Health Record Rights Index · country brief · this country's data as of October 2, 2026

Who holds the health record in the United States?

In 2026, the United States scores 48 out of 100 for how much say a person has over their own health record. It is tied for 55th of 198 countries and territories, and could rank anywhere from 45th to 80th allowing for scoring error, in the Mixed band (45 to 64). Who holds the keys: doctors, hospitals and insurers. Source: Health Record Rights Index, SuperTruth, this country's data as of October 2, 2026.

Doctors, hospitals and insurers decide. Its strongest right, compared with the typical country, is rules for AI in your care (56 out of 100, against 30 for the typical country). The furthest behind is protection from sale and ads (38 out of 100, against 45 for the typical country).

The United States in depth: US law in plain English, the enforcement record and how fair this score is

What each US state adds to HIPAA: the 50 states and Washington, DC, question by question

Americans have an enforced legal right to copies of their records, but providers and insurers decide most sharing, and health apps sit outside HIPAA.

Published · updated · this country's data as of October 2, 2026 · research tool, not legal advice

overall score · Mixed band, 45 to 64
48/100
rank among 198 countries and territories; likely 45th to 80th, allowing for scoring error
Tied for 55th
confidence in our evidence
High
strength of our evidence (DTI™)
92/100 (Platinum)

Questions people ask

Can I see my health record in the United States?

In 2026, getting your full record scores 50 out of 100 in the United States; the typical country scores 40 to 45. HIPAA gives a right to copies within 30 days, and the Cures Act penalizes providers and health IT firms that block a patient's electronic access without a listed exception. OCR has brought 55 access cases, but there is no national record, and 59% of people juggle several portals. Source: eCFR, and the other sources below.

Who controls health records in the United States?

In 2026, doctors, hospitals and insurers hold the keys to your health record in the United States. Control over who sees it scores 35 out of 100 in the United States; the typical country scores 30. HIPAA lets providers and plans share records for treatment, payment and operations without consent, and they may refuse restriction requests. Source: eCFR, and the other sources below.

How does the United States compare?

In 2026, the United States scores 48 out of 100, against 39 for the typical country. This brief compares it with Canada (52 out of 100), United Kingdom (59 out of 100) and Germany (63 out of 100). Source: the ranking of all 198 countries and territories.

Eight rights, compared with Canada, United Kingdom, Germany and the typical country

Scores out of 100, by right
Getting your full record20%5050 · 66 · 64
Control over who sees it20%3555 · 52 · 66
Privacy and security15%5058 · 56 · 58
One record across your care15%6050 · 62 · 66
Protection from sale and ads10%3845 · 60 · 70
Doctors see it when treating you10%5555 · 60 · 62
Your say over research use5%4949 · 64 · 50
Rules for AI in your care5%5656 · 55 · 50

Black dot: United States. Hollow dots: Canada, United Kingdom, Germany (scores out of 100 on the right, same order). Gray line: the typical country of all 198. Overall: United States 48 out of 100. Scores move in steps of about 5 points, so read a rank with its likely range.

What would the United States need to change to score higher?

The United States sits in Mixed (45 to 64); Strong starts at 65. Its weakest right, compared with the typical country, is protection from sale and ads (38 out of 100, against 45 for the typical country). Every other right is at or above the typical country; the one with the most room to grow, weighted, is control over who sees it (35 out of 100, against 30 for the typical country). Our scoring rules give more points for:

  • Protection from sale and ads: Clear limits on selling health data or using it for ads, covering apps and data brokers as well as doctors and hospitals.
  • Control over who sees it: A way to say no to sharing (or to be asked first), a log you can read of who opened your record, and finer choices about who sees what. Together these put this right at 60 to 80 out of 100.

Which laws give health record rights in the United States?

  • HIPAA Privacy Rule, right of access (45 CFR 164.524) (2000): Right to the designated record set within 30 days, cost-based fee, electronic format if readily producible.
  • 42 CFR Part 2, substance use disorder records final rule (2024): Single revocable consent for future treatment, payment and operations uses; compliance from February 16, 2026.
  • FTC Health Breach Notification Rule (2024 update): Breach notice duties for health apps and similar technologies not covered by HIPAA.

Doctors, waits and private care context, not part of the score

Doctors per 10,000
26.5 2022 · 35th highest of 38 OECD countries
Nurses and midwives per 10,000
124 2024 · 11th highest of 38 OECD countries
Private insurance + out-of-pocket
11.7% 2023 · 35th highest of 35 OECD countries
Record reaches private care?
unknown

Compulsory private insurance, counted separately: 31.6% of health spending (2023).

Real cases

  • December 16, 2025 · U.S. Department of Health and Human Services, Office for Civil Rights Six requests and more than a year before a patient got his records
  • September 30, 2025 · U.S. Department of Health and Human Services, Office for Civil Rights Care provider posted patient stories online without written permission

Compare the United States

Cite this brief

In 2026, the United States scored 48 out of 100 for how much say a person has over their own health record, tied for 55th of 198 countries and territories (could be 45th to 80th), in the Mixed band. Who holds the keys: doctors, hospitals and insurers. Source: Health Record Rights Index, SuperTruth, this country's data as of October 2, 2026, https://healthrecordrights.com/brief/united-states/

The 32 sources for the United States

Each source appears once, under the first right it supports. Titles are shown as our research agents recorded them, usually in the page's own language; text in square brackets is our machine translation. Links were checked on the date shown.

Getting your full record (4 sources)

  1. “45 CFR 164.524 Access of individuals to protected health information”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Getting your full record

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524

  2. “45 CFR Part 171 Information Blocking”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Getting your full record

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-171

  3. “HHS OCR settles HIPAA Right of Access investigation with Azul Vision”

    HHS (regulator) · Title in English

    Dated August 27, 2026 · Link checked October 3, 2026 (blocked by the site's bot protection)

    Used for: Getting your full record

    https://www.hhs.gov/press-room/hhs-ocr-settles-hipaa-investigation-with-azul-vision.html

  4. “Individuals' Access and Use of Patient Portals and Smartphone Health Apps, 2024, Data Brief 77”

    ASTP/ONC (government guidance) · Title in English

    Dated July 2025 · Link checked October 3, 2026 (opened)

    Used for: Getting your full record

    https://healthit.gov/data/data-briefs/individuals-access-and-use-patient-portals-and-smartphone-health-apps-2024/

Control over who sees it (4 sources)

  1. “45 CFR 164.506 Uses and disclosures to carry out treatment, payment, or health care operations”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Control over who sees it

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506

  2. “45 CFR 164.522 Rights to request privacy protection”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Control over who sees it

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.522

  3. “45 CFR 164.528 Accounting of disclosures”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Control over who sees it

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.528

  4. “Confidentiality of Substance Use Disorder Patient Records, final rule”

    Federal Register (law or regulation) · Title in English

    Dated February 16, 2024 · Link checked October 3, 2026 (opened)

    Used for: Control over who sees it

    https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-ud-patient-records

Privacy and security (4 sources)

  1. “H1 2026 Healthcare Data Breach Report”

    HIPAA Journal (news) · Title in English

    Dated September 30, 2026 · Link checked October 3, 2026 (opened)

    Used for: Privacy and security

    https://www.hipaajournal.com/h1-2026-healthcare-data-breach-report/

  2. “Unified Agenda: HIPAA Security Rule, RIN 0945-AA22”

    OIRA, reginfo.gov (government guidance) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Privacy and security

    https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22

  3. “HIPAA and Reproductive Health”

    HHS OCR (regulator) · Title in English

    Dated June 27, 2025 · Link checked October 3, 2026 (blocked by the site's bot protection)

    Used for: Privacy and security

    https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/index.html

  4. “Texas SB 1188, enrolled text”

    Texas Legislature (law or regulation) · Title in English

    Dated 2025 · Link checked October 3, 2026 (opened)

    Used for: Privacy and security

    https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm

One record across your care (4 sources)

  1. “HHS expands secure access to health records through TEFCA, one billion records exchanged”

    HHS (government guidance) · Title in English

    Dated June 26, 2026 · Link checked October 3, 2026 (blocked by the site's bot protection)

    Used for: One record across your care

    https://www.hhs.gov/press-room/onc-strengthens-tefca-one-billion-health-records-exchanged.html

  2. “Electronic Health Information Exchange by Hospitals, Quick Stat”

    ASTP/ONC (government guidance) · Title in English

    Dated February 2026 · Link checked October 3, 2026 (opened)

    Used for: One record across your care

    https://healthit.gov/data/quickstats/electronic-health-information-exchange-hospitals/

  3. “Electronic Public Health Reporting Among Non-Federal Acute Care Hospitals, 2024, Data Brief 78”

    ASTP/ONC (government guidance) · Title in English

    Dated July 2025 · Link checked October 3, 2026 (opened)

    Used for: One record across your care

    https://healthit.gov/data/data-briefs/electronic-public-health-reporting-among-non-federal-acute-care-hospitals-2024/

  4. “Advancing Interoperability and Improving Prior Authorization Processes, final rule CMS-0057-F”

    Federal Register (law or regulation) · Title in English

    Dated February 8, 2024 · Link checked October 3, 2026 (opened)

    Used for: One record across your care

    https://www.federalregister.gov/documents/2024/02/08/2024-00895/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-advancing-interoperability

Protection from sale and ads (4 sources)

  1. “45 CFR 164.508 Uses and disclosures for which an authorization is required”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Protection from sale and ads

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508

  2. “Health Breach Notification Rule, final rule”

    Federal Register (law or regulation) · Title in English

    Dated May 30, 2024 · Link checked October 3, 2026 (opened)

    Used for: Protection from sale and ads

    https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule

  3. “FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising”

    FTC (regulator) · Title in English

    Dated February 1, 2023 · Link checked October 3, 2026 (opened)

    Used for: Protection from sale and ads

    https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising

  4. “RCW 19.373.070 Valid authorization to sell consumer health data”

    Washington Legislature (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Protection from sale and ads

    https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070

Doctors see it when treating you (4 sources)

  1. “Interoperable Exchange of Patient Health Information Among U.S. Hospitals: 2023, Data Brief 71”

    ASTP/ONC (government guidance) · Title in English

    Dated May 2024 · Link checked October 3, 2026 (opened)

    Used for: Doctors see it when treating you

    https://healthit.gov/data/data-briefs/interoperable-exchange-patient-health-information-among-us-hospitals-2023/

  2. “HHS Announces Crackdown on Health Data Blocking”

    HHS (government guidance) · Title in English

    Dated September 3, 2025 · Link checked October 3, 2026 (blocked by the site's bot protection)

    Used for: Doctors see it when treating you

    https://www.hhs.gov/press-room/hhs-crackdown-health-data-blocking.html

  3. “Information Blocking; Office of Inspector General's Civil Money Penalty Rules, final rule”

    Federal Register (law or regulation) · Title in English

    Dated July 3, 2023 · Link checked October 3, 2026 (opened)

    Used for: Doctors see it when treating you

    https://www.federalregister.gov/documents/2023/07/03/2023-13851/grants-contracts-and-other-agreements-fraud-and-abuse-information-blocking-office-of-inspector

  4. “Information Blocking Claims: By the Numbers, Quick Stat”

    ASTP/ONC (government guidance) · Title in English

    Dated July 2026 · Link checked October 3, 2026 (opened)

    Used for: Doctors see it when treating you

    https://healthit.gov/data/quickstats/information-blocking-claims-numbers/

Your say over research use (4 sources)

  1. “45 CFR 164.512 Uses and disclosures for which authorization is not required”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Your say over research use

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512

  2. “45 CFR 164.514 De-identification of protected health information”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Your say over research use

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514

  3. “45 CFR 46.116 General requirements for informed consent”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Your say over research use

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46/subpart-A/section-46.116

  4. “Certificates of Confidentiality”

    NIH (government guidance) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Your say over research use

    https://grants.nih.gov/policy-and-compliance/policy-topics/human-subjects/coc

Rules for AI in your care (4 sources)

  1. “Artificial Intelligence-Enabled Medical Devices”

    FDA (regulator) · Title in English

    Dated September 4, 2026 · Link checked October 3, 2026 (opened)

    Used for: Rules for AI in your care

    https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices

  2. “Marketing Submission Recommendations for a Predetermined Change Control Plan for AI-Enabled Device Software Functions”

    FDA (regulator) · Title in English

    Dated August 2025 · Link checked October 3, 2026 (opened)

    Used for: Rules for AI in your care

    https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence

  3. “HTI-5 proposed rule: ASTP/ONC deregulatory actions”

    Federal Register (law or regulation) · Title in English

    Dated December 29, 2025 · Link checked October 3, 2026 (opened)

    Used for: Rules for AI in your care

    https://www.federalregister.gov/documents/2025/12/29/2025-23896/health-data-technology-and-interoperability-astponc-deregulatory-actions-to-unleash-prosperity

  4. “45 CFR 92.210 Nondiscrimination in the use of patient care decision support tools”

    eCFR (law or regulation) · Title in English

    No date recorded · Link checked October 3, 2026 (opened)

    Used for: Rules for AI in your care

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-92/subpart-C/section-92.210

Something wrong on this page? Tell us.

Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI · Follow changes

SuperTruth Inc. · 24 S. 24th St., Philadelphia, PA 19103, USA · +1 215 918 4140 · supertruth.ai
Something wrong? Tell us · Questions or a briefing: supertruth.ai/on-the-record#contact · Full index: healthrecordrights.com
OECD: Organisation for Economic Co-operation and Development (38 mostly high-income countries). DTI™: the Data Trust Index, which grades the evidence behind each score. SuperTruth makes it and publishes this index. Everything here comes from public information: laws, government and regulator pages, court decisions, published news, WHO, OECD and World Bank data. Full sources: https://healthrecordrights.com/brief/united-states/#sources. SuperTruth built this index and sells health data verification products; no one paid to be included. Research tool, not legal advice. Our scores and our own words are CC BY 4.0; quoted law and source titles stay with their owners.