelphia, PA 19103, USA · +1 215 918 4140 · supertruth.ai
Something wrong? Tell us · Questions or a briefing: supertruth.ai/on-the-record#contact · Full index: healthrecordrights.com
OECD: Organisation for Economic Co-operation and Development (38 mostly high-income countries). DTI™: the Data Trust Index, which grades the evidence behind each score. SuperTruth makes it and publishes this index. Everything here comes from public information: laws, government and regulator pages, court decisions, published news, WHO, OECD and World Bank data. Full sources: https://healthrecordrights.com/brief/sri-lanka/#sources. SuperTruth built this index and sells health data verification products; no one paid to be included. Research tool, not legal advice. Our scores and our own words are CC BY 4.0; quoted law and source titles stay with their owners.