# Health Record Rights Index: full text

> Health record rights in 198 countries. An open index by SuperTruth Inc. Data as of 2026-10-02. Licence: CC BY 4.0. Short version: https://healthrecordrights.com/llms.txt

Key findings (2026): In 2026, none of the 198 countries we rated puts a person fully in charge of their own health record. The highest scores are Finland (71), Denmark (70), Estonia (68), Hungary (68) and Sweden (67); allowing for scoring error, any of them could rank first. The median is 39. No country reaches the Leading band (85 and up). By band, 9 rate Strong, 66 Mixed, 111 Weak and 12 Poor. Everywhere, the state or providers run the system that holds the record (51 Shared, 81 Institutional, 66 State).

## Method
Each country scores 0 to 100 in eight weighted rights: patient access to the full record (20%), patient control and consent (20%), privacy and security (15%), connected care journey (15%), protection from commercial use (10%), clinician access at the point of care (10%), research and trial consent (5%), clinical AI governance (5%). Bands: Poor 0 to 24, Weak 25 to 44, Mixed 45 to 64, Strong 65 to 84, Leading 85 to 100. Scores move in steps of about 5 points; read each rank with its likely range (90% of simulations that allow for scoring error and weight choices). Research was done by AI research agents built on Anthropic's Claude, in each country's language, cross-checked by a second agent and reviewed by the authors. Every score cites the public pages it rests on.

Confidence: 27 high, 105 medium, 66 low. Confidence says how many of the 8 category scores rest on an official source (a law, a government or regulator page, or an international agency page such as WHO or OECD) with no fact the text says we could not check. High: at least 7 do, and no fact is marked unchecked. Low: 4 or more do not. Medium: the rest. The evidence grade (DTI) rates all the sources we cite, taken together. A country can cite good sources overall and still have thin evidence in some categories. Neither label changes the score. Median score by label: 48 for high, 37 for medium and 40 for low; low-confidence countries appear in the Poor, Weak and Mixed bands. The label is about the evidence, not the country's rights.

## How to cite
Snyder, J. A., Hill, B., & Raney, D. (2026). Health Record Rights Index (version 1.0). SuperTruth Inc. https://healthrecordrights.com/

## Countries, in rank order

### Finland (FIN): 71/100, rank 1 of 198 (likely range 1 to 6), Strong, confidence: high
In 2026, Finland scores 71 of 100 on a person's right to see, control and share their own health record: rank 1 of 198 countries (likely range 1 to 6), in the Strong band (65 to 84). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (74, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (58, median 46).
Finns read a national record in OmaKanta and decide by permit who outside their region sees it, but public bodies cannot yet be fined.
Scores: patient access to the full record 76; patient control and consent 74; privacy and security 62; connected care journey 82; protection from commercial use 68; clinician access at the point of care 76; research and trial consent 58; clinical AI governance 50.
Access: OmaKanta shows visit notes, lab and imaging results, vaccinations and prescriptions from public and private care, and 3.3 million people used it in 2025. Records start only when a provider joined Kanta (from 2013), and no app can yet download them.
Control: Records leave the region or provider where they were written only if the patient gives a revocable permit, which can be narrowed by visit, register or all data, even in emergencies. OmaKanta shows which units fetched data, but staff names need a log request.
Key laws: Act on the Processing of Client Data in Healthcare and Social Welfare (703/2023) (2023); Act on the Secondary Use of Health and Social Data (552/2019), amended by 1159/2025 (2019).
Brief and every source: https://healthrecordrights.com/brief/FIN/

### Denmark (DNK): 70/100, rank 2 of 198 (likely range 1 to 8), Strong, confidence: medium
In 2026, Denmark scores 70 of 100 on a person's right to see, control and share their own health record: rank 2 of 198 countries (likely range 1 to 8), in the Strong band (65 to 84). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is connected care journey (82, against a median of 38 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (49, median 46).
Danes see hospital records, labs and medicines on sundhed.dk and can block lookups, but GP notes are only now arriving and registers have no opt-out.
Scores: patient access to the full record 78; patient control and consent 70; privacy and security 62; connected care journey 82; protection from commercial use 58; clinician access at the point of care 78; research and trial consent 49; clinical AI governance 50.
Access: The Commission gave Denmark a 98% eHealth maturity score for 2025, and over 3 million Danes use sundhed.dk or MinSundhed each year. GP notes are only starting to appear, and the full hospital record still needs an access request.
Control: Patients can refuse lookups by named staff, units or time periods, and can block access on sundhed.dk. A log on sundhed.dk shows who looked, but treatment lookups need no consent and refusals give way to overriding interests.
Key laws: Danish Health Act (Sundhedsloven), LBK 275 of 2025 (2025); Act no. 717 of 20 June 2025 amending the Health Act (2025).
Brief and every source: https://healthrecordrights.com/brief/DNK/

### Estonia (EST): 68/100, rank 3= of 198 (likely range 1 to 13), Strong, confidence: medium
In 2026, Estonia scores 68 of 100 on a person's right to see, control and share their own health record: rank 3= of 198 countries (likely range 1 to 13), in the Strong band (65 to 84). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is connected care journey (80, against a median of 38 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Every provider must feed one national record that patients can read, log-check and close, but police and security services can query it without consent.
Scores: patient access to the full record 80; patient control and consent 68; privacy and security 55; connected care journey 80; protection from commercial use 58; clinician access at the point of care 75; research and trial consent 50; clinical AI governance 50.
Access: The Health Portal shows documents, prescriptions, invoices and access logs, kept without time limit, and 60% of people aged 16 to 74 read records online in 2024 (EU 28%). Export was not verified, so the score sits in the lower half of its band.
Control: Patients can close their whole record or single documents in the portal and read a logbook of who viewed each document. Uploads need no consent, prescription views are not in the portal log, and police can obtain data for criminal proceedings without consent.
Key laws: Health Services Organisation Act (Tervishoiuteenuste korraldamise seadus) (2001); Government Regulation No. 138, Statute of the Health Information System (2016).
Brief and every source: https://healthrecordrights.com/brief/EST/

### Hungary (HUN): 68/100, rank 3= of 198 (likely range 1 to 13), Strong, confidence: high
In 2026, Hungary scores 68 of 100 on a person's right to see, control and share their own health record: rank 3= of 198 countries (likely range 1 to 13), in the Strong band (65 to 84). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (72, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (47, median 46).
Hungary's EESZT links every GP, hospital and pharmacy, and patients can block doctors and read an access log, though very few use those controls.
Scores: patient access to the full record 72; patient control and consent 72; privacy and security 62; connected care journey 78; protection from commercial use 55; clinician access at the point of care 76; research and trial consent 47; clinical AI governance 54.
Access: Through the EESZT portal and the EgészségAblak app, patients can see documents from their care, prescriptions and referrals, and the EU scored Hungary 85.98 on record access in 2024. Medical images are not yet shown to citizens, so the score stays inside the portal band.
Control: Patients can open their record to all, block whole specialties, block a single doctor or hospital, or block everyone, and they can read a log of every query. Only about 0.6 percent of people have changed the default.
Key laws: Act CLIV of 1997 on Health (Eütv.) (1997); Act XLVII of 1997 on Health Data (Eüak.) (1997).
Brief and every source: https://healthrecordrights.com/brief/HUN/

### Sweden (SWE): 67/100, rank 5 of 198 (likely range 1 to 17), Strong, confidence: high
In 2026, Sweden scores 67 of 100 on a person's right to see, control and share their own health record: rank 5 of 198 countries (likely range 1 to 17), in the Strong band (65 to 84). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (72, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (49, median 46).
Swedes read nearly all their record in 1177 and must consent before another provider looks, but registers have no opt-out and consent may soon go.
Scores: patient access to the full record 77; patient control and consent 72; privacy and security 64; connected care journey 66; protection from commercial use 60; clinician access at the point of care 64; research and trial consent 49; clinical AI governance 50.
Access: Every region shows records in 1177, and the Commission found all 13 data types it checks available in all 21 regions, with images only on request. About 8 million people have logged in, but 1177 offers reading and paper copies, not a download.
Control: Another provider may read shared records only with the patient's consent, patients can object and have data blocked at once, and some regions show the access log in 1177. A June 2026 proposal would drop the consent rule from July 2027; it is not yet law.
Key laws: Patient Data Act (Patientdatalag 2008:355) (2008); Act on coordinated care and social care documentation (2022:913) (2022).
Brief and every source: https://healthrecordrights.com/brief/SWE/

### Australia (AUS): 66/100, rank 6= of 198 (likely range 2 to 20), Strong, confidence: medium
In 2026, Australia scores 66 of 100 on a person's right to see, control and share their own health record: rank 6= of 198 countries (likely range 2 to 20), in the Strong band (65 to 84). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (68, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Australia's opt-out national record holds over 25 million records patients can lock and audit, and test results now upload to it by default.
Scores: patient access to the full record 70; patient control and consent 68; privacy and security 62; connected care journey 70; protection from commercial use 65; clinician access at the point of care 66; research and trial consent 50; clinical AI governance 55.
Access: My Health Record held 25.16 million records in July 2026, and from 1 July 2026 pathology and imaging reports must be uploaded by default. It is a summary, not the full chart, and copies from providers may carry a fee.
Control: People can cancel the record, lock it or single documents with access codes, stop uploads, and read an access log with alerts. But the default lets every treating provider see everything, and only about 72,000 people use advanced access controls.
Key laws: My Health Records Act 2012 (2012); Health Legislation Amendment (Modernising My Health Record, Sharing by Default) Act 2025 (2025).
Brief and every source: https://healthrecordrights.com/brief/AUS/

### France (FRA): 66/100, rank 6= of 198 (likely range 2 to 20), Strong, confidence: high
In 2026, France scores 66 of 100 on a person's right to see, control and share their own health record: rank 6= of 198 countries (likely range 2 to 20), in the Strong band (65 to 84). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (68, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is privacy and security (58, median 45).
Nearly everyone has an opt-out Mon espace santé with blocking and an access history, but only a third use it and vendors leak.
Scores: patient access to the full record 70; patient control and consent 68; privacy and security 58; connected care journey 72; protection from commercial use 66; clinician access at the point of care 62; research and trial consent 60; clinical AI governance 54.
Access: French law gives a free right to the whole record within 8 days, and Mon espace santé exists for about 97% of people by default. It holds documents providers deposit, not the full chart, and only 33.6% of accounts are activated.
Control: Mon espace santé is opt-out, but inside it patients can block named professionals, hide documents, get a notification when a professional connects and read an activity history. Emergency staff can open the record unless the patient objected.
Key laws: Code de la santé publique, L1110-4 and R1111-1 to R1111-7 (2004); Code de la santé publique, article L1111-8 (health data hosting) (2017).
Brief and every source: https://healthrecordrights.com/brief/FRA/

### Norway (NOR): 66/100, rank 6= of 198 (likely range 2 to 20), Strong, confidence: high
In 2026, Norway scores 66 of 100 on a person's right to see, control and share their own health record: rank 6= of 198 countries (likely range 2 to 20), in the Strong band (65 to 84). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (74, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Norwegians control a national core record with opt-out, blocks and a lookup log, but full notes rarely follow them between GP, hospital and municipality.
Scores: patient access to the full record 68; patient control and consent 74; privacy and security 62; connected care journey 66; protection from commercial use 64; clinician access at the point of care 68; research and trial consent 50; clinical AI governance 50.
Access: Norway has a statutory right to see and copy the whole record, and Helsenorge logged 104.7 million logins in 2025. But GP records are not on Helsenorge, and the Commission found imaging reports and images are not online at all.
Control: Patients can opt out of the national Kjernejournal, block all or some items, block named staff even in emergencies, and read a log of who looked. A 2026 law adds a right to see which data were shared, while widening direct access between providers.
Key laws: Patient and User Rights Act (pasient- og brukerrettighetsloven) (1999); Patient Records Act (pasientjournalloven) (2014).
Brief and every source: https://healthrecordrights.com/brief/NOR/

### Austria (AUT): 65/100, rank 9 of 198 (likely range 3 to 23), Strong, confidence: high
In 2026, Austria scores 65 of 100 on a person's right to see, control and share their own health record: rank 9 of 198 countries (likely range 3 to 23), in the Strong band (65 to 84). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (72, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (49, median 46).
Austria's opt-out ELGA record gives strong controls and a full access log, but holds reports and medicines, not complete charts, and few use it.
Scores: patient access to the full record 63; patient control and consent 72; privacy and security 63; connected care journey 68; protection from commercial use 66; clinician access at the point of care 66; research and trial consent 49; clinical AI governance 50.
Access: Patients have a statutory right to see their records and get a free first copy, and the ELGA portal shows discharge letters, lab and radiology reports and 18 months of medicines. Images, GP notes and documents from before 2016 are missing, and uptake is low.
Control: Everyone is in ELGA unless they opt out, fully or for e-reports or e-medication, and patients can hide or delete single documents, block a provider and read a full access log. There is no opt-out from the e-vaccination record or e-prescriptions.
Key laws: Gesundheitstelematikgesetz 2012 (GTelG 2012) (2012); Datenschutzgesetz (DSG) (2018).
Brief and every source: https://healthrecordrights.com/brief/AUT/

### Portugal (PRT): 64/100, rank 10 of 198 (likely range 3 to 26), Mixed, confidence: high
In 2026, Portugal scores 64 of 100 on a person's right to see, control and share their own health record: rank 10 of 198 countries (likely range 3 to 26), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (70, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (48, median 46).
Portugal's SNS 24 shows patients who opened their record and asks consent before clinicians look; a May 2026 credential theft tested both.
Scores: patient access to the full record 70; patient control and consent 70; privacy and security 56; connected care journey 68; protection from commercial use 62; clinician access at the point of care 64; research and trial consent 48; clinical AI governance 50.
Access: Portugal scored 88.1 on the EU 2025 record-access indicator against an EU average of 82.7, and SNS 24 shows prescriptions, lab results, vaccines and five years of care history. Lei 12/2005 gives a right to the whole record, but the portal is not the full chart.
Control: Clinicians cannot open the national record without the patient's authorisation, set in SNS 24 or given at the visit, and patients can see every access. Lei 58/2019 requires that people be notified of any access to their health data.
Key laws: Lei n.º 12/2005, informação genética pessoal e informação de saúde (2005); Lei n.º 58/2019, execução do RGPD (2019).
Brief and every source: https://healthrecordrights.com/brief/PRT/

### Belgium (BEL): 63/100, rank 11= of 198 (likely range 5 to 30), Mixed, confidence: medium
In 2026, Belgium scores 63 of 100 on a person's right to see, control and share their own health record: rank 11= of 198 countries (likely range 5 to 30), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (72, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (49, median 46).
Belgian records are indexed unless patients object, providers need consent to open them, and patients can block named doctors and see who looked.
Scores: patient access to the full record 68; patient control and consent 72; privacy and security 54; connected care journey 68; protection from commercial use 54; clinician access at the point of care 62; research and trial consent 49; clinical AI governance 50.
Access: The law gives a free first copy, paper or electronic, within 15 days, and the EU rates Belgian record access 100 out of 100. The federal portal shows linked documents, not one full record, and French speakers cannot see vaccines or test results in the app.
Control: The national index lists where a patient's data sits unless the patient objects, but another provider may open it only with revocable consent. Patients can exclude named providers and see who consulted their data; exclusion works only name by name.
Key laws: Loi du 22 août 2002 relative aux droits du patient (2002); Loi du 22 avril 2019 relative à la qualité de la pratique des soins de santé (2019).
Brief and every source: https://healthrecordrights.com/brief/BEL/

### Germany (DEU): 63/100, rank 11= of 198 (likely range 5 to 30), Mixed, confidence: high
In 2026, Germany scores 63 of 100 on a person's right to see, control and share their own health record: rank 11= of 198 countries (likely range 5 to 30), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (66, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
About 73 million Germans have an opt-out ePA with an access log and blocking options, but only 5.1 million have the ID to open it.
Scores: patient access to the full record 64; patient control and consent 66; privacy and security 58; connected care journey 66; protection from commercial use 70; clinician access at the point of care 62; research and trial consent 50; clinical AI governance 50.
Access: Since 6 February 2026 the BGB gives a free first copy of the complete treatment record, including electronic copies, and insurers have created about 73 million ePAs. Only 5.1 million people had the GesundheitsID needed to read theirs.
Control: Patients can object to the whole ePA, to single uses, or to named facilities, hide documents, change access periods and read an access log. Hiding is all-or-nothing: a document cannot be hidden from one practice only.
Key laws: Bürgerliches Gesetzbuch § 630g (as amended 2026) (2026); SGB V ePA provisions §§ 337-363 (Digital-Gesetz) (2025).
Brief and every source: https://healthrecordrights.com/brief/DEU/

### Italy (ITA): 63/100, rank 11= of 198 (likely range 5 to 31), Mixed, confidence: medium
In 2026, Italy scores 63 of 100 on a person's right to see, control and share their own health record: rank 11= of 198 countries (likely range 5 to 31), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (72, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Italians can hide documents and read who opened their regional record, but fewer than half let doctors see it.
Scores: patient access to the full record 68; patient control and consent 72; privacy and security 56; connected care journey 66; protection from commercial use 60; clinician access at the point of care 50; research and trial consent 50; clinical AI governance 54.
Access: Law 24/2017 obliges providers to release records within seven days, and every regional FSE shows lab, discharge and ER reports. Italy scored 84.1 on the EU record-access indicator (EU 82.7), but the full hospital chart is online in only 6 of 21 regions.
Control: Clinicians may consult the FSE only after the patient gives explicit, revocable consent, and patients can hide any document online and read the access log, both available in all 21 regions. Documents still flow into the FSE automatically without consent.
Key laws: Legge 8 marzo 2017, n. 24 (Gelli-Bianco), art. 4 (2017); Decreto-legge 18 ottobre 2012, n. 179, art. 12, as amended by DL 19 maggio 2020, n. 34, art. 11 (2012).
Brief and every source: https://healthrecordrights.com/brief/ITA/

### Taiwan (TWN): 63/100, rank 11= of 198 (likely range 5 to 32), Mixed, confidence: medium
In 2026, Taiwan scores 63 of 100 on a person's right to see, control and share their own health record: rank 11= of 198 countries (likely range 5 to 32), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinician access at the point of care (78, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is privacy and security (50, median 45).
Taiwan's single insurer offers every insured person three years of claims-based records online, with 12.48 million registered users, but full charts stay in each hospital.
Scores: patient access to the full record 68; patient control and consent 52; privacy and security 50; connected care journey 72; protection from commercial use 62; clinician access at the point of care 78; research and trial consent 66; clinical AI governance 58.
Access: The Medical Care Act gives a right to a copy of the record, and My Health Bank shows three years of visits, medicines, lab results and imaging reports to 12.48 million registered users. Copies cost the patient, and Liberty Times reported only 1 to 3 million regular users.
Control: A person can set an NHI card password that stops all contracted doctors and pharmacists from viewing their MediCloud data, and a separate opt-out covers research use. The block is a single switch that must be set in person at an NHIA or district office.
Key laws: National Health Insurance Data Management Act (2025); Personal Data Protection Act (1995).
Brief and every source: https://healthrecordrights.com/brief/TWN/

### Turkey (TUR): 63/100, rank 11= of 198 (likely range 4 to 29), Mixed, confidence: low
Weak evidence in 5 of 8 categories: access, privacy, journey, commercial and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Turkey scores 63 of 100 on a person's right to see, control and share their own health record: rank 11= of 198 countries (likely range 4 to 29), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is connected care journey (80, against a median of 38 across 198 countries); its weakest is research and trial consent (44, median 46).
e-Nabız gives nearly every Turk one national record with an access log and SMS-code consent, but the state holds the data centrally.
Scores: patient access to the full record 74; patient control and consent 62; privacy and security 50; connected care journey 80; protection from commercial use 55; clinician access at the point of care 64; research and trial consent 44; clinical AI governance 50.
Access: The Patient Rights Regulation gives a right to examine the file and take a copy, and the national e-Nabız portal shows labs, imaging, prescriptions, diagnoses and reports. The minister said it served over 79 million citizens in 2025.
Control: Patients can see every access to their e-Nabız account by date and time, and can require an SMS code before most doctors see their past data. Family, emergency and inpatient doctors keep access, and records held by the ministry cannot be deleted.
Key laws: Law No. 6698 on the Protection of Personal Data (KVKK) (2016); Regulation on Personal Health Data (Kişisel Sağlık Verileri Hakkında Yönetmelik) (2019).
Brief and every source: https://healthrecordrights.com/brief/TUR/

### Iceland (ISL): 62/100, rank 16= of 198 (likely range 5 to 32), Mixed, confidence: medium
In 2026, Iceland scores 62 of 100 on a person's right to see, control and share their own health record: rank 16= of 198 countries (likely range 5 to 32), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinician access at the point of care (74, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Iceland's records are linked across nearly all public care and patients can block sharing, but the Heilsuvera portal shows only part of the record.
Scores: patient access to the full record 62; patient control and consent 55; privacy and security 62; connected care journey 76; protection from commercial use 58; clinician access at the point of care 74; research and trial consent 50; clinical AI governance 50.
Access: The Medical Records Act gives a right to a copy of the whole record, clarified by a 2025 amendment. Heilsuvera shows prescriptions, vaccinations and dates of hospital and clinic visits, but not clinical notes or lab results.
Control: Patients can ban sharing through linked record systems, for a whole provider, a department or a named party, and have a legal right to learn who looked at their record. Bans need a signed form, and the access log comes on request only.
Key laws: Medical Records Act (lög um sjúkraskrár) no. 55/2009 (2009); Act no. 81/2025 amending the Medical Records Act (2025).
Brief and every source: https://healthrecordrights.com/brief/ISL/

### Israel (ISR): 62/100, rank 16= of 198 (likely range 6 to 34), Mixed, confidence: medium
In 2026, Israel scores 62 of 100 on a person's right to see, control and share their own health record: rank 16= of 198 countries (likely range 6 to 34), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinician access at the point of care (75, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (49, median 46).
Every Israeli can read most of their record in their health fund's app, but the national exchange offers only an all-or-nothing opt-out.
Scores: patient access to the full record 66; patient control and consent 50; privacy and security 58; connected care journey 78; protection from commercial use 56; clinician access at the point of care 75; research and trial consent 49; clinical AI governance 50.
Access: The Patient's Rights Act gives a right to the record and a copy, and a 2019 ministry circular makes all four health funds show members structured and free-text data online. No fixed deadline was found and no official usage figure was verified.
Control: Everyone is in the national Eitan exchange by default and can leave only completely, by a request at a health fund branch that is handled within 30 days. Every view is logged, but no patient-facing view of that log was found.
Key laws: Patient's Rights Act 1996 (1996); Patient's Rights Regulations (maximum fee for a medical record copy) 2019 (2019).
Brief and every source: https://healthrecordrights.com/brief/ISR/

### Latvia (LVA): 62/100, rank 16= of 198 (likely range 7 to 34), Mixed, confidence: medium
In 2026, Latvia scores 62 of 100 on a person's right to see, control and share their own health record: rank 16= of 198 countries (likely range 7 to 34), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (62, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
The E-veselība record, with an access log and patient bans, covers prescriptions, labs and discharges, but staff snooping persists and the portal is being rebuilt.
Scores: patient access to the full record 64; patient control and consent 62; privacy and security 58; connected care journey 70; protection from commercial use 55; clinician access at the point of care 66; research and trial consent 50; clinical AI governance 50.
Access: The free national E-veselība portal shows prescriptions, referrals, discharge summaries and lab results (from 2024), and the law gives one free copy within three working days. Export and full history depth were not verified, so the score sits in the lower half of its band.
Control: Patients can see an audit log of who opened their record, ban all access or block chosen providers and data, and delegate access. Records are open to treating staff by default, and repeated snooping cases keep the score in the lower half of the band.
Key laws: Patient Rights Law (Pacientu tiesību likums) (2009); Cabinet Regulation No. 134 on the unified health sector information system (2014).
Brief and every source: https://healthrecordrights.com/brief/LVA/

### Singapore (SGP): 62/100, rank 16= of 198 (likely range 6 to 34), Mixed, confidence: medium
In 2026, Singapore scores 62 of 100 on a person's right to see, control and share their own health record: rank 16= of 198 countries (likely range 6 to 34), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinician access at the point of care (68, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
A 2026 law, not yet in force, makes every provider feed one national record without consent; patients can block access, but very few do.
Scores: patient access to the full record 62; patient control and consent 58; privacy and security 62; connected care journey 64; protection from commercial use 62; clinician access at the point of care 68; research and trial consent 50; clinical AI governance 62.
Access: Patients can view medications, immunisations and lab results from the national record in HealthHub, and the PDPA gives a right to request the rest from each provider. But providers may charge a fee and need not hand over copies of doctors' notes.
Control: Data flows into the NEHR without consent, but a person can block all provider access and can see a one-year log of which institutions opened their record. Only about 2,300 people have placed a block since 2011, and finer choices in HealthHub are planned from 2027.
Key laws: Health Information Act 2026 (2026); Personal Data Protection Act 2012 (2012).
Brief and every source: https://healthrecordrights.com/brief/SGP/

### Slovenia (SVN): 62/100, rank 16= of 198 (likely range 6 to 33), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, journey and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Slovenia scores 62 of 100 on a person's right to see, control and share their own health record: rank 16= of 198 countries (likely range 6 to 33), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinician access at the point of care (68, against a median of 34 across 198 countries); its weakest is research and trial consent (45, median 46).
Slovenia's zVEM portal shows patients their reports, prescriptions and an access log, but data flows to the central register without consent.
Scores: patient access to the full record 66; patient control and consent 60; privacy and security 62; connected care journey 66; protection from commercial use 60; clinician access at the point of care 68; research and trial consent 45; clinical AI governance 50.
Access: The Patients' Rights Act gives a right to see and copy the record within five working days, and the national zVEM portal shows test results, prescriptions, referrals and appointments. Some providers still send less than they should, so the portal is not the full chart.
Control: Patients can block viewing of their Patient Data Summary for one provider or all providers and can see which institution opened their records. They cannot stop data going to the central register, and the log names institutions, not staff.
Key laws: Patients' Rights Act (Zakon o pacientovih pravicah, ZPacP) (2008); Health Data Collections Act amendment (ZZPPZ-A) (2015).
Brief and every source: https://healthrecordrights.com/brief/SVN/

### Liechtenstein (LIE): 61/100, rank 21= of 198 (likely range 7 to 35), Mixed, confidence: medium
In 2026, Liechtenstein scores 61 of 100 on a person's right to see, control and share their own health record: rank 21= of 198 countries (likely range 7 to 35), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (74, against a median of 30 across 198 countries); its weakest is research and trial consent (42, median 46).
Every insured person has an opt-out eGD with access logs and patient-unlocked doctor access, but active use is unproven and EU health-data rules lag.
Scores: patient access to the full record 64; patient control and consent 74; privacy and security 62; connected care journey 54; protection from commercial use 54; clinician access at the point of care 63; research and trial consent 42; clinical AI governance 50.
Access: By law every insured person has an eGD they can read in full, holding letters, reports, labs, imaging findings and medicines since 2023. Older records and full charts stay with each doctor, and no official figure on active use was found.
Control: Patients can opt out at any time, hide or delete single documents, see an access log, and must unlock each provider before access. The opt-out is all or nothing: it deletes the whole dossier.
Key laws: Gesetz über das elektronische Gesundheitsdossier (EGDG) (2021); Verordnung über das elektronische Gesundheitsdossier (EGDV) (2022).
Brief and every source: https://healthrecordrights.com/brief/LIE/

### Spain (ESP): 61/100, rank 21= of 198 (likely range 8 to 36), Mixed, confidence: high
In 2026, Spain scores 61 of 100 on a person's right to see, control and share their own health record: rank 21= of 198 countries (likely range 8 to 36), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (64, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Spaniards can read key reports from any region and hide them from other doctors, but the national record is summaries, not the chart.
Scores: patient access to the full record 66; patient control and consent 64; privacy and security 56; connected care journey 64; protection from commercial use 60; clinician access at the point of care 60; research and trial consent 50; clinical AI governance 50.
Access: Ley 41/2002 gives a free right to the clinical record, and the national HCDSNS shows up to nine report types from any region. Spain scored 88.3 on the EU record-access indicator (Digital Decade 2025, 2024 data; EU 82.7), but what each region publishes varies.
Control: Patients can hide individual reports from other doctors in HCDSNS and see every access, with a form to complain about unjustified ones. Choice covers only the shared national layer; inside each region clinicians treating the patient read the record by law.
Key laws: Ley 41/2002, básica reguladora de la autonomía del paciente (2002); Ley Orgánica 3/2018 (LOPDGDD) (2018).
Brief and every source: https://healthrecordrights.com/brief/ESP/

### Croatia (HRV): 60/100, rank 23= of 198 (likely range 9 to 38), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Croatia scores 60 of 100 on a person's right to see, control and share their own health record: rank 23= of 198 countries (likely range 9 to 38), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (66, against a median of 30 across 198 countries); its weakest is research and trial consent (45, median 46).
Croatians can see labs, prescriptions and hospital letters online and block whole groups of doctors, but private clinics stay outside CEZIH until 2027.
Scores: patient access to the full record 62; patient control and consent 66; privacy and security 52; connected care journey 68; protection from commercial use 56; clinician access at the point of care 64; research and trial consent 45; clinical AI governance 50.
Access: The 2004 patient rights law gives a right to the whole record, with copies at the patient's cost. Portal zdravlja shows lab results, prescriptions, referrals and hospital letters, but its user count was not verified, so the score sits in the lower half of the band.
Control: In Portal zdravlja patients can allow or block access by whole groups, such as all family doctors, emergency doctors or hospital specialists. A law-backed log shows who viewed which data and when, but sharing is on by default.
Key laws: Zakon o podacima i informacijama u zdravstvu (NN 14/19) (2019); Zakon o zastiti prava pacijenata (NN 169/04) (2004).
Brief and every source: https://healthrecordrights.com/brief/HRV/

### Lithuania (LTU): 60/100, rank 23= of 198 (likely range 9 to 38), Mixed, confidence: medium
In 2026, Lithuania scores 60 of 100 on a person's right to see, control and share their own health record: rank 23= of 198 countries (likely range 9 to 38), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (62, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (48, median 46).
A national e-health record with per-document hiding and a visible view history, undercut by weak clinician logins and a shaky central system.
Scores: patient access to the full record 67; patient control and consent 62; privacy and security 50; connected care journey 68; protection from commercial use 54; clinician access at the point of care 64; research and trial consent 48; clinical AI governance 50.
Access: The law gives patients their records and certified copies, and the national E. sveikata portal shows diagnoses, prescriptions, referrals, images and vaccinations. An EC study scored Lithuania 95% on eHealth maturity, but lab results were only being added from October 2025.
Control: Patients can hide individual documents and see who viewed each one, when and on what basis. Hiding does not stop primary care doctors, emergency doctors or representatives, and uploads need no consent.
Key laws: Law on the Rights of Patients and Compensation for Damage to Health (I-1562) (1996); Law on the Reuse of Health Data (XIV-789) (2021).
Brief and every source: https://healthrecordrights.com/brief/LTU/

### Netherlands (NLD): 60/100, rank 23= of 198 (likely range 11 to 40), Mixed, confidence: medium
In 2026, the Netherlands scores 60 of 100 on a person's right to see, control and share their own health record: rank 23= of 198 countries (likely range 11 to 40), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (72, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is privacy and security (52, median 45).
Dutch records move between providers only with the patient's explicit opt-in, but few people use their copy apps and an EHDS opt-out is planned.
Scores: patient access to the full record 55; patient control and consent 72; privacy and security 52; connected care journey 60; protection from commercial use 62; clinician access at the point of care 58; research and trial consent 57; clinical AI governance 50.
Access: Dutch law gives a copy of the whole file and free electronic access, and about 93% of GPs connect to certified apps. Only 571,000 people fetched records that way in 2024, and the EU scores Dutch record access 69.35 against an 86.51 average.
Control: Under the Wabvpz a provider may share data through an exchange system only with the patient's explicit consent, and patients can see on Volgjezorg who viewed their data via the national switch point. Consent is split across several systems, and the government plans an EHDS opt-out.
Key laws: Burgerlijk Wetboek Boek 7, afdeling 5 (WGBO) (1994); Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg (Wabvpz) (2008).
Brief and every source: https://healthrecordrights.com/brief/NLD/

### South Korea (KOR): 60/100, rank 23= of 198 (likely range 8 to 38), Mixed, confidence: medium
In 2026, South Korea scores 60 of 100 on a person's right to see, control and share their own health record: rank 23= of 198 countries (likely range 8 to 38), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinical AI governance (66, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Koreans can copy their whole record and see 10 years of claims online, and clinical records move only with opt-in consent.
Scores: patient access to the full record 66; patient control and consent 55; privacy and security 65; connected care journey 62; protection from commercial use 55; clinician access at the point of care 58; research and trial consent 50; clinical AI governance 66.
Access: The Medical Service Act lets patients view or copy their whole record, though copies carry a fee and we found no deadline. Since May 2026 NHIS lets every insured person view and download up to 10 years of claims-based treatment history online.
Control: Records move between hospitals, or to apps and firms, only with the patient's opt-in consent, chosen by institution, item and period and revocable. We found no way for patients to see who opened their chart, which holds control at the top of the 40 to 55 band.
Key laws: Medical Service Act (2024 amendment; Articles 21, 21-2, 21-3, 88) (2024); Personal Information Protection Act (2026 amendment) (2026).
Brief and every source: https://healthrecordrights.com/brief/KOR/

### Bulgaria (BGR): 59/100, rank 27= of 198 (likely range 11 to 40), Mixed, confidence: low
Weak evidence in 5 of 8 categories: access, journey, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Bulgaria scores 59 of 100 on a person's right to see, control and share their own health record: rank 27= of 198 countries (likely range 11 to 40), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (62, against a median of 30 across 198 countries); its weakest is research and trial consent (44, median 46).
Bulgaria's national health information system records every visit, prescription and hospital stay, with consent rules and an access history, but few patients use it.
Scores: patient access to the full record 62; patient control and consent 62; privacy and security 55; connected care journey 70; protection from commercial use 50; clinician access at the point of care 62; research and trial consent 44; clinical AI governance 50.
Access: The Health Act gives a right to copies, and the national record shows exams, referrals, lab results, vaccines, prescriptions and hospital stays. Use is low: about 500,000 records were reachable through the eZdrave app in February 2026, so the score sits low in its band.
Control: Access by providers, the health fund and insurers needs the patient's express written consent, which can be limited and withdrawn, and patients can check an access history in the app. The patient's own GP has standing access.
Key laws: General Data Protection Regulation (EU) 2016/679 (2016); Health Act (Закон за здравето) (2004).
Brief and every source: https://healthrecordrights.com/brief/BGR/

### Luxembourg (LUX): 59/100, rank 27= of 198 (likely range 12 to 42), Mixed, confidence: medium
In 2026, Luxembourg scores 59 of 100 on a person's right to see, control and share their own health record: rank 27= of 198 countries (likely range 12 to 42), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (70, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (46, median 46).
Every insured person gets a shared record with an access log and blocking tools, but few patients activate it and the EU says access lags.
Scores: patient access to the full record 64; patient control and consent 70; privacy and security 54; connected care journey 54; protection from commercial use 54; clinician access at the point of care 56; research and trial consent 46; clinical AI governance 50.
Access: The 2014 patient rights law gives a right to a full copy within 15 working days, and a national shared record holds lab, imaging and discharge reports. Patients activate only about 3,257 accounts a month, and the EU rates record access as lagging.
Control: The patient can oppose sharing at any time, close the record, block named professionals or mask data, and see a log of every access. The record is created by default, and the referring doctor cannot be blocked.
Key laws: Loi du 24 juillet 2014 relative aux droits et obligations du patient (2014); Code de la sécurité sociale, Article 60quater (dossier de soins partagé) (2010).
Brief and every source: https://healthrecordrights.com/brief/LUX/

### Malta (MLT): 59/100, rank 27= of 198 (likely range 11 to 42), Mixed, confidence: medium
In 2026, Malta scores 59 of 100 on a person's right to see, control and share their own health record: rank 27= of 198 countries (likely range 11 to 42), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient access to the full record (72, against a median of 43 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (48, median 46).
Malta's myHealth portal shows most public-sector records online, but private clinics, hospitals and prescribers are still largely outside the national record.
Scores: patient access to the full record 72; patient control and consent 50; privacy and security 62; connected care journey 60; protection from commercial use 58; clinician access at the point of care 56; research and trial consent 48; clinical AI governance 50.
Access: Malta scored 93.71 on the EU's 2024 record-access indicator against an EU average of 82.7. myHealth shows public hospital summaries, labs, imaging reports, prescriptions and vaccines, but the Commission found no private-sector data and no mobile app.
Control: Patients choose which doctors can see their myHealth data and can remove a link at any time, and they set cross-border consent country by country. No patient-visible access log was found; the 2030 strategy only promises a way to see who contributes to records.
Key laws: Data Protection Act (Cap. 586) (2018); Processing of Personal Data (Secondary Processing) (Health Sector) Regulations (S.L. 528.10) (2019).
Brief and every source: https://healthrecordrights.com/brief/MLT/

### Poland (POL): 59/100, rank 27= of 198 (likely range 12 to 42), Mixed, confidence: medium
In 2026, Poland scores 59 of 100 on a person's right to see, control and share their own health record: rank 27= of 198 countries (likely range 12 to 42), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is connected care journey (70, against a median of 38 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (46, median 46).
Over 20 million Poles can see prescriptions, visits and documents in a national patient account and control specialist access, but 2026 vendor leaks hit millions.
Scores: patient access to the full record 70; patient control and consent 55; privacy and security 46; connected care journey 70; protection from commercial use 54; clinician access at the point of care 60; research and trial consent 46; clinical AI governance 54.
Access: The law gives a right to records and a free first copy, and the national patient account (IKP) shows prescriptions, referrals, visit history, NFZ payments and uploaded documents to 53% of citizens. An EC study finds lab results, discharge reports and images only partly available.
Control: Outside a few groups named in law, a clinician can see a patient's records only with consent given in the IKP or mojeIKP, limited in scope and time and revocable. Patients cannot block their family doctor, the record's author or emergency staff.
Key laws: Act on Patient Rights and the Patient Rights Ombudsman (2008); Act on the Health Care Information System (2011).
Brief and every source: https://healthrecordrights.com/brief/POL/

### United Kingdom (GBR): 59/100, rank 27= of 198 (likely range 11 to 41), Mixed, confidence: high
In 2026, the United Kingdom scores 59 of 100 on a person's right to see, control and share their own health record: rank 27= of 198 countries (likely range 11 to 41), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinician access at the point of care (60, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is privacy and security (56, median 45).
In England, 39 million are registered on the NHS App and can opt out of the Summary Care Record, but not the Palantir-built data platform.
Scores: patient access to the full record 66; patient control and consent 52; privacy and security 56; connected care journey 62; protection from commercial use 60; clinician access at the point of care 60; research and trial consent 64; clinical AI governance 55.
Access: UK GDPR gives a free copy of the record within one month, and 39.1 million people are registered on the NHS App. But the app shows only new GP record entries, not historic or hospital records; a single patient record is promised from 2028.
Control: Patients can opt out of the national Summary Care Record, and staff must ask permission before viewing it outside emergencies. But there is no opt-out from the Palantir-built Federated Data Platform, and access logs are available only by formal request.
Key laws: UK GDPR and Data Protection Act 2018 (2018); Data (Use and Access) Act 2025 (2025).
Brief and every source: https://healthrecordrights.com/brief/GBR/

### Uruguay (URY): 59/100, rank 27= of 198 (likely range 13 to 42), Mixed, confidence: medium
In 2026, Uruguay scores 59 of 100 on a person's right to see, control and share their own health record: rank 27= of 198 countries (likely range 13 to 42), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (66, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is clinical AI governance (30, median 30).
Uruguayans can view their national health record online, limit who opens it and check who did, but it holds a minimum data set.
Scores: patient access to the full record 65; patient control and consent 66; privacy and security 57; connected care journey 60; protection from commercial use 52; clinician access at the point of care 58; research and trial consent 49; clinical AI governance 30.
Access: Ley 18.335 makes the patient the record's owner with a right to a copy, and the national Mi Historia Clinica Digital portal shows adult SNIS members the care events providers registered. Copies cost the patient, and the shared record is a minimum data set.
Control: By law a patient can block or limit access to their national record and see who opened it. Sharing is on by default, and the Health Ministry keeps its own right of access.
Key laws: Ley 18.335 (derechos de pacientes y usuarios) (2008); Ley 18.331 (proteccion de datos personales) (2008).
Brief and every source: https://healthrecordrights.com/brief/URY/

### Slovakia (SVK): 58/100, rank 33 of 198 (likely range 16 to 45), Mixed, confidence: medium
In 2026, Slovakia scores 58 of 100 on a person's right to see, control and share their own health record: rank 33 of 198 countries (likely range 16 to 45), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is connected care journey (66, against a median of 38 across 198 countries); its weakest is research and trial consent (45, median 46).
Slovaks can read a national e-health record and see every access, but cannot opt out of clinician sharing, and login needs a chip ID card.
Scores: patient access to the full record 62; patient control and consent 50; privacy and security 58; connected care journey 66; protection from commercial use 58; clinician access at the point of care 60; research and trial consent 45; clinical AI governance 50.
Access: The law gives patients the right to see their whole record without delay, and the national electronic health book (EZK) is online through the National Health Portal. Login needs a chip ID card with an activated e-signature, minors cannot log in, and usage figures were not verified.
Control: Patients can see who opened their EZK, when and in what role, and can grant and withdraw extra access. Providers share records without consent by law, and we found no general opt-out from clinician access.
Key laws: Act No. 153/2013 on the National Health Information System (2013); Act No. 576/2004 on Health Care (2004).
Brief and every source: https://healthrecordrights.com/brief/SVK/

### Andorra (AND): 57/100, rank 34= of 198 (likely range 16 to 45), Mixed, confidence: medium
In 2026, Andorra scores 57 of 100 on a person's right to see, control and share their own health record: rank 34= of 198 countries (likely range 16 to 45), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinician access at the point of care (64, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is clinical AI governance (30, median 30).
Andorra's single shared record links almost all care and patients can read results in an app, but opting out is hard and fines are low.
Scores: patient access to the full record 62; patient control and consent 55; privacy and security 54; connected care journey 66; protection from commercial use 56; clinician access at the point of care 64; research and trial consent 50; clinical AI governance 30.
Access: Llei 20/2017 gives a right to the whole record, with copies within five working days. The national Andorra Salut app shows reports, test results and vaccinations, but it needs a digital certificate and has about 25,000 users.
Control: The law lets a patient block clinicians' direct access to the shared record and get a log of every access within 15 working days. The log comes only on request, and in 2019 patients asking to leave were told no real alternative existed.
Key laws: Llei 20/2017 de drets i deures dels usuaris i dels professionals del sistema sanitari i sobre la història clínica (2017); Llei 29/2021 qualificada de protecció de dades personals (2021).
Brief and every source: https://healthrecordrights.com/brief/AND/

### Armenia (ARM): 57/100, rank 34= of 198 (likely range 17 to 46), Mixed, confidence: medium
In 2026, Armenia scores 57 of 100 on a person's right to see, control and share their own health record: rank 34= of 198 countries (likely range 17 to 46), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (70, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (46, median 46).
Armenia's single national e-health system lets patients approve, block and audit each doctor's access, but many state bodies can see records without consent.
Scores: patient access to the full record 62; patient control and consent 70; privacy and security 50; connected care journey 62; protection from commercial use 50; clinician access at the point of care 48; research and trial consent 46; clinical AI governance 40.
Access: The law gives patients a right to see and copy their medical files, and the ArMed portal shows diagnoses, services and tests entered by clinics. How complete the portal is for privately paid care was not verified.
Control: Since 31 December 2025 a doctor sees a patient's wider history only after the patient approves the request in the ArMed site or app, choosing full history, a summary or listed diagnoses. Consent can be revoked, and patients see every viewing.
Key laws: Law on Medical Assistance and Service of the Population (HO-42) (1996); Law on Protection of Personal Data (HO-49-N) (2015).
Brief and every source: https://healthrecordrights.com/brief/ARM/

### Czechia (CZE): 57/100, rank 34= of 198 (likely range 16 to 46), Mixed, confidence: medium
In 2026, Czechia scores 57 of 100 on a person's right to see, control and share their own health record: rank 34= of 198 countries (likely range 16 to 46), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (64, against a median of 30 across 198 countries); its weakest is research and trial consent (45, median 46).
Czechia added an opt-out shared record and the EZKarta app in 2026, but the record is still thin and research use needs no consent.
Scores: patient access to the full record 60; patient control and consent 64; privacy and security 56; connected care journey 55; protection from commercial use 60; clinician access at the point of care 52; research and trial consent 45; clinical AI governance 50.
Access: Patients have a legal right to copy their records, and the first copy has been free since 1 October 2024. The EZKarta app shows labs, prescriptions, vaccinations and some hospital documents, but it is still partial, with about 34,000 daily users.
Control: Clinicians can see the shared health record and the medication record unless the patient objects, and patients can allow named doctors only. The medication record shows patients who viewed it; an access log for the newer shared record was not verified.
Key laws: General Data Protection Regulation (EU) 2016/679 (2016); Act 110/2019 Sb. on Personal Data Processing (2019).
Brief and every source: https://healthrecordrights.com/brief/CZE/

### Greece (GRC): 57/100, rank 34= of 198 (likely range 17 to 46), Mixed, confidence: low
Weak evidence in 4 of 8 categories: control, commercial, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Greece scores 57 of 100 on a person's right to see, control and share their own health record: rank 34= of 198 countries (likely range 17 to 46), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is connected care journey (62, against a median of 38 across 198 countries); its weakest is research and trial consent (44, median 46).
Greece put one national record in every patient's phone in 2025, but hospital archives are not yet digitised and per-doctor consent is unclear.
Scores: patient access to the full record 66; patient control and consent 46; privacy and security 56; connected care journey 62; protection from commercial use 62; clinician access at the point of care 58; research and trial consent 44; clinical AI governance 54.
Access: Since May 2025 the national record (EHFY) shows diagnoses, prescriptions, test results and hospital stays in the MyHealth app and citizen portal. The EC still ranks Greece below the EU average, with no imaging reports in its 2024 data.
Control: Greek law logs every access to the record and lets the patient be told who looked and when. The 2019 law only requires that patients be informed of clinician access; a per-doctor consent or opt-out in the live platform is not verified.
Key laws: Law 4600/2019, Article 84 (Individual Electronic Health Record) (2019); Law 3892/2010 (electronic prescriptions and referrals) (2010).
Brief and every source: https://healthrecordrights.com/brief/GRC/

### Japan (JPN): 56/100, rank 38= of 198 (likely range 19 to 48), Mixed, confidence: high
In 2026, Japan scores 56 of 100 on a person's right to see, control and share their own health record: rank 38= of 198 countries (likely range 19 to 48), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (62, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Japanese patients see five years of claims-based records online and choose at each visit what doctors see, but full charts stay with each provider.
Scores: patient access to the full record 62; patient control and consent 62; privacy and security 58; connected care journey 48; protection from commercial use 50; clinician access at the point of care 52; research and trial consent 50; clinical AI governance 60.
Access: The privacy law gives a right to a copy, electronic on request, and Mynaportal shows five years of claims-based treatment and medicine data. The law sets no fixed deadline and allows fees, so full charts still come provider by provider.
Control: At each visit the patient chooses, item by item, whether the clinic may see past treatment, medicine and checkup data, and Mynaportal lists who received it. Hospital viewing without consent in emergencies, even for conscious patients, keeps the score low in its band.
Key laws: Act on the Protection of Personal Information (APPI) (2003); Act amending the APPI (2026) (2026).
Brief and every source: https://healthrecordrights.com/brief/JPN/

### Romania (ROU): 56/100, rank 38= of 198 (likely range 20 to 48), Mixed, confidence: low
Weak evidence in 5 of 8 categories: access, control, privacy, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Romania scores 56 of 100 on a person's right to see, control and share their own health record: rank 38= of 198 countries (likely range 20 to 48), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (62, against a median of 30 across 198 countries); its weakest is research and trial consent (44, median 46).
Romania opened a national patient portal on 1 September 2026 with 10 years of history, but the older e-health record was largely empty.
Scores: patient access to the full record 60; patient control and consent 62; privacy and security 50; connected care journey 60; protection from commercial use 56; clinician access at the point of care 50; research and trial consent 44; clinical AI governance 50.
Access: Since 1 September 2026 the CNAS portal eSanatateaMea shows insured people their medical history from the last 10 years and prescriptions from the last 5. Score sits at the bottom of the portal band because the launch is staged and the earlier record was largely empty.
Control: The law lets patients choose which doctors can open their e-health record, see the full history of doctor access, and refuse the record without losing care. Whether the new portal offers these controls in practice was not verified.
Key laws: General Data Protection Regulation (EU) 2016/679 (2016); Law 190/2018 implementing the GDPR (2018).
Brief and every source: https://healthrecordrights.com/brief/ROU/

### Cyprus (CYP): 55/100, rank 40= of 198 (likely range 24 to 51), Mixed, confidence: medium
In 2026, Cyprus scores 55 of 100 on a person's right to see, control and share their own health record: rank 40= of 198 countries (likely range 24 to 51), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is patient access to the full record (64, against a median of 43 across 198 countries); its weakest is research and trial consent (45, median 46).
Cyprus wrote strong patient controls into its 2019 eHealth law, but the national record those controls govern is not due until 2029.
Scores: patient access to the full record 64; patient control and consent 46; privacy and security 58; connected care journey 58; protection from commercial use 54; clinician access at the point of care 55; research and trial consent 45; clinical AI governance 50.
Access: The eHealth law and GDPR give a right to see and copy the record, and the GeSY portal shows prescriptions, referrals, diagnoses and visits. The Commission's 2025 eHealth indicator study scored Cyprus 75% for 2024, against an EU average of 83%.
Control: The GeSY portal shows patients which health professionals viewed their history. Opt-out, data locking and per-provider permissions are in the 2019 law, but they belong to a national record bank that is not yet built.
Key laws: Electronic Health Law of 2019, 59(I)/2019 (amended 176(I)/2025) (2019); Law 125(I)/2018 on processing of personal data (2018).
Brief and every source: https://healthrecordrights.com/brief/CYP/

### San Marino (SMR): 55/100, rank 40= of 198 (likely range 23 to 50), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, control, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, San Marino scores 55 of 100 on a person's right to see, control and share their own health record: rank 40= of 198 countries (likely range 23 to 50), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient access to the full record (70, against a median of 43 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (46, median 46).
Over 90% of San Marino residents hold an online record from the single public health service, but rules on sharing and secondary use stay general.
Scores: patient access to the full record 70; patient control and consent 55; privacy and security 52; connected care journey 56; protection from commercial use 50; clinician access at the point of care 48; research and trial consent 46; clinical AI governance 40.
Access: Law 171/2018 gives a free right of access within one month, and the health secretariat says over 90% of citizens have an electronic health record (FSE). It shows reports, discharge letters, prescriptions and vaccinations, but full clinical notes and export were not verified.
Control: Patients sign a consent form to open their FSE, and the ISS says every access is logged and can be checked by the owner. We found no way to hide documents or pick clinicians, so the score sits at the top of the 40 to 55 band.
Key laws: Legge 21 dicembre 2018 n.171 (data protection) (2018); Legge 30 giugno 2021 n.122 (good clinical practice) (2021).
Brief and every source: https://healthrecordrights.com/brief/SMR/

### Serbia (SRB): 55/100, rank 40= of 198 (likely range 23 to 51), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, journey, clinical and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Serbia scores 55 of 100 on a person's right to see, control and share their own health record: rank 40= of 198 countries (likely range 23 to 51), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (60, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (46, median 46).
Serbs can see labs, scans and an access log in the eZdravlje portal, but the central eKarton began in 2026 and private care sits outside.
Scores: patient access to the full record 62; patient control and consent 60; privacy and security 46; connected care journey 64; protection from commercial use 46; clinician access at the point of care 55; research and trial consent 46; clinical AI governance 40.
Access: Serbian law gives a right to see and copy the medical record, and the state eZdravlje portal shows doctors' reports, lab results, radiology images and e-prescriptions. Only 1,778,802 people had registered by May 2025, and some institutions' data is missing, so the score sits low in the portal band.
Control: Only the chosen doctor, referred specialists and emergency staff may open the eKarton by law; other clinicians need the patient's consent, and the portal logs every access. No way to block the chosen doctor was found, so the score sits at the band's bottom.
Key laws: Zakon o pravima pacijenata (Sl. glasnik RS 45/2013) (2013); Zakon o zastiti podataka o licnosti (Sl. glasnik RS 87/2018) (2018).
Brief and every source: https://healthrecordrights.com/brief/SRB/

### United Arab Emirates (ARE): 55/100, rank 40= of 198 (likely range 23 to 54), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, control, journey and commercial. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, the United Arab Emirates scores 55 of 100 on a person's right to see, control and share their own health record: rank 40= of 198 countries (likely range 23 to 54), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is connected care journey (80, against a median of 38 across 198 countries); its weakest is patient access to the full record (35, median 43).
Each emirate runs its own shared record with near-universal reach, but patient copy rights and opt-outs come from emirate regulators, not federal law.
Scores: patient access to the full record 35; patient control and consent 48; privacy and security 50; connected care journey 80; protection from commercial use 56; clinician access at the point of care 76; research and trial consent 46; clinical AI governance 64.
Access: No federal law gives patients a right to a copy of their record; the right sits in Abu Dhabi and Dubai regulator standards. Three government portals show part of the record by region, which lifts the cell to the top of its band (35) and no further.
Control: Each emirate has a different rule: Riayati lets Northern Emirates patients opt out and promises access notices, Dubai's NABIDH takes opt-outs by signed form, and Abu Dhabi's Malaffi makes participation universal. The blend sits mid-band at 48.
Key laws: Federal Law No. 2 of 2019 on the Use of ICT in Health Fields (2019); Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (2021).
Brief and every source: https://healthrecordrights.com/brief/ARE/

### Costa Rica (CRI): 54/100, rank 44= of 198 (likely range 27 to 55), Mixed, confidence: medium
In 2026, Costa Rica scores 54 of 100 on a person's right to see, control and share their own health record: rank 44= of 198 countries (likely range 27 to 55), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (65, against a median of 34 across 198 countries); its weakest is privacy and security (40, median 45).
Costa Rica runs one national digital record (EDUS) across public care; patients can view and share parts of it but cannot opt out.
Scores: patient access to the full record 64; patient control and consent 48; privacy and security 40; connected care journey 68; protection from commercial use 52; clinician access at the point of care 65; research and trial consent 45; clinical AI governance 30.
Access: Ley 8239 gives a right to a copy, and the EDUS app lets patients download an authenticated copy showing diagnoses, medicines, allergies and visits, not the full chart. App usage was not verified, so the score sits in the lower half of the portal band.
Control: EDUS data is collected without patient consent and is visible to any CCSS user with the right access level, with no opt-out. Every action is logged, and a patient can ask their clinic for a certified access record.
Key laws: Ley 8239 (derechos y deberes de las personas usuarias de los servicios de salud) (2002); Ley 8968 (proteccion de la persona frente al tratamiento de sus datos personales) (2011).
Brief and every source: https://healthrecordrights.com/brief/CRI/

### Switzerland (CHE): 54/100, rank 44= of 198 (likely range 28 to 57), Mixed, confidence: medium
In 2026, Switzerland scores 54 of 100 on a person's right to see, control and share their own health record: rank 44= of 198 countries (likely range 28 to 57), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (60, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is connected care journey (40, median 38).
Swiss patients have a free right to their whole record, but the optional e-dossier reached only 136,076 people, so Parliament is building an opt-out replacement.
Scores: patient access to the full record 55; patient control and consent 60; privacy and security 60; connected care journey 40; protection from commercial use 58; clinician access at the point of care 38; research and trial consent 66; clinical AI governance 56.
Access: The data protection act gives a free copy of the whole record, normally within 30 days, and an official national portal exists. Most people still ask each doctor or hospital, because the portal (the e-dossier, EPD) is optional: only 136,076 were open by end of April 2026.
Control: Inside the EPD the patient opens it by explicit consent, picks which professionals see what, can block named providers and reads an access log. Few people hold one, so for most patients control rests on doctors' professional secrecy.
Key laws: Bundesgesetz über den Datenschutz (DSG) (2020); Bundesgesetz über das elektronische Patientendossier (EPDG) (2015).
Brief and every source: https://healthrecordrights.com/brief/CHE/

### Saudi Arabia (SAU): 53/100, rank 46 of 198 (likely range 30 to 57), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, control, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Saudi Arabia scores 53 of 100 on a person's right to see, control and share their own health record: rank 46 of 198 countries (likely range 30 to 57), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is connected care journey (70, against a median of 38 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (46, median 46).
A national record links over 30 million people and Sehhaty shows much of it, but patients have no working say over sharing.
Scores: patient access to the full record 64; patient control and consent 32; privacy and security 50; connected care journey 70; protection from commercial use 54; clinician access at the point of care 54; research and trial consent 46; clinical AI governance 58.
Access: The PDPL gives a right to a copy in a common electronic format within 30 days, and Sehhaty passed 31 million users in 2025. How much of the full chart it displays was not verified, so the cell sits low in its band.
Control: Data flows into the national record by default and no live opt-out was found, so a 2015 policy's opt-out earns nothing. The cell sits at 32, above Egypt's 25, because the PDPL regulation gives that policy force and consent-withdrawal rights exist on paper.
Key laws: Personal Data Protection Law (Royal Decree M/19, amended by M/148) (2021); Implementing Regulation of the Personal Data Protection Law (2023).
Brief and every source: https://healthrecordrights.com/brief/SAU/

### Brazil (BRA): 52/100, rank 47= of 198 (likely range 33 to 61), Mixed, confidence: medium
In 2026, Brazil scores 52 of 100 on a person's right to see, control and share their own health record: rank 47= of 198 countries (likely range 33 to 61), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (57, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Brazil's national network holds over 5 billion health records and patients can see part of theirs, but the state decides who else sees them.
Scores: patient access to the full record 62; patient control and consent 35; privacy and security 58; connected care journey 55; protection from commercial use 55; clinician access at the point of care 50; research and trial consent 50; clinical AI governance 57.
Access: LGPD gives a free right of access with a 15-day deadline, and the national Meu SUS Digital app shows vaccines, exam results, medicines and visit records. It is a partial record: no export was found and patients cannot correct entries themselves.
Control: Decree 12,560/2025 puts the Ministry of Health in charge of the RNDS and limits clinician access to the care context, but sets no patient consent switch. A published notice offering an opt-out from clinician viewing could not be verified as working today.
Key laws: Lei Geral de Proteção de Dados (Lei 13.709) (2018); Decreto 12.560 (RNDS and SUS Digital platforms) (2025).
Brief and every source: https://healthrecordrights.com/brief/BRA/

### Canada (CAN): 52/100, rank 47= of 198 (likely range 33 to 60), Mixed, confidence: high
In 2026, Canada scores 52 of 100 on a person's right to see, control and share their own health record: rank 47= of 198 countries (likely range 33 to 60), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinical AI governance (56, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is protection from commercial use (45, median 45).
Provinces grant record access and Quebec and Ontario allow blocking, but records stop at provincial borders and only 13% see core records online.
Scores: patient access to the full record 50; patient control and consent 55; privacy and security 58; connected care journey 50; protection from commercial use 45; clinician access at the point of care 55; research and trial consent 49; clinical AI governance 56.
Access: Provincial laws give a right to a copy, and the largest provinces run portals with labs and medications. But in 2025 only 13% of adults could see test results, vaccines and medication history online, and Quebec holds results back 30 days.
Control: Control depends on the province. Quebec lets patients block named providers or categories from chosen items and shows an access log in Carnet santé, while Ontario cut its EHR blocks to whole repositories in February 2026 and gives logs only on request.
Key laws: Personal Information Protection and Electronic Documents Act (PIPEDA) (2000); Personal Health Information Protection Act (PHIPA), Ontario (2004).
Brief and every source: https://healthrecordrights.com/brief/CAN/

### Thailand (THA): 52/100, rank 47= of 198 (likely range 36 to 64), Mixed, confidence: medium
In 2026, Thailand scores 52 of 100 on a person's right to see, control and share their own health record: rank 47= of 198 countries (likely range 36 to 64), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinical AI governance (55, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is protection from commercial use (45, median 45).
Thais can choose which hospitals share their records through Health Link, but sign-up is optional and ministry data flows without a choice.
Scores: patient access to the full record 50; patient control and consent 50; privacy and security 55; connected care journey 57; protection from commercial use 45; clinician access at the point of care 50; research and trial consent 50; clinical AI governance 55.
Access: The PDPA gives a right to a copy within 30 days, and Health Link on the Paotang and Tang Rat apps lets opted-in users see treatment and claims history. Only about 30,129 people had viewed records on Tang Rat by April 2026, and hospitals charge for copies.
Control: Health Link is opt-in: a person chooses which hospitals may share, some hospitals ask for consent each time, and consent can be withdrawn at any time. Ministry of Public Health data flows to its cloud without a verified choice, and no patient-visible access log was verified.
Key laws: Personal Data Protection Act B.E. 2562 (2019); National Health Act B.E. 2550 (2007).
Brief and every source: https://healthrecordrights.com/brief/THA/

### Georgia (GEO): 51/100, rank 50 of 198 (likely range 36 to 65), Mixed, confidence: medium
In 2026, Georgia scores 51 of 100 on a person's right to see, control and share their own health record: rank 50 of 198 countries (likely range 36 to 65), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (60, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is privacy and security (45, median 45).
Georgia's ministry-owned health record lets patients hide episodes by law, but the auditor found half of selected state-programme cases missing and the data regulator abolished.
Scores: patient access to the full record 55; patient control and consent 60; privacy and security 45; connected care journey 52; protection from commercial use 45; clinician access at the point of care 52; research and trial consent 46; clinical AI governance 35.
Access: Patients may see their records and get a free copy within 10 working days. A national patient page exists, but the state auditor found low awareness and half of state-programme cases missing; portal usage is not verified.
Control: The EHR order lets patients hide or share each episode, unlock hidden data by SMS code and see processing logs. But records are shared with all authorised doctors by default, and a December 2025 law ordered a state mental health database without a consent step.
Key laws: Law of Georgia on Patient Rights (2000); Law of Georgia on Health Care (1997).
Brief and every source: https://healthrecordrights.com/brief/GEO/

### Mongolia (MNG): 50/100, rank 51= of 198 (likely range 41 to 71), Mixed, confidence: low
Weak evidence in 5 of 8 categories: access, control, commercial, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Mongolia scores 50 of 100 on a person's right to see, control and share their own health record: rank 51= of 198 countries (likely range 41 to 71), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient access to the full record (60, against a median of 43 across 198 countries); no right falls below the median, and the closest to it is protection from commercial use (45, median 45).
Mongolian law requires consent and notices when health data moves, but the national exchange is still being built and usage is unproven.
Scores: patient access to the full record 60; patient control and consent 47; privacy and security 48; connected care journey 54; protection from commercial use 45; clinician access at the point of care 47; research and trial consent 50; clinical AI governance 30.
Access: The Personal Data Protection Law gives a right to a free electronic copy of one's data, and the Ministry said in 2021 that E-Mongolia shows lab results. No full national chart was found, and how many people view lab results there was not verified.
Control: Health providers must get consent under the Personal Data Protection Law when they first collect data and before passing it to another provider, and patients are to be notified of transfers. Granular choices and whether health notices reach patients in practice were not verified.
Key laws: Law on Personal Data Protection (2021); Law on Health (2011).
Brief and every source: https://healthrecordrights.com/brief/MNG/

### Qatar (QAT): 50/100, rank 51= of 198 (likely range 40 to 72), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, journey, clinical and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Qatar scores 50 of 100 on a person's right to see, control and share their own health record: rank 51= of 198 countries (likely range 40 to 72), in the Mixed band (45 to 64). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is clinician access at the point of care (54, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is patient control and consent (30, median 30).
Qatar's privacy law gives a right to a copy and the public portal shows key results, but patients get few sharing controls.
Scores: patient access to the full record 60; patient control and consent 30; privacy and security 54; connected care journey 57; protection from commercial use 52; clinician access at the point of care 54; research and trial consent 50; clinical AI governance 40.
Access: The 2016 privacy law gives a right to a copy of personal data for a fee capped at service cost, and the free public MyHealth portal shows reports, labs, medicines and vaccines from HMC and PHCC. How many residents use it was not verified.
Control: Decision 9 of 2022 bars anyone outside care from seeing the file without the patient's consent, except on a court or prosecution order. No sharing opt-out and no patient-visible access log were verified.
Key laws: Law No. 13 of 2016 on Personal Data Privacy Protection (2016); Minister of Public Health Decision No. 9 of 2022 on patients' rights (2022).
Brief and every source: https://healthrecordrights.com/brief/QAT/

### Kenya (KEN): 49/100, rank 53= of 198 (likely range 43 to 74), Mixed, confidence: low
Weak evidence in 5 of 8 categories: access, control, journey, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Kenya scores 49 of 100 on a person's right to see, control and share their own health record: rank 53= of 198 countries (likely range 43 to 74), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinical AI governance (48, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is research and trial consent (50, median 46).
Kenya's rules promise patients a national record with alerts, logs and consent, but the live system is young, claims-driven and leaky.
Scores: patient access to the full record 55; patient control and consent 44; privacy and security 55; connected care journey 45; protection from commercial use 52; clinician access at the point of care 42; research and trial consent 50; clinical AI governance 48.
Access: The 2021 data protection rules make a copy free and due within 7 days, and the Digital Health Agency runs a national portal, Afyangu, showing visits, prescriptions and results. No official figure shows most people use it, so the cell stops at 55.
Control: Every visit is copied to a national Shared Health Record, but the rules require client authorisation, an alert on each look-up and an access log. A May 2026 fake entry posted with no alert shows these controls are not yet reliable.
Key laws: Data Protection Act No. 24 of 2019 (2019); Data Protection (General) Regulations 2021 (2021).
Brief and every source: https://healthrecordrights.com/brief/KEN/

### Ukraine (UKR): 49/100, rank 53= of 198 (likely range 43 to 77), Mixed, confidence: medium
In 2026, Ukraine scores 49 of 100 on a person's right to see, control and share their own health record: rank 53= of 198 countries (likely range 43 to 77), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The person has real controls inside a state or provider system. Its strongest right against the other countries is connected care journey (62, against a median of 38 across 198 countries); its weakest is protection from commercial use (40, median 45).
Ukraine's national e-health system holds records on 34.6 million people, but patients still cannot see their own medical data in the state portal.
Scores: patient access to the full record 46; patient control and consent 50; privacy and security 42; connected care journey 62; protection from commercial use 40; clinician access at the point of care 58; research and trial consent 44; clinical AI governance 40.
Access: The law gives patients a right to see their medical documents and to get their personal data within 30 days, but the national patient cabinet shows only personal data and doctor declarations. Some private apps show part of the record.
Control: The law says access to a patient's e-health data needs consent, and patients approve other doctors by SMS code. But signing a family doctor declaration counts as blanket consent, and no patient-visible access log was found.
Key laws: Fundamentals of Ukrainian Health Legislation (No. 2801-XII) (1992); Law on Personal Data Protection (No. 2297-VI) (2010).
Brief and every source: https://healthrecordrights.com/brief/UKR/

### Argentina (ARG): 48/100, rank 55= of 198 (likely range 46 to 81), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, control, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Argentina scores 48 of 100 on a person's right to see, control and share their own health record: rank 55= of 198 countries (likely range 46 to 81), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (48, against a median of 30 across 198 countries); its weakest is privacy and security (42, median 45).
Argentine law makes patients owners of their record, and a national app lets people refuse network sharing, but the network is still young.
Scores: patient access to the full record 60; patient control and consent 48; privacy and security 42; connected care journey 45; protection from commercial use 45; clinician access at the point of care 42; research and trial consent 49; clinical AI governance 40.
Access: Ley 26.529 makes the patient the owner of the clinical record, with an authenticated copy due within 48 hours. The Mi Argentina app shows vaccines, 60 days of e-prescriptions and records from connected facilities, not the full chart; usage figures were not verified.
Control: Official pages say facilities on the national network can see a record unless the person explicitly refuses, using privacy settings in Mi Argentina. A patient-visible access log is described only as design intent; use of the opt-out was not verified.
Key laws: Ley 26.529 (derechos del paciente, historia clinica y consentimiento informado) (2009); Ley 25.326 (proteccion de los datos personales) (2000).
Brief and every source: https://healthrecordrights.com/brief/ARG/

### Azerbaijan (AZE): 48/100, rank 55= of 198 (likely range 46 to 82), Mixed, confidence: low
Weak evidence in 7 of 8 categories: access, control, privacy, journey, commercial, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Azerbaijan scores 48 of 100 on a person's right to see, control and share their own health record: rank 55= of 198 countries (likely range 46 to 82), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is connected care journey (60, against a median of 38 across 198 countries); its weakest is privacy and security (40, median 45).
Azerbaijanis can download labs, scans and discharge summaries on the state mygov portal, but no patient control over who sees the health record was verified.
Scores: patient access to the full record 60; patient control and consent 40; privacy and security 40; connected care journey 60; protection from commercial use 40; clinician access at the point of care 50; research and trial consent 46; clinical AI governance 30.
Access: The 1997 public health law gives a right to see medical documents and get copies on request, and the mygov portal shows lab results, scan reports, prescriptions and discharge summaries as PDFs. How many people use its health section was not verified.
Control: mygov lets people grant and revoke consent for companies to pull their data and shows every request. No opt-out or patient-visible access log for the clinical record itself was verified, so the score sits at the bottom of the 40 to 55 band.
Key laws: Law No. 360-IQ on Protection of Public Health (1997); Law No. 998-IIIQ on Personal Data (2010).
Brief and every source: https://healthrecordrights.com/brief/AZE/

### Kazakhstan (KAZ): 48/100, rank 55= of 198 (likely range 45 to 80), Mixed, confidence: low
Weak evidence in 6 of 8 categories: access, control, privacy, commercial, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Kazakhstan scores 48 of 100 on a person's right to see, control and share their own health record: rank 55= of 198 countries (likely range 45 to 80), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (48, against a median of 30 across 198 countries); its weakest is privacy and security (38, median 45).
Kazakh law promises consent and an access log for health data, but the state collects records centrally and its systems are still being joined up.
Scores: patient access to the full record 60; patient control and consent 46; privacy and security 38; connected care journey 50; protection from commercial use 40; clinician access at the point of care 48; research and trial consent 49; clinical AI governance 48.
Access: Article 61 of the Health Code gives a right to see one's data in the National Electronic Health Passport, and eGov's eDensaulyq shows prescriptions, hospital stays and referrals. The Ministry said in December 2025 the passport still holds limited data; usage was not verified.
Control: The Health Code says providers may access a person's medical data only with consent and gives a right to track an access log. But data must flow to the national health passport without consent, and whether patients can actually see the log was not verified.
Key laws: Code On Public Health and the Healthcare System (No. 360-VI) (2020); Law On Personal Data and Their Protection (No. 94-V) (2013).
Brief and every source: https://healthrecordrights.com/brief/KAZ/

### New Zealand (NZL): 48/100, rank 55= of 198 (likely range 46 to 82), Mixed, confidence: high
In 2026, New Zealand scores 48 of 100 on a person's right to see, control and share their own health record: rank 55= of 198 countries (likely range 46 to 82), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is patient control and consent (47, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is connected care journey (40, median 38).
New Zealanders get records free from public agencies, but the national shared record is not live and a 2025 portal hack exposed nearly 100,000 patients.
Scores: patient access to the full record 55; patient control and consent 47; privacy and security 50; connected care journey 40; protection from commercial use 52; clinician access at the point of care 40; research and trial consent 50; clinical AI governance 40.
Access: The health privacy code gives a right to your records within 20 working days, free from public agencies. The national My Health Record shows only immunisations, COVID-19 results and some identity details; fuller views sit in private GP portals.
Control: Today choices are narrow: people can restrict their national immunisation record, and some regional shared records allow opt-out. The national Shared Digital Health Record, with opt-out, item blocking and access summaries, has not started sharing.
Key laws: Privacy Act 2020 (2020); Health Information Privacy Code 2020 (2020).
Brief and every source: https://healthrecordrights.com/brief/NZL/

### United States (USA): 48/100, rank 55= of 198 (likely range 45 to 80), Mixed, confidence: high
In 2026, the United States scores 48 of 100 on a person's right to see, control and share their own health record: rank 55= of 198 countries (likely range 45 to 80), in the Mixed band (45 to 64). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is clinical AI governance (56, against a median of 30 across 198 countries); its weakest is protection from commercial use (38, median 45).
Americans have an enforced legal right to copies of their records, but providers and insurers decide most sharing, and health apps sit outside HIPAA.
Scores: patient access to the full record 50; patient control and consent 35; privacy and security 50; connected care journey 60; protection from commercial use 38; clinician access at the point of care 55; research and trial consent 49; clinical AI governance 56.
Access: HIPAA gives a right to the whole designated record set within 30 days at a cost-based fee, and OCR has brought 55 right of access enforcement actions. There is no national record: 65% used a portal in 2024, and 59% had more than one.
Control: HIPAA lets providers and plans share records for treatment, payment and operations without consent, and they may refuse restriction requests. A block on items paid in full and a six-year disclosure log that omits routine sharing put the cell at the top of its band.
Key laws: HIPAA Privacy Rule, right of access (45 CFR 164.524) (2000); 42 CFR Part 2, substance use disorder records final rule (2024).
Brief and every source: https://healthrecordrights.com/brief/USA/

### Bahrain (BHR): 47/100, rank 60= of 198 (likely range 47 to 85), Mixed, confidence: low
Weak evidence in 6 of 8 categories: access, control, privacy, journey, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Bahrain scores 47 of 100 on a person's right to see, control and share their own health record: rank 60= of 198 countries (likely range 47 to 85), in the Mixed band (45 to 64). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is clinical AI governance (50, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is patient control and consent (30, median 30).
Bahrain's privacy regulator now fines clinics for leaking health data, but patients get reports, not their chart, and have no say in record sharing.
Scores: patient access to the full record 50; patient control and consent 30; privacy and security 56; connected care journey 50; protection from commercial use 50; clinician access at the point of care 52; research and trial consent 50; clinical AI governance 50.
Access: The data protection law gives a free right to be told, within 15 working days, all personal data a controller holds. In practice the Sehati app offers medical reports, certificates and vaccination records, not the full chart.
Control: Health ministry rules limit reading a record to staff directly involved in care or quality checks, and others need written authorization. No opt-out from record sharing and no patient-visible access log were found.
Key laws: Law No. (30) of 2018 with Respect to Personal Data Protection (2018); Decree No. (78) of 2019 (2019).
Brief and every source: https://healthrecordrights.com/brief/BHR/

### El Salvador (SLV): 47/100, rank 60= of 198 (likely range 47 to 82), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, control, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, El Salvador scores 47 of 100 on a person's right to see, control and share their own health record: rank 60= of 198 countries (likely range 47 to 82), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (55, against a median of 34 across 198 countries); its weakest is privacy and security (42, median 45).
El Salvador gave patients new data rights in 2024 and a state AI telemedicine app in 2025, but public records are shared without individual choice.
Scores: patient access to the full record 50; patient control and consent 45; privacy and security 42; connected care journey 52; protection from commercial use 48; clinician access at the point of care 55; research and trial consent 46; clinical AI governance 35.
Access: The 2024 data law gives free access within 20 working days, and a 2026 ministry rule adds copies, summaries and export of the electronic record. No national portal shows the public record; the DoctorSV app shows only its own visits.
Control: Health data may be used for care without consent, and each person's digital record is open to all public providers, with no opt-out. Every access must be logged and the data law lets patients learn who consulted their data, but practice was not verified.
Key laws: Decreto 307, Ley de Deberes y Derechos de los Pacientes y Prestadores de Servicios de Salud (2016); Decreto 302, Ley del Sistema Nacional Integrado de Salud (2019).
Brief and every source: https://healthrecordrights.com/brief/SLV/

### Greenland (GRL): 47/100, rank 60= of 198 (likely range 46 to 85), Mixed, confidence: low
Weak evidence in 6 of 8 categories: access, control, privacy, journey, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Greenland scores 47 of 100 on a person's right to see, control and share their own health record: rank 60= of 198 countries (likely range 46 to 85), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (66, against a median of 34 across 198 countries); its weakest is patient access to the full record (30, median 43).
Greenlanders have a legal right to their record in one national system, but copies cost a fee, and no online record view was found.
Scores: patient access to the full record 30; patient control and consent 44; privacy and security 50; connected care journey 64; protection from commercial use 55; clinician access at the point of care 66; research and trial consent 49; clinical AI governance 20.
Access: A 2001 ordinance gives patients a right to see and copy their records, but a 2006 order makes them pay a fee for copies and the right covers only records from 1995 on. No national portal showing the record was found.
Control: The 2001 ordinance lets a patient refuse at any time that their data be passed to other health staff during a treatment course. How to use that right in the national record, and any patient-visible access log, were not verified.
Key laws: Landstingsforordning nr. 6 af 31. maj 2001 om patienters retsstilling (2001); Anordning nr. 1238 af 14. oktober 2016 (Personal Data Act for Greenland) (2016).
Brief and every source: https://healthrecordrights.com/brief/GRL/

### Indonesia (IDN): 47/100, rank 60= of 198 (likely range 48 to 84), Mixed, confidence: medium
In 2026, Indonesia scores 47 of 100 on a person's right to see, control and share their own health record: rank 60= of 198 countries (likely range 48 to 84), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (56, against a median of 30 across 198 countries); its weakest is privacy and security (38, median 45).
Indonesia's laws give patients rights to their records, but the ministry holds the data by default and the privacy regulator still does not exist.
Scores: patient access to the full record 55; patient control and consent 42; privacy and security 38; connected care journey 57; protection from commercial use 42; clinician access at the point of care 40; research and trial consent 49; clinical AI governance 56.
Access: The Health Law and the PDP Law give patients a right to their record data, with access due within 3 x 24 hours. SATUSEHAT Mobile shows a medical summary, not the full chart, and how widely it works was not verified.
Control: Every facility must open its electronic records to the health ministry, with no patient choice. A 6-digit consent code and a patient-visible access history arrived with SATUSEHAT RME, which is starting in stages at a few named facilities.
Key laws: Law 17/2023 on Health (2023); Law 27/2022 on Personal Data Protection (2022).
Brief and every source: https://healthrecordrights.com/brief/IDN/

### Ireland (IRL): 47/100, rank 60= of 198 (likely range 48 to 87), Mixed, confidence: high
In 2026, Ireland scores 47 of 100 on a person's right to see, control and share their own health record: rank 60= of 198 countries (likely range 48 to 87), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is research and trial consent (70, against a median of 46 across 198 countries); no right falls below the median, and the closest to it is patient control and consent (30, median 30).
Irish records are still largely paper, but a national Shared Care Record went live for clinicians in 2026; patient controls are legislated, not in force.
Scores: patient access to the full record 55; patient control and consent 30; privacy and security 56; connected care journey 38; protection from commercial use 58; clinician access at the point of care 36; research and trial consent 70; clinical AI governance 50.
Access: Patients have a free GDPR and FOI right to their whole record, but get it by writing to each hospital or service. The HSE Health App shows only part of the record (appointments, waiting lists, vaccines) and had about 125,000 registered users in January 2026.
Control: The new Shared Care Record shares data by default on a public interest basis, with no opt-out found and no patient-readable access log. Rights to restrict access and to be told who looked are in the Health Information Act 2026 but not commenced.
Key laws: Health Information Act 2026 (No. 10 of 2026) (2026); Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. 314/2018) (2018).
Brief and every source: https://healthrecordrights.com/brief/IRL/

### Kyrgyzstan (KGZ): 47/100, rank 60= of 198 (likely range 47 to 84), Mixed, confidence: medium
In 2026, Kyrgyzstan scores 47 of 100 on a person's right to see, control and share their own health record: rank 60= of 198 countries (likely range 47 to 84), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (55, against a median of 30 across 198 countries); its weakest is privacy and security (42, median 45).
Kyrgyz patients see visits, hospital stays and lab results in the Tunduk app, but clinics must send data to the state with no opt-out found.
Scores: patient access to the full record 60; patient control and consent 35; privacy and security 42; connected care journey 55; protection from commercial use 45; clinician access at the point of care 40; research and trial consent 49; clinical AI governance 55.
Access: Since February 2026 the Digital Code gives access to all a person's digital data within 7 working days, a copy only if the holder chooses. The Tunduk app shows visits, hospital stays and lab results, but private care is missing and usage was not verified.
Control: The Health Law ties consent for electronic records to consent to treatment, and clinics must send data to the state system. We found no opt-out and no access log patients can see, though only the family doctor can open the digital card.
Key laws: Law No. 14 on Health Protection of Citizens (2024); Digital Code of the Kyrgyz Republic (No. 178) (2025).
Brief and every source: https://healthrecordrights.com/brief/KGZ/

### Vietnam (VNM): 47/100, rank 60= of 198 (likely range 46 to 83), Mixed, confidence: high
In 2026, Vietnam scores 47 of 100 on a person's right to see, control and share their own health record: rank 60= of 198 countries (likely range 46 to 83), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (50, against a median of 30 across 198 countries); its weakest is privacy and security (42, median 45).
Vietnamese patients can download visit records in their ID app, but every facility must feed a national database with no opt-out.
Scores: patient access to the full record 60; patient control and consent 30; privacy and security 42; connected care journey 55; protection from commercial use 55; clinician access at the point of care 44; research and trial consent 50; clinical AI governance 50.
Access: Law 15/2023 lets patients read and copy their record on written request, and Decree 356 sets a 10-day deadline. VNeID shows visit summaries, labs and drugs as downloadable PDFs, but only 34 million people had one in September 2026, short of most residents.
Control: Decree 102/2025 makes every facility push records to the national health database and VNeID, with no article letting a patient opt out. Agency heads may release health data without consent for public interest, and no patient-visible access log was found.
Key laws: Law on Medical Examination and Treatment (15/2023/QH15) (2023); Law on Personal Data Protection (91/2025/QH15) (2025).
Brief and every source: https://healthrecordrights.com/brief/VNM/

### Belarus (BLR): 46/100, rank 67= of 198 (likely range 49 to 88), Mixed, confidence: high
In 2026, Belarus scores 46 of 100 on a person's right to see, control and share their own health record: rank 67= of 198 countries (likely range 49 to 88), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is connected care journey (55, against a median of 38 across 198 countries); its weakest is privacy and security (35, median 45).
Belarusians can keep their records out of the new state health system, but police and security bodies can obtain medical secrets without consent.
Scores: patient access to the full record 50; patient control and consent 45; privacy and security 35; connected care journey 55; protection from commercial use 45; clinician access at the point of care 50; research and trial consent 49; clinical AI governance 40.
Access: The Health Care Law lets patients read their records and get free extracts within 5 days, but not a copy of the whole record. A national patient portal opened in test mode in June 2026, and just over 2.2 million electronic cards existed in April.
Control: Patients have a legal right to refuse having medical secrets entered into the central health system, made on a written form at their clinic. Otherwise records flow without consent, and no access log that patients can view was found.
Key laws: Law No. 2435-XII on Health Care (1993); Law No. 99-Z on Personal Data Protection (2021).
Brief and every source: https://healthrecordrights.com/brief/BLR/

### Oman (OMN): 46/100, rank 67= of 198 (likely range 49 to 89), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, control, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Oman scores 46 of 100 on a person's right to see, control and share their own health record: rank 67= of 198 countries (likely range 49 to 89), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (56, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is patient control and consent (30, median 30).
Oman links every Ministry of Health record by civil number and shows it in the Shifa app, but patients get no opt-out.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 50; connected care journey 58; protection from commercial use 50; clinician access at the point of care 56; research and trial consent 46; clinical AI governance 42.
Access: The Ministry of Health's Shifa app shows medical records, history, medicines, tests and vaccinations from all ministry facilities. The data law's free copy right may not reach state hospitals (not verified), and an official report costs 3 to 5 rials.
Control: Al Shifa links every ministry record to the civil number by default, and we found no opt-out and no patient-visible access log. The data law requires explicit consent, but state bodies acting within their legal powers are exempt.
Key laws: Personal Data Protection Law (Royal Decree 6/2022) (2022); Executive Regulation of the PDPL (Ministerial Decision 34/2024) (2024).
Brief and every source: https://healthrecordrights.com/brief/OMN/

### Tonga (TON): 46/100, rank 67= of 198 (likely range 50 to 89), Mixed, confidence: low
Weak evidence in 5 of 8 categories: access, control, journey, clinical and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Tonga scores 46 of 100 on a person's right to see, control and share their own health record: rank 67= of 198 countries (likely range 50 to 89), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (60, against a median of 34 across 198 countries); its weakest is clinical AI governance (20, median 30).
Tonga runs one national health record in every facility and passed a health privacy law in 2025, but the Ministry enforces it on itself.
Scores: patient access to the full record 45; patient control and consent 42; privacy and security 45; connected care journey 58; protection from commercial use 40; clinician access at the point of care 60; research and trial consent 46; clinical AI governance 20.
Access: Section 57 of the Personal Health Information Protection Act 2025 gives a right to see and copy one's record, including in electronic form, with a reply due within 30 days. There is no patient portal, and custodians may charge cost-recovery fees.
Control: The 2025 Act lets patients revoke consent, tell custodians not to share, and flag sensitive information, but sharing for care runs on implied consent inside the Ministry's NHIS. Access is logged, yet no right for patients to see the log was found.
Key laws: Personal Health Information Protection Act 2025 (Act 31 of 2025) (2025); Privacy Act 2025 (Act 34 of 2025) (2025).
Brief and every source: https://healthrecordrights.com/brief/TON/

### Uzbekistan (UZB): 46/100, rank 67= of 198 (likely range 51 to 92), Mixed, confidence: low
Weak evidence in 7 of 8 categories: access, control, privacy, journey, commercial, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Uzbekistan scores 46 of 100 on a person's right to see, control and share their own health record: rank 67= of 198 countries (likely range 51 to 92), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (52, against a median of 34 across 198 countries); its weakest is privacy and security (38, median 45).
Uzbeks can open their e-medical card in the state DMED app, but the law promises only extracts and records flow without patient choice.
Scores: patient access to the full record 60; patient control and consent 30; privacy and security 38; connected care journey 55; protection from commercial use 40; clinician access at the point of care 52; research and trial consent 46; clinical AI governance 45.
Access: The 1996 health law gives a right to information and to extracts from medical records, not a full copy. Since April 2026 a Health Ministry order lets patients view and download their e-medical card, case history and e-prescriptions in the state DMED app.
Control: Health data moves between clinics through the state e-health system with no patient opt-out found. A December 2025 amendment added the social protection agency to the bodies that can get medical-secret data without consent.
Key laws: Law ZRU-547 On Personal Data (2019); Law 265-I On Protection of Citizens' Health (1996).
Brief and every source: https://healthrecordrights.com/brief/UZB/

### India (IND): 45/100, rank 71= of 198 (likely range 52 to 95), Mixed, confidence: low
Weak evidence in 5 of 8 categories: access, control, journey, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, India scores 45 of 100 on a person's right to see, control and share their own health record: rank 71= of 198 countries (likely range 52 to 95), in the Mixed band (45 to 64). Who holds the keys: Shared. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The person has real controls inside a state or provider system. Its strongest right against the other countries is clinical AI governance (55, against a median of 30 across 198 countries); its weakest is privacy and security (35, median 45).
India built an opt-in consent exchange linking 110 crore records, but the records are thin and its privacy law and regulator are not yet working.
Scores: patient access to the full record 55; patient control and consent 50; privacy and security 35; connected care journey 45; protection from commercial use 35; clinician access at the point of care 35; research and trial consent 46; clinical AI governance 55.
Access: A binding medical ethics regulation makes doctors issue records within 72 hours, and 96.43 crore ABHA accounts can view 110 crore linked records (August 2026). Linked records average about one per account, and the DPDP access right only gives a summary and starts in May 2027.
Control: ABDM shares records between providers only on the patient's revocable, time-bound consent, an opt-in choice that is live nationwide. Policy lets patients see their consents, but a log of each access was not verified, so the cell sits mid-band (40 to 55), level with Thailand.
Key laws: Digital Personal Data Protection Act, 2023 (2023); Digital Personal Data Protection Rules, 2025 (2025).
Brief and every source: https://healthrecordrights.com/brief/IND/

### Kuwait (KWT): 45/100, rank 71= of 198 (likely range 53 to 94), Mixed, confidence: low
Weak evidence in 5 of 8 categories: access, journey, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Kuwait scores 45 of 100 on a person's right to see, control and share their own health record: rank 71= of 198 countries (likely range 53 to 94), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is patient access to the full record (60, against a median of 43 across 198 countries); its weakest is privacy and security (42, median 45).
Kuwait's Salem app shows public-hospital results and prescriptions, but there is no general privacy law, no data regulator and no patient control over sharing.
Scores: patient access to the full record 60; patient control and consent 30; privacy and security 42; connected care journey 50; protection from commercial use 42; clinician access at the point of care 45; research and trial consent 50; clinical AI governance 42.
Access: Law 70 of 2020 gives patients a right to a medical report and copies of results, and the ministry's Salem app shows records, prescriptions, lab and radiology results from public hospitals. How many people use Salem was not verified.
Control: Law 70 lets the care team, facility administration and family share patient information as needed without asking, and no opt-out or patient-visible access log was found. The 2014 e-transactions law requires consent for disclosure, with many exceptions.
Key laws: Law No. 70 of 2020 on the Practice of Medicine and Patient Rights (2020); Law No. 20 of 2014 on Electronic Transactions (2014).
Brief and every source: https://healthrecordrights.com/brief/KWT/

### North Macedonia (MKD): 45/100, rank 71= of 198 (likely range 52 to 93), Mixed, confidence: medium
In 2026, North Macedonia scores 45 of 100 on a person's right to see, control and share their own health record: rank 71= of 198 countries (likely range 52 to 93), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is patient access to the full record (60, against a median of 43 across 198 countries); its weakest is privacy and security (42, median 45).
North Macedonia has run one national e-health system since 2013, but the state controls it, patients see only part, and auditors found weak security.
Scores: patient access to the full record 60; patient control and consent 28; privacy and security 42; connected care journey 52; protection from commercial use 48; clinician access at the point of care 50; research and trial consent 46; clinical AI governance 30.
Access: Patients have a legal right to see their medical file, and the national Moe Zdravje app shows referrals, prescriptions and vaccinations. Copies cost the real price, usage was not verified, and the minister says full record access comes with an upgrade planned for 2028 to 2029.
Control: The national record opens to any doctor during an exam, with no patient opt-out and no access history the patient can see. The Ministry and the Health Insurance Fund manage the data, and the 2026 strategy only plans a consent tool and access log.
Key laws: Law on Protection of Patients' Rights (2008); Law on Personal Data Protection (42/2020) (2020).
Brief and every source: https://healthrecordrights.com/brief/MKD/

### Peru (PER): 45/100, rank 71= of 198 (likely range 53 to 96), Mixed, confidence: low
Weak evidence in 4 of 8 categories: access, control, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Peru scores 45 of 100 on a person's right to see, control and share their own health record: rank 71= of 198 countries (likely range 53 to 96), in the Mixed band (45 to 64). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is clinical AI governance (56, against a median of 30 across 198 countries); its weakest is connected care journey (35, median 38).
Peruvian law makes patients authorise who sees their electronic record and bans its commercial use, but the national record network is still fragmented.
Scores: patient access to the full record 45; patient control and consent 44; privacy and security 50; connected care journey 35; protection from commercial use 55; clinician access at the point of care 34; research and trial consent 49; clinical AI governance 56.
Access: Patients may request a complete copy of their record within five working days, but they pay for it. The social insurer's app shows past visits, prescriptions and tests to its members only, and no national patient portal was verified.
Control: Ley 31750 says only professionals the patient has authorised may reach their record through the national register, and patients may flag sensitive data to restrict it. Whether these controls work in practice was not verified, and no patient-visible access log was found.
Key laws: Ley 29733, Ley de Proteccion de Datos Personales (2011); Decreto Supremo 016-2024-JUS (Reglamento de la Ley 29733) (2024).
Brief and every source: https://healthrecordrights.com/brief/PER/

### Russia (RUS): 45/100, rank 71= of 198 (likely range 54 to 97), Mixed, confidence: low
Weak evidence in 7 of 8 categories: access, control, privacy, commercial, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Russia scores 45 of 100 on a person's right to see, control and share their own health record: rank 71= of 198 countries (likely range 54 to 97), in the Mixed band (45 to 64). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (55, against a median of 30 across 198 countries); its weakest is privacy and security (34, median 45).
Russians can see 32 types of medical documents on the state portal, but the state system decides how records flow and police access is broad.
Scores: patient access to the full record 60; patient control and consent 30; privacy and security 34; connected care journey 55; protection from commercial use 40; clinician access at the point of care 45; research and trial consent 42; clinical AI governance 55.
Access: Federal Law 323-FZ gives patients the right to see their records and get copies, including electronically. The Gosuslugi portal shows 32 types of electronic documents, but how many people use it and how complete it is were not verified.
Control: Law 323-FZ lets clinics exchange records through state information systems for care without the patient's consent. The health regulator has said a patient's written refusal to send health data to the state system should be honoured, but no patient-visible access log was found.
Key laws: Federal Law 323-FZ on the Basics of Protecting Citizens' Health (2011); Federal Law 152-FZ on Personal Data (2006).
Brief and every source: https://healthrecordrights.com/brief/RUS/

### Bosnia and Herzegovina (BIH): 44/100, rank 76= of 198 (likely range 56 to 99), Weak, confidence: low
Weak evidence in 5 of 8 categories: access, control, privacy, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Bosnia and Herzegovina scores 44 of 100 on a person's right to see, control and share their own health record: rank 76= of 198 countries (likely range 56 to 99), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is clinician access at the point of care (42, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is clinical AI governance (30, median 30).
Bosnians gained GDPR-style data rights in October 2025, but health records are split between two entities, ten cantons and Brcko, with no countrywide e-health.
Scores: patient access to the full record 50; patient control and consent 32; privacy and security 52; connected care journey 45; protection from commercial use 50; clinician access at the point of care 42; research and trial consent 49; clinical AI governance 30.
Access: The 2025 data law gives a free first copy within 30 days, but Republika Srpska's health law still charges for copies. Official portals exist only in RS and Tuzla Canton, with user numbers not verified, so the score is 45, +5 free copy, +5 portals, -5 fee.
Control: Records stay with institutions and, in Republika Srpska, IZIS limits access to staff treating the patient, which puts the score just above Albania's 30. No opt-out and no access log that patients can see was found in either entity.
Key laws: Law on Personal Data Protection (Official Gazette of BiH 12/25) (2025); Law on Rights, Obligations and Responsibilities of Patients (FBiH 40/10) (2010).
Brief and every source: https://healthrecordrights.com/brief/BIH/

### Montenegro (MNE): 44/100, rank 76= of 198 (likely range 56 to 99), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Montenegro scores 44 of 100 on a person's right to see, control and share their own health record: rank 76= of 198 countries (likely range 56 to 99), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is clinical AI governance (50, against a median of 30 across 198 countries); its weakest is privacy and security (40, median 45).
Montenegrins see prescriptions and lab results online, but the 2026 central record still awaits the agency meant to run it, and patients cannot limit sharing.
Scores: patient access to the full record 60; patient control and consent 28; privacy and security 40; connected care journey 50; protection from commercial use 40; clinician access at the point of care 42; research and trial consent 49; clinical AI governance 50.
Access: The 2010 patient rights law gives a right to see and copy the record, at the patient's cost and with no deadline. The eZdravlje portal shows prescriptions and primary care lab results but not hospital letters, so the score sits at the bottom of its band.
Control: By law, record data flows automatically into a central record held by the Ministry of Health, and treating clinicians may open it. No opt-out, no patient restriction tool and no access log visible to patients was found.
Key laws: Zakon o upravljanju podacima u oblasti zdravstva i digitalnom zdravlju (Sl. list CG 31/2026) (2026); Zakon o pravima pacijenata (Sl. list CG 40/10, 40/11) (2010).
Brief and every source: https://healthrecordrights.com/brief/MNE/

### Panama (PAN): 44/100, rank 76= of 198 (likely range 55 to 98), Weak, confidence: medium
In 2026, Panama scores 44 of 100 on a person's right to see, control and share their own health record: rank 76= of 198 countries (likely range 55 to 98), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is clinician access at the point of care (45, against a median of 34 across 198 countries); no right falls below the median, and the closest to it is patient control and consent (32, median 30).
Panama's laws give patients free, fast access to their data, but records stay split between the Health Ministry, the Social Security Fund and private providers.
Scores: patient access to the full record 50; patient control and consent 32; privacy and security 48; connected care journey 45; protection from commercial use 52; clinician access at the point of care 45; research and trial consent 49; clinical AI governance 35.
Access: Ley 68 gives patients the right to know all information about their health, and Ley 81 makes data requests free with a 10 business day deadline. There is no national portal; the Social Security Fund shows only 12 months of lab results online.
Control: Ley 68 says nobody may see a person's health data without authorisation unless the law allows it, but the same law opens the record to every clinician treating the patient at that centre. No opt-out from record sharing and no patient-visible access log was found.
Key laws: Ley 68 de 2003 (derechos y obligaciones de los pacientes) (2003); Ley 81 de 2019 (proteccion de datos personales) (2019).
Brief and every source: https://healthrecordrights.com/brief/PAN/

### Rwanda (RWA): 44/100, rank 76= of 198 (likely range 55 to 98), Weak, confidence: medium
In 2026, Rwanda scores 44 of 100 on a person's right to see, control and share their own health record: rank 76= of 198 countries (likely range 55 to 98), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (55, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is patient control and consent (30, median 30).
Rwanda's 2025 health law gives patients their file within five working days, but the state record is still rolling out with no sharing controls.
Scores: patient access to the full record 50; patient control and consent 30; privacy and security 52; connected care journey 46; protection from commercial use 50; clinician access at the point of care 34; research and trial consent 50; clinical AI governance 55.
Access: Law 026/2025 gives patients the right to consult their file and get a copy within five working days of a written request. A national patient app is planned, and whether patients can see their own records online today is not verified.
Control: The law requires consent or another legal ground, but health processing for care and public health needs no separate consent, and records are linked to the national ID. We found no opt-out and no access log patients can see.
Key laws: Law n° 058/2021 relating to the protection of personal data and privacy (2021); Law n° 026/2025 regulating healthcare services (2025).
Brief and every source: https://healthrecordrights.com/brief/RWA/

### Brunei (BRN): 43/100, rank 80= of 198 (likely range 60 to 109), Weak, confidence: high
In 2026, Brunei scores 43 of 100 on a person's right to see, control and share their own health record: rank 80= of 198 countries (likely range 60 to 109), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (62, against a median of 34 across 198 countries); its weakest is patient access to the full record (35, median 43).
Brunei keeps one public health record for nearly everyone, but its new privacy law does not cover the Ministry of Health that holds it.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 40; connected care journey 65; protection from commercial use 40; clinician access at the point of care 62; research and trial consent 46; clinical AI governance 30.
Access: Brunei's 2025 data protection order gives a right of access only against private providers, not the Ministry of Health, which holds most records. BruHealth shows lab and imaging results (63% of residents logged in weekly in 2022), so this sits at the band's top.
Control: Bru-HIMS runs on a 'One Patient, One Record' model across government facilities, and no opt-out or patient-visible access log was found. BruHealth users can manage app permissions, but the ministry says some health data cannot be deleted.
Key laws: Personal Data Protection Order, 2025 (2025); Medicines Order, 2007 (2007).
Brief and every source: https://healthrecordrights.com/brief/BRN/

### China (CHN): 43/100, rank 80= of 198 (likely range 59 to 106), Weak, confidence: medium
In 2026, China scores 43 of 100 on a person's right to see, control and share their own health record: rank 80= of 198 countries (likely range 59 to 106), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (62, against a median of 30 across 198 countries); its weakest is patient access to the full record (35, median 43).
Over 9,000 public hospitals feed provincial data platforms, but patients can copy only listed parts of their chart and cannot see who looked.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 45; connected care journey 60; protection from commercial use 38; clinician access at the point of care 50; research and trial consent 49; clinical AI governance 62.
Access: The Civil Code lets patients read and copy listed record types, and the 2013 rules list what hospitals may copy, leaving out progress notes, with a fee and no fixed deadline. Public health files are opening to residents county by county, a target for 2026.
Control: PIPL needs separate consent for health data and lets people withdraw it, but statutory duties and public health emergencies need no consent. Hospitals feed provincial platforms by default, with no national opt-out and no patient-visible access log found.
Key laws: Personal Information Protection Law (2021); Civil Code (Articles 1034, 1225, 1226) (2020).
Brief and every source: https://healthrecordrights.com/brief/CHN/

### Colombia (COL): 43/100, rank 80= of 198 (likely range 58 to 103), Weak, confidence: medium
In 2026, Colombia scores 43 of 100 on a person's right to see, control and share their own health record: rank 80= of 198 countries (likely range 58 to 103), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (50, against a median of 34 across 198 countries); its weakest is patient control and consent (27, median 30).
Colombia's law says patients own their electronic record and must consent to sharing, but the new national exchange is built for providers, not patients.
Scores: patient access to the full record 45; patient control and consent 27; privacy and security 50; connected care journey 50; protection from commercial use 50; clinician access at the point of care 50; research and trial consent 45; clinical AI governance 35.
Access: Ley 1751 and Ley 2015 give patients a free, complete electronic copy of their record. No national patient portal was found; the new national summaries are viewed by providers, so access still runs provider by provider.
Control: Ley 2015 says providers may access the electronic record only with the person's prior, express consent. The rollout rules describe automatic sharing with any authorised professional and no patient-facing consent switch or access log.
Key laws: Ley Estatutaria 1751 de 2015 (derecho fundamental a la salud) (2015); Ley 2015 de 2020 (historia clinica electronica interoperable) (2020).
Brief and every source: https://healthrecordrights.com/brief/COL/

### Ecuador (ECU): 43/100, rank 80= of 198 (likely range 61 to 106), Weak, confidence: medium
In 2026, Ecuador scores 43 of 100 on a person's right to see, control and share their own health record: rank 80= of 198 countries (likely range 61 to 106), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (45, against a median of 30 across 198 countries); no right falls below the median, and the closest to it is patient control and consent (30, median 30).
Ecuadorian law gives free data access and a record copy within 48 hours, but Health Ministry records are shared by default and still fragmented.
Scores: patient access to the full record 50; patient control and consent 30; privacy and security 45; connected care journey 40; protection from commercial use 52; clinician access at the point of care 40; research and trial consent 49; clinical AI governance 45.
Access: The data protection law gives free access within 15 days, and the health records rule requires a certified copy within 48 hours. No national patient portal showing the record was found, so access runs facility by facility.
Control: The LOPDP lets health providers process health data without consent for diagnosis, treatment and running health services. Ministry records go into one central database, with no opt-out and no access log patients can see.
Key laws: Ley Organica de Proteccion de Datos Personales (LOPDP) (2021); Acuerdo Ministerial 5216 (informacion confidencial en el Sistema Nacional de Salud) (2015).
Brief and every source: https://healthrecordrights.com/brief/ECU/

### Eswatini (SWZ): 43/100, rank 80= of 198 (likely range 59 to 106), Weak, confidence: medium
In 2026, Eswatini scores 43 of 100 on a person's right to see, control and share their own health record: rank 80= of 198 countries (likely range 59 to 106), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is connected care journey (50, against a median of 38 across 198 countries); its weakest is clinical AI governance (25, median 30).
Most public clinics share one national electronic record, but patients get no portal, no sharing choices, and health data rules are still in draft.
Scores: patient access to the full record 40; patient control and consent 35; privacy and security 55; connected care journey 50; protection from commercial use 42; clinician access at the point of care 45; research and trial consent 46; clinical AI governance 25.
Access: Section 19 of the Data Protection Act 2022 gives a right to a copy of your data, including who has had access to it, but at a prescribed fee. We found no patient portal, so requests go facility by facility.
Control: Health data may be processed without consent for treatment and facility administration, and the national CMIS record is shared across public clinics with no opt-out we could find. A right to learn who accessed your data exists in law, not verified in practice.
Key laws: Data Protection Act, 2022 (Act No. 5 of 2022) (2022); Medicines and Related Substances Control Act, 2016 (Act 9 of 2016) (2016).
Brief and every source: https://healthrecordrights.com/brief/SWZ/

### Malaysia (MYS): 43/100, rank 80= of 198 (likely range 60 to 107), Weak, confidence: medium
In 2026, Malaysia scores 43 of 100 on a person's right to see, control and share their own health record: rank 80= of 198 countries (likely range 60 to 107), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is patient control and consent (45, against a median of 30 across 198 countries); its weakest is patient access to the full record (40, median 43).
Malaysia is digitising public care toward one record per person, but its data law exempts the government hospitals most patients use.
Scores: patient access to the full record 40; patient control and consent 45; privacy and security 48; connected care journey 38; protection from commercial use 50; clinician access at the point of care 32; research and trial consent 46; clinical AI governance 45.
Access: The PDPA right to a copy in 21 days (fee up to RM30) binds only private providers; government facilities issue a medical report, not the record. MySejahtera shows parts (base 45, minus 5 fee, minus 5 scope, plus 5 portal).
Control: Since August 2026 a ministry guideline lets patients withdraw consent, by written notice, for sharing their data with other health workers. Consent for care is implied, records are shared across government facilities, and a log patients can see was not verified.
Key laws: Personal Data Protection Act 2010 (Act 709) (2010); Personal Data Protection (Amendment) Act 2024 (Act A1727) (2024).
Brief and every source: https://healthrecordrights.com/brief/MYS/

### Monaco (MCO): 43/100, rank 80= of 198 (likely range 57 to 102), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, journey, commercial and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Monaco scores 43 of 100 on a person's right to see, control and share their own health record: rank 80= of 198 countries (likely range 57 to 102), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (58, against a median of 45 across 198 countries); its weakest is connected care journey (32, median 38).
Monaco gives a firm legal right to the full record and a new GDPR-style law, but there is no shared national record linking providers.
Scores: patient access to the full record 50; patient control and consent 35; privacy and security 58; connected care journey 32; protection from commercial use 52; clinician access at the point of care 35; research and trial consent 46; clinical AI governance 38.
Access: Law 1.454 of 2017 gives a right to all health information held by any provider, within 15 days. There is no national record portal, but the main public hospital runs a patient portal, so the score sits at the anchor base plus 5.
Control: Each provider holds and controls its own file, and there is no shared record. Patients can object to outside hosting for a legitimate reason and files pass to a successor doctor only with consent, but there is no opt-out or patient-visible access log.
Key laws: Loi n° 1.454 du 30 octobre 2017 relative au consentement et à l'information en matière médicale (2017); Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles (2024).
Brief and every source: https://healthrecordrights.com/brief/MCO/

### Seychelles (SYC): 43/100, rank 80= of 198 (likely range 58 to 105), Weak, confidence: medium
In 2026, Seychelles scores 43 of 100 on a person's right to see, control and share their own health record: rank 80= of 198 countries (likely range 58 to 105), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (50, against a median of 34 across 198 countries); its weakest is clinical AI governance (20, median 30).
Seychelles has a 2023 data law and one state electronic health system, but its regulator says the law risks going largely unenforced.
Scores: patient access to the full record 40; patient control and consent 42; privacy and security 45; connected care journey 52; protection from commercial use 40; clinician access at the point of care 50; research and trial consent 46; clinical AI governance 20.
Access: Section 27 of the Data Protection Act 2023 gives a free right to your data but sets no reply deadline, and the regulator says the Act risks going largely unenforced. There is no national patient portal, so patients ask the health service directly.
Control: Health data may be used without consent for care and running health services, and eHIS records are open to all authorised providers. The law gives a right to a list of who accessed your data in the last 6 months, but we found no opt-out.
Key laws: Data Protection Act, 2023 (Act 24 of 2023) (2023); Access to Information Act, 2018 (2018).
Brief and every source: https://healthrecordrights.com/brief/SYC/

### South Africa (ZAF): 43/100, rank 80= of 198 (likely range 57 to 102), Weak, confidence: medium
In 2026, South Africa scores 43 of 100 on a person's right to see, control and share their own health record: rank 80= of 198 countries (likely range 57 to 102), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is clinical AI governance (48, against a median of 30 across 198 countries); its weakest is connected care journey (33, median 38).
South African patients have strong paper rights under POPIA and the National Health Act, but records stay in each provider's or province's own system.
Scores: patient access to the full record 40; patient control and consent 42; privacy and security 60; connected care journey 33; protection from commercial use 50; clinician access at the point of care 32; research and trial consent 50; clinical AI governance 48.
Access: POPIA section 23 and PAIA give a right to your record within 30 days, but providers may charge a prescribed fee and no national patient portal was found. Scored as statutory right (45) minus 5 for the fee.
Control: The National Health Act needs written consent to disclose records outside care, and POPIA lets you ask which third parties saw your data. But providers share for care without asking, and no system shows patients who opened their record.
Key laws: Protection of Personal Information Act 4 of 2013 (POPIA) (2013); Promotion of Access to Information Act 2 of 2000 (PAIA) (2000).
Brief and every source: https://healthrecordrights.com/brief/ZAF/

### Mexico (MEX): 42/100, rank 89= of 198 (likely range 63 to 110), Weak, confidence: high
In 2026, Mexico scores 42 of 100 on a person's right to see, control and share their own health record: rank 89= of 198 countries (likely range 63 to 110), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is patient access to the full record (55, against a median of 43 across 198 countries); its weakest is privacy and security (40, median 45).
Mexican law gives patients a free copy of their data, but records stay inside each institution until cross-institution sharing, decreed in April 2026, begins.
Scores: patient access to the full record 55; patient control and consent 35; privacy and security 40; connected care journey 38; protection from commercial use 45; clinician access at the point of care 35; research and trial consent 50; clinical AI governance 38.
Access: Both data laws make access free with a 20-day answer deadline, and the IMSS app shows 36 months of visits, prescriptions and labs. Score: base 45, +5 free with a deadline, +5 official portal; only 493,144 of 54 million eligible had enrolled by October 2025.
Control: Mexico's public-sector law lets providers use health data for care without consent, and the private-sector law lets them share it for treatment without consent. No opt-out or patient-visible log exists; scored at the band top because no cross-institution sharing is live.
Key laws: Ley General de Proteccion de Datos Personales en Posesion de Sujetos Obligados (2025); Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares (2025).
Brief and every source: https://healthrecordrights.com/brief/MEX/

### Nauru (NRU): 42/100, rank 89= of 198 (likely range 60 to 113), Weak, confidence: low
Weak evidence in 6 of 8 categories: access, control, privacy, journey, clinical and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Nauru scores 42 of 100 on a person's right to see, control and share their own health record: rank 89= of 198 countries (likely range 60 to 113), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is clinician access at the point of care (68, against a median of 34 across 198 countries); its weakest is patient access to the full record (28, median 43).
Nauru keeps every public clinic visit in one electronic record, but patients get only a practitioner's report, and no data protection law exists.
Scores: patient access to the full record 28; patient control and consent 35; privacy and security 38; connected care journey 65; protection from commercial use 40; clinician access at the point of care 68; research and trial consent 50; clinical AI governance 20.
Access: The Health and Medical Services Act 2025 gives the patient only a special report prepared by a health practitioner, not a copy of the record. No patient portal was found, and an access to information law is still being drafted.
Control: The 2025 Act requires the patient's written consent before health information goes to anyone outside listed exceptions, but treating staff see the shared record by default. No opt-out, granular choice or patient-visible access log was found.
Key laws: Health and Medical Services Act 2025 (No 35 of 2025) (2025); Constitution of Nauru 1968, Articles 3 and 9 (1968).
Brief and every source: https://healthrecordrights.com/brief/NRU/

### Albania (ALB): 41/100, rank 91= of 198 (likely range 67 to 117), Weak, confidence: low
Weak evidence in 5 of 8 categories: access, control, journey, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Albania scores 41 of 100 on a person's right to see, control and share their own health record: rank 91= of 198 countries (likely range 67 to 117), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (55, against a median of 45 across 198 countries); its weakest is connected care journey (34, median 38).
Albania has a new EU-aligned data protection law, but patients have no national record to view and hospitals were still going digital in 2026.
Scores: patient access to the full record 50; patient control and consent 30; privacy and security 55; connected care journey 34; protection from commercial use 50; clinician access at the point of care 30; research and trial consent 43; clinical AI governance 30.
Access: The 2024 data protection law gives a free right of access within 30 days, but no national portal shows the medical record. Only pieces are online, such as a person's own e-prescriptions on e-Albania, so the score sits at 50.
Control: Health data is a special category, but the law lets providers process it for care without consent, and no opt-out or patient-visible access log was found. Records sit with institutions, and the ministry has a legal right of access.
Key laws: Law No. 124/2024 On personal data protection (2024); Law No. 10107/2009 On health care in the Republic of Albania (2009).
Brief and every source: https://healthrecordrights.com/brief/ALB/

### Jordan (JOR): 41/100, rank 91= of 198 (likely range 67 to 117), Weak, confidence: medium
In 2026, Jordan scores 41 of 100 on a person's right to see, control and share their own health record: rank 91= of 198 countries (likely range 67 to 117), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (45, against a median of 34 across 198 countries); its weakest is protection from commercial use (40, median 45).
Jordan's public hospitals and clinics share one electronic record, but patients see only part of it and have no say over sharing.
Scores: patient access to the full record 50; patient control and consent 28; privacy and security 45; connected care journey 45; protection from commercial use 40; clinician access at the point of care 45; research and trial consent 43; clinical AI governance 30.
Access: The 2023 data law gives a free right to access and obtain one's data. The Hakeemi app shows public patients labs, radiology reports and medicines, but not notes or diagnoses; a reported World Bank count of 1 million users is not verified at source.
Control: The data law demands explicit, written consent in general, but processing for diagnosis and care needs neither consent nor notice. Hakeem opens a patient's file at any connected site by national ID, and no opt-out or patient-visible access log was found.
Key laws: Personal Data Protection Law No. 24 of 2023 (2023); Data Subject Rights Regulation 2025 (2025).
Brief and every source: https://healthrecordrights.com/brief/JOR/

### Mauritius (MUS): 41/100, rank 91= of 198 (likely range 70 to 119), Weak, confidence: medium
In 2026, Mauritius scores 41 of 100 on a person's right to see, control and share their own health record: rank 91= of 198 countries (likely range 70 to 119), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is privacy and security (55, against a median of 45 across 198 countries); its weakest is connected care journey (30, median 38).
Mauritius has a GDPR-style data law and a free right to a copy, but its one-record e-Health system is still a regional pilot.
Scores: patient access to the full record 50; patient control and consent 32; privacy and security 55; connected care journey 30; protection from commercial use 45; clinician access at the point of care 30; research and trial consent 49; clinical AI governance 28.
Access: Section 37 of the Data Protection Act 2017 gives a free copy of your data, with a reply due within one month. No national patient portal is live yet, so patients ask each hospital or clinic.
Control: Health data can be processed without consent for diagnosis, care and running health services under section 29 of the Data Protection Act. The e-Health record is built to follow the patient to every public hospital, and we found no opt-out or patient access log.
Key laws: Data Protection Act 2017 (Act No. 20 of 2017) (2017); Clinical Trials Act 2011 (2011).
Brief and every source: https://healthrecordrights.com/brief/MUS/

### Moldova (MDA): 41/100, rank 91= of 198 (likely range 70 to 119), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Moldova scores 41 of 100 on a person's right to see, control and share their own health record: rank 91= of 198 countries (likely range 70 to 119), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is clinical AI governance (40, against a median of 30 across 198 countries); its weakest is patient access to the full record (40, median 43).
Moldovans have a legal right to their medical files, but under 10% can see their data digitally and a national e-health record is still planned.
Scores: patient access to the full record 40; patient control and consent 32; privacy and security 48; connected care journey 45; protection from commercial use 45; clinician access at the point of care 35; research and trial consent 46; clinical AI governance 40.
Access: Law 263/2005 gives patients unlimited access to their medical data and a copy of any part, but there is no national patient portal and no fixed deadline was verified. The Ministry of Health says under 10% of citizens can access their medical data digitally.
Control: Patients have no tool to choose who sees their records or to check who looked at them. The Ministry of Health plans a digital consent mechanism only by the end of 2027.
Key laws: Law 263/2005 on patient rights and responsibilities (2005); Law 195/2024 on personal data protection (2024).
Brief and every source: https://healthrecordrights.com/brief/MDA/

### Tanzania (TZA): 41/100, rank 91= of 198 (likely range 67 to 117), Weak, confidence: medium
In 2026, Tanzania scores 41 of 100 on a person's right to see, control and share their own health record: rank 91= of 198 countries (likely range 67 to 117), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (58, against a median of 30 across 198 countries); its weakest is patient access to the full record (35, median 43).
Electronic records now cover every referral hospital, but patients get only a description of their data and no say over sharing.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 48; connected care journey 48; protection from commercial use 45; clinician access at the point of care 40; research and trial consent 46; clinical AI governance 58.
Access: Section 33 of the Personal Data Protection Act gives a right to be told what data is held and why, not clearly a copy of the record. There is no deadline for answering and no national patient portal.
Control: The law requires prior written consent to process health data, but it exempts processing for medical care under a health professional. Records move between referral hospitals through national systems, with no patient opt-out or access log found.
Key laws: Personal Data Protection Act, 2022 (Cap. 44) (2022); Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (2023).
Brief and every source: https://healthrecordrights.com/brief/TZA/

### Zambia (ZMB): 41/100, rank 91= of 198 (likely range 66 to 114), Weak, confidence: low
Weak evidence in 4 of 8 categories: privacy, journey, commercial and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Zambia scores 41 of 100 on a person's right to see, control and share their own health record: rank 91= of 198 countries (likely range 66 to 114), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is connected care journey (45, against a median of 38 across 198 countries); no right falls below the median, and the closest to it is patient control and consent (30, median 30).
A government-run national health record now reaches most public clinics, but patients have no portal, no opt-out and no view of who opened their file.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 48; connected care journey 45; protection from commercial use 45; clinician access at the point of care 40; research and trial consent 50; clinical AI governance 30.
Access: The Data Protection Act 2021 gives a right to a copy, which may be free for the first copy and comes in electronic format on request, but sets no deadline. We found no patient portal, so people ask each facility.
Control: Health data may be processed without consent for care and for managing health systems, and the national SmartCare record is shared across public facilities by default. We found no patient opt-out and no patient-visible access log.
Key laws: Data Protection Act No. 3 of 2021 (2021); National Health Research Act No. 2 of 2013 (2013).
Brief and every source: https://healthrecordrights.com/brief/ZMB/

### Bhutan (BTN): 40/100, rank 97= of 198 (likely range 71 to 123), Weak, confidence: medium
In 2026, Bhutan scores 40 of 100 on a person's right to see, control and share their own health record: rank 97= of 198 countries (likely range 71 to 123), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is connected care journey (58, against a median of 38 across 198 countries); its weakest is patient access to the full record (33, median 43).
Bhutan runs one national electronic record across 300 health facilities, but patients have no statutory right to a copy and no data protection regulator.
Scores: patient access to the full record 33; patient control and consent 30; privacy and security 38; connected care journey 58; protection from commercial use 38; clinician access at the point of care 50; research and trial consent 49; clinical AI governance 40.
Access: No statute gives patients a right to a copy of their record; the right rests on a 2022 ministry manual, and copies are at the patient's expense. The ePIS app shows visit history, diagnoses and prescriptions, which keeps the score near the top of the band.
Control: Records sit in one government system with no opt-out and no patient-visible access log that we could find. Rules require written consent before release outside care, and the 2025 healthcare rules make unauthorised disclosure an offence.
Key laws: Constitution of the Kingdom of Bhutan (2008); Information, Communications and Media Act of Bhutan (2018).
Brief and every source: https://healthrecordrights.com/brief/BTN/

### Malawi (MWI): 40/100, rank 97= of 198 (likely range 71 to 120), Weak, confidence: high
In 2026, Malawi scores 40 of 100 on a person's right to see, control and share their own health record: rank 97= of 198 countries (likely range 71 to 120), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is patient access to the full record (50, against a median of 43 across 198 countries); its weakest is clinical AI governance (25, median 30).
Malawi's 2024 data law gives a 30-day right to a copy, but most patients still carry their record in a paper health passport.
Scores: patient access to the full record 50; patient control and consent 30; privacy and security 50; connected care journey 40; protection from commercial use 42; clinician access at the point of care 30; research and trial consent 49; clinical AI governance 25.
Access: Section 19 of the Data Protection Act 2024 gives a right to a copy of your data in electronic form within 30 days, free where practicable. There is no patient portal, and most people hold their own record in a paper health passport.
Control: Health data may be processed without consent for public health or the public interest, and the new shared record gives no sharing choice or access log. HIV status is the exception: providers need written consent to disclose it beyond the treating team, with narrow exceptions.
Key laws: Data Protection Act, 2024 (Act No. 3 of 2024) (2024); HIV and AIDS (Prevention and Management) Act, 2018 (Act No. 9 of 2018) (2018).
Brief and every source: https://healthrecordrights.com/brief/MWI/

### Bahamas (BHS): 39/100, rank 99= of 198 (likely range 80 to 133), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, control, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Bahamas scores 39 of 100 on a person's right to see, control and share their own health record: rank 99= of 198 countries (likely range 80 to 133), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is patient control and consent (35, against a median of 30 across 198 countries); its weakest is protection from commercial use (40, median 45).
Bahamians can ask each provider for a copy of their record under a 2003 law, but public clinics were still moving off paper in 2026.
Scores: patient access to the full record 45; patient control and consent 35; privacy and security 45; connected care journey 35; protection from commercial use 40; clinician access at the point of care 30; research and trial consent 46; clinical AI governance 25.
Access: The 2003 Data Protection Act gives a right to a copy within 40 days, but the Minister may set a fee and no national portal with the full record was verified. NHI's patient portal for its own providers offsets the fee.
Control: The 2003 law has no consent rules, and no opt-out or patient-visible access log was found. NHI says a patient can consent to have their record shared with a new provider, which puts this at the top of the lowest band.
Key laws: Data Protection (Privacy of Personal Information) Act, 2003 (Ch. 324A) (2003); Data Protection Act, 2025 (2025).
Brief and every source: https://healthrecordrights.com/brief/BHS/

### Botswana (BWA): 39/100, rank 99= of 198 (likely range 74 to 128), Weak, confidence: medium
In 2026, Botswana scores 39 of 100 on a person's right to see, control and share their own health record: rank 99= of 198 countries (likely range 74 to 128), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (58, against a median of 45 across 198 countries); its weakest is clinician access at the point of care (22, median 34).
Botswana has a modern data law with an active regulator, but clinic and hospital systems do not share records and patients have no portal.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 58; connected care journey 28; protection from commercial use 48; clinician access at the point of care 22; research and trial consent 49; clinical AI governance 40.
Access: The Data Protection Act 2024 gives a free copy of your data within one month, and the Public Health Act lets facilities only temporarily deny record access. There is no patient portal, and we quote the published Bill because the enacted text was not verified.
Control: Health data may be processed without consent for diagnosis, treatment and health system management, and there is no shared record with sharing choices or an access log. Patients keep only general rights to object.
Key laws: Data Protection Act 18 of 2024 (2024); Public Health Act 11 of 2013 (2013).
Brief and every source: https://healthrecordrights.com/brief/BWA/

### Chile (CHL): 39/100, rank 99= of 198 (likely range 75 to 127), Weak, confidence: medium
In 2026, Chile scores 39 of 100 on a person's right to see, control and share their own health record: rank 99= of 198 countries (likely range 75 to 127), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is patient control and consent (35, against a median of 30 across 198 countries); its weakest is privacy and security (40, median 45).
Chilean law gives patients a free, portable copy of their record, but records stay provider by provider and the new data law may slip.
Scores: patient access to the full record 45; patient control and consent 35; privacy and security 40; connected care journey 38; protection from commercial use 42; clinician access at the point of care 35; research and trial consent 50; clinical AI governance 30.
Access: Ley 20.584 Article 13 gives patients a free, complete copy of their record in a structured, portable format, but only on request to each provider. The national Portal Paciente shows vaccines, GES guarantees and waiting lists, not the clinical record.
Control: The law bars staff not involved in care from the record and makes providers log who opens it, but patients have no opt-out, consent switch or visible log. Scored at the top of the lowest band because no national sharing system is live.
Key laws: Ley 20.584 (derechos y deberes de los pacientes) (2012); Ley 21.668 (interoperabilidad de las fichas clinicas) (2024).
Brief and every source: https://healthrecordrights.com/brief/CHL/

### Philippines (PHL): 39/100, rank 99= of 198 (likely range 77 to 130), Weak, confidence: medium
In 2026, the Philippines scores 39 of 100 on a person's right to see, control and share their own health record: rank 99= of 198 countries (likely range 77 to 130), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is clinical AI governance (42, against a median of 30 across 198 countries); its weakest is clinician access at the point of care (27, median 34).
Filipino patients have strong privacy rights on paper, but records stay hospital by hospital and a shared exchange is still a pilot.
Scores: patient access to the full record 40; patient control and consent 40; privacy and security 45; connected care journey 32; protection from commercial use 45; clinician access at the point of care 27; research and trial consent 46; clinical AI governance 42.
Access: The Data Privacy Act gives a right of access and a structured electronic copy, but no fixed deadline is in force and one city hospital's rules release only parts of the record. Base 45, +5 structured copy, -5 no fixed deadline, -5 limited scope = 40.
Control: By law a patient can ask any provider who received their data and when it was last accessed (RA 10173 Section 16(c)), but only on request; practice was not verified. UHC Act Section 31 makes every provider send health data to PhilHealth, with no consent step.
Key laws: Data Privacy Act of 2012 (RA 10173) (2012); Universal Health Care Act (RA 11223) (2019).
Brief and every source: https://healthrecordrights.com/brief/PHL/

### Uganda (UGA): 39/100, rank 99= of 198 (likely range 80 to 134), Weak, confidence: medium
In 2026, Uganda scores 39 of 100 on a person's right to see, control and share their own health record: rank 99= of 198 countries (likely range 80 to 134), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is protection from commercial use (50, against a median of 45 across 198 countries); its weakest is clinician access at the point of care (25, median 34).
A 2019 data law bans selling personal data, but records stay locked in each hospital and the Ministry, not the patient, owns them.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 48; connected care journey 35; protection from commercial use 50; clinician access at the point of care 25; research and trial consent 46; clinical AI governance 25.
Access: The 2019 Act lets a patient confirm what a provider holds, get a description and learn who received it, within 30 days and with no listed fee. The right to a full copy rests on a 2009 Ministry charter, and there is no national portal.
Control: The 2019 Act requires consent but lets providers process data for medical purposes without it, and the right to object does not cover those cases. A 2025 health deal gives the US government logins to nine national health systems for seven years.
Key laws: Data Protection and Privacy Act, 2019 (2019); Data Protection and Privacy Regulations, 2021 (2021).
Brief and every source: https://healthrecordrights.com/brief/UGA/

### Bangladesh (BGD): 38/100, rank 104= of 198 (likely range 82 to 141), Weak, confidence: low
Weak evidence in 5 of 8 categories: access, control, journey, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Bangladesh scores 38 of 100 on a person's right to see, control and share their own health record: rank 104= of 198 countries (likely range 82 to 141), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (50, against a median of 30 across 198 countries); its weakest is protection from commercial use (35, median 45).
Bangladesh's new data law treats health data as sensitive, but penalties are not yet in force and the national record exchange's reach is unverified.
Scores: patient access to the full record 35; patient control and consent 42; privacy and security 42; connected care journey 33; protection from commercial use 35; clinician access at the point of care 28; research and trial consent 46; clinical AI governance 50.
Access: The Personal Data Protection Act, 2026 gives a right to a copy of personal data, including who it was shared with. Deadlines are left to future regulations, complaints and fines are not yet in force, and no national patient portal exists.
Control: Health data needs specific consent, consent can be withdrawn, and the national exchange retrieves past records only with the patient's explicit consent. But treatment, public health and state purposes are exempt, and the redress sections are not yet in force.
Key laws: Personal Data Protection Act, 2026 (Act No. 63) (2026); National Data Management Act, 2026 (Act No. 80) (2026).
Brief and every source: https://healthrecordrights.com/brief/BGD/

### Côte d'Ivoire (CIV): 38/100, rank 104= of 198 (likely range 84 to 140), Weak, confidence: medium
In 2026, Côte d'Ivoire scores 38 of 100 on a person's right to see, control and share their own health record: rank 104= of 198 countries (likely range 84 to 140), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is privacy and security (48, against a median of 45 across 198 countries); its weakest is patient access to the full record (35, median 43).
Côte d'Ivoire's state patient record now follows millions of people between public facilities, but patients get no portal, opt-out or access log.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 48; connected care journey 38; protection from commercial use 45; clinician access at the point of care 36; research and trial consent 49; clinical AI governance 25.
Access: Law 2019-678 lets a patient obtain the contents of the hospital file through a doctor of their choice, and Law 2013-450 gives a general right to a copy. No deadline is set, summaries can be charged for, and no patient portal shows the record.
Control: Law 2013-450 requires express prior consent, but public-interest and legal-duty exceptions cover state systems. The state record links each patient by a unique code across connected facilities, and we found no opt-out or patient-visible access log.
Key laws: Law No. 2013-450 on the protection of personal data (2013); Law No. 2019-678 on hospital reform (2019).
Brief and every source: https://healthrecordrights.com/brief/CIV/

### Ghana (GHA): 38/100, rank 104= of 198 (likely range 82 to 137), Weak, confidence: medium
In 2026, Ghana scores 38 of 100 on a person's right to see, control and share their own health record: rank 104= of 198 countries (likely range 82 to 137), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (40, against a median of 30 across 198 countries); its weakest is clinician access at the point of care (28, median 34).
Ghana's data law gives patients a 40-day right of access, but records sit in a state-owned hospital system rebuilt after a 2025 vendor shutdown.
Scores: patient access to the full record 40; patient control and consent 30; privacy and security 45; connected care journey 35; protection from commercial use 48; clinician access at the point of care 28; research and trial consent 49; clinical AI governance 40.
Access: Act 843 lets you ask any provider for your data, with a reply due within 40 days, but the request can carry a prescribed fee. There is no national patient portal: the official MyNHIS app covers insurance membership, not records.
Control: On paper the Act lets you object to processing and learn who has had access, but health processing by clinicians is presumed necessary and no opt-out or patient access log works in practice (not verified). Hospital records now sit in a state-owned system by design.
Key laws: Data Protection Act, 2012 (Act 843) (2012); Public Health Act, 2012 (Act 851) (2012).
Brief and every source: https://healthrecordrights.com/brief/GHA/

### Maldives (MDV): 38/100, rank 104= of 198 (likely range 85 to 141), Weak, confidence: high
In 2026, Maldives scores 38 of 100 on a person's right to see, control and share their own health record: rank 104= of 198 countries (likely range 85 to 141), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (50, against a median of 46 across 198 countries); its weakest is protection from commercial use (38, median 45).
Patients can get their record within 3 working days, but hospital systems do not connect and Maldives has no data protection law yet.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 40; connected care journey 40; protection from commercial use 38; clinician access at the point of care 28; research and trial consent 50; clinical AI governance 28.
Access: A 2019 regulation lets any adult get their medical record from a provider within 3 working days, at a cost-only fee. There is no national record portal; the MIHIS portal shows mainly vaccination, growth and primary care data.
Control: The law lets providers share records with other clinicians for care without asking, and we found no opt-out and no access log patients can see. Disclosure outside care needs written consent, a court order or a legal duty.
Key laws: Constitution of the Republic of Maldives (2008); Health Services Act (Law 29/2015) (2015).
Brief and every source: https://healthrecordrights.com/brief/MDV/

### Zimbabwe (ZWE): 38/100, rank 104= of 198 (likely range 84 to 140), Weak, confidence: medium
In 2026, Zimbabwe scores 38 of 100 on a person's right to see, control and share their own health record: rank 104= of 198 countries (likely range 84 to 140), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is research and trial consent (50, against a median of 46 across 198 countries); its weakest is connected care journey (32, median 38).
Zimbabwe has written health-data consent and confidentiality into law, but patients have no verified portal, no access log and a record system built for clinics.
Scores: patient access to the full record 40; patient control and consent 32; privacy and security 48; connected care journey 32; protection from commercial use 45; clinician access at the point of care 28; research and trial consent 50; clinical AI governance 28.
Access: Section 14 of the Cyber and Data Protection Act 2021 gives a right to access personal information, but sets no deadline or format. No patient portal was verified, so patients ask each provider.
Control: The 2021 Act requires written, revocable consent for health data, but care under a health professional is exempt, and the 2026 amendment lets providers share records with each other in the patient's interest. No access log or opt-out was found.
Key laws: Cyber and Data Protection Act, No. 5 of 2021 (2021); SI 155 of 2024, Licensing of Data Controllers and Appointment of DPOs Regulations (2024).
Brief and every source: https://healthrecordrights.com/brief/ZWE/

### Barbados (BRB): 37/100, rank 109= of 198 (likely range 85 to 142), Weak, confidence: low
Weak evidence in 5 of 8 categories: access, control, commercial, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Barbados scores 37 of 100 on a person's right to see, control and share their own health record: rank 109= of 198 countries (likely range 85 to 142), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is patient access to the full record (45, against a median of 43 across 198 countries); its weakest is protection from commercial use (40, median 45).
Barbados has a GDPR-style privacy law, but health is not legally sensitive, the main hospital charges $375 per record copy, and no portal is live.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 44; connected care journey 35; protection from commercial use 40; clinician access at the point of care 30; research and trial consent 43; clinical AI governance 28.
Access: The Data Protection Act 2019 promises a free copy within one month, in electronic form if asked electronically. In practice the Queen Elizabeth Hospital lists a $375 fee for a copy of its records, and its promised patient app was not yet live.
Control: Health data is not on the Act's sensitive list, and even sensitive data may be processed for care or public functions without consent. No opt-out from record sharing and no patient-visible access log were found as the hospital moves to one digital system.
Key laws: Data Protection Act, 2019-29 (2019); Barbados Medical Products Act, 2026 (passed as a bill; commencement not verified) (2026).
Brief and every source: https://healthrecordrights.com/brief/BRB/

### Benin (BEN): 37/100, rank 109= of 198 (likely range 89 to 148), Weak, confidence: medium
In 2026, Benin scores 37 of 100 on a person's right to see, control and share their own health record: rank 109= of 198 countries (likely range 89 to 148), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (52, against a median of 45 across 198 countries); its weakest is connected care journey (22, median 38).
Benin has a strong data law and an active regulator, but patients cannot view or share records online; a digital record is only a promise.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 52; connected care journey 22; protection from commercial use 45; clinician access at the point of care 20; research and trial consent 50; clinical AI governance 30.
Access: The Digital Code gives a free right to a copy of your personal data within 60 days, which covers medical files. There is no national portal or patient app, and use of this right in health care was not verified, so the score sits at 45.
Control: Health data may be processed without consent when needed for care under a health professional, and there is no shared record, opt-out or access log. The patient's main tool is a general right to object for legitimate reasons.
Key laws: Law 2017-20 on the Digital Code (Book V, personal data) (2018); Law 2020-35 amending the Digital Code (2021).
Brief and every source: https://healthrecordrights.com/brief/BEN/

### Ethiopia (ETH): 37/100, rank 109= of 198 (likely range 85 to 143), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, journey, commercial and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Ethiopia scores 37 of 100 on a person's right to see, control and share their own health record: rank 109= of 198 countries (likely range 85 to 143), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (56, against a median of 30 across 198 countries); its weakest is clinician access at the point of care (24, median 34).
Ethiopia passed a GDPR-style data law in 2024 and plans paperless hospitals by 2030, but patients have no portal and little control today.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 44; connected care journey 30; protection from commercial use 50; clinician access at the point of care 24; research and trial consent 49; clinical AI governance 56.
Access: The 2024 data protection law gives a free right of access with no fixed deadline, but key directives were still pending in late 2025 and there is no patient portal. Score: base 45, minus 5 no deadline, plus 5 portability, minus 5 enforcement rules pending.
Control: Article 47 of Proclamation No. 1362/2024 lets records be used and shared for care, public health, research and legal purposes without asking the patient, and there is no opt-out or patient-visible access log. Scored 28, level with Nigeria, in the 20 to 35 band.
Key laws: Personal Data Protection Proclamation No. 1321/2024 (2024); Health Service Administration and Regulation Proclamation No. 1362/2024 (2025).
Brief and every source: https://healthrecordrights.com/brief/ETH/

### Jamaica (JAM): 37/100, rank 109= of 198 (likely range 86 to 143), Weak, confidence: medium
In 2026, Jamaica scores 37 of 100 on a person's right to see, control and share their own health record: rank 109= of 198 countries (likely range 86 to 143), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is protection from commercial use (50, against a median of 45 across 198 countries); its weakest is connected care journey (30, median 38).
Jamaica's data law took effect in December 2023, but many public records are still paper and eCare does not yet reach every public facility.
Scores: patient access to the full record 40; patient control and consent 30; privacy and security 48; connected care journey 30; protection from commercial use 50; clinician access at the point of care 30; research and trial consent 46; clinical AI governance 25.
Access: The Data Protection Act, 2020 (section 6) gives a right to a copy within 30 days, but on payment of a prescribed fee, which one ministry agency lists as J$100 per page. There is no national patient portal.
Control: Health data may be processed without consent when needed for medical purposes by a health professional, and no opt-out from eCare sharing or patient-visible access log was found. The patient's main levers are general rights to object and correct.
Key laws: Data Protection Act, 2020 (2020); Data Protection Regulations, 2024 (2024).
Brief and every source: https://healthrecordrights.com/brief/JAM/

### Kosovo (XKX): 37/100, rank 109= of 198 (likely range 84 to 141), Weak, confidence: low
Weak evidence in 8 of 8 categories: access, control, privacy, journey, commercial, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Kosovo scores 37 of 100 on a person's right to see, control and share their own health record: rank 109= of 198 countries (likely range 84 to 141), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (52, against a median of 45 across 198 countries); its weakest is connected care journey (25, median 38).
Kosovo has a GDPR-style data law and a right to see the record, but care runs on unlinked systems and no patient portal was found.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 52; connected care journey 25; protection from commercial use 46; clinician access at the point of care 25; research and trial consent 46; clinical AI governance 30.
Access: Two laws give a right to a copy: the 2019 data law makes the first copy free within one month, but the patient rights law puts copies at the patient's cost. With no national portal, the free copy (+5) and the charge (-5) cancel at 45.
Control: Health institutions own the data they record and must report it to the national health information system, with no opt-out or patient-visible access log found. A 2004 law lets patients name who may learn of their illness, but its use in practice was not verified.
Key laws: Law No. 06/L-082 on Protection of Personal Data (2019); Law No. 2004/38 on the Rights and Responsibilities of Kosovo Residents in the Health Care System (2004).
Brief and every source: https://healthrecordrights.com/brief/XKX/

### Tunisia (TUN): 37/100, rank 109= of 198 (likely range 87 to 143), Weak, confidence: medium
In 2026, Tunisia scores 37 of 100 on a person's right to see, control and share their own health record: rank 109= of 198 countries (likely range 87 to 143), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is patient control and consent (35, against a median of 30 across 198 countries); its weakest is connected care journey (30, median 38).
Patients won a legal right to a full record copy in 2024, but records stay mostly on paper and the national portal is not live.
Scores: patient access to the full record 40; patient control and consent 35; privacy and security 45; connected care journey 30; protection from commercial use 44; clinician access at the point of care 28; research and trial consent 49; clinical AI governance 27.
Access: Law 2024-32 gives patients the right to a complete copy of their medical record, but sets no deadline or fee rule. The 2004 data law's free copy within one month does not apply to public health establishments, and no national portal is live.
Control: Health data needs consent under the 2004 law, but the law also allows processing without consent for legal duties, public health, care and research. No opt-out, granular choice or patient-visible access log exists for the new national identifier.
Key laws: Loi organique n° 2004-63 sur la protection des données à caractère personnel (2004); Loi n° 2024-32 relative aux droits des bénéficiaires des services de santé et à la responsabilité médicale (2024).
Brief and every source: https://healthrecordrights.com/brief/TUN/

### Vatican City (VAT): 37/100, rank 109= of 198 (likely range 85 to 142), Weak, confidence: medium
In 2026, Vatican City scores 37 of 100 on a person's right to see, control and share their own health record: rank 109= of 198 countries (likely range 85 to 142), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is clinical AI governance (48, against a median of 30 across 198 countries); its weakest is connected care journey (30, median 38).
Vatican care runs through one polyclinic and a staff health fund; a 2024 data law sets a right of access but no fines.
Scores: patient access to the full record 40; patient control and consent 30; privacy and security 45; connected care journey 30; protection from commercial use 45; clinician access at the point of care 33; research and trial consent 40; clinical AI governance 48.
Access: Decree DCLVII of 2024 gives a right to a copy of one's data within 30 working days, with only extra copies charged. It binds only the Governatorato, a data protection complaint ends in a final order, separate court action remains available, and there is no patient portal.
Control: Health data may be used for care without consent, and the right to object gives way to public interest. We found no patient-visible access log and no shared record to opt out of.
Key laws: Decreto N. DCLVII, Regolamento Generale sulla protezione dei Dati personali (2024); Decreto N. DCCII, Linee Guida in materia di intelligenza artificiale (2024).
Brief and every source: https://healthrecordrights.com/brief/VAT/

### Cape Verde (CPV): 36/100, rank 116= of 198 (likely range 90 to 148), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, journey, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Cape Verde scores 36 of 100 on a person's right to see, control and share their own health record: rank 116= of 198 countries (likely range 90 to 148), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (50, against a median of 45 across 198 countries); its weakest is patient access to the full record (35, median 43).
Cape Verde has a modern data law and a right to see your records, but the promised digital record is not yet open to patients.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 50; connected care journey 32; protection from commercial use 45; clinician access at the point of care 28; research and trial consent 49; clinical AI governance 28.
Access: Two laws give a right to see your records, but the data law routes health data through a doctor you choose and sets no deadline. The Nha Card e-Saúde portal books visits and tests; whether it shows your results was not verified.
Control: Health data may be used for care without consent when handled by a professional bound by secrecy and notified to the regulator. There is no shared record yet, so no sharing setting, opt-out or access log exists for patients.
Key laws: Lei 133/V/2001, general data protection regime, as amended by Lei 41/VIII/2013 and Lei 121/IX/2021 (2021); Lei 120/IX/2021 amending Lei 42/VIII/2013 on the CNPD (2021).
Brief and every source: https://healthrecordrights.com/brief/CPV/

### Gabon (GAB): 36/100, rank 116= of 198 (likely range 89 to 149), Weak, confidence: medium
In 2026, Gabon scores 36 of 100 on a person's right to see, control and share their own health record: rank 116= of 198 countries (likely range 89 to 149), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (54, against a median of 45 across 198 countries); its weakest is clinician access at the point of care (25, median 34).
Gabon has a detailed 2023 data law and a regulator that fines, but patients cannot see records online and digital files stay in pilot hospitals.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 54; connected care journey 30; protection from commercial use 46; clinician access at the point of care 25; research and trial consent 50; clinical AI governance 25.
Access: Law 025/2023 gives a free written right to see your data and a copy, directly or through a doctor. No deadline is set, the provider may charge the cost of copying, and there is no patient portal, so 35.
Control: Health data may be processed without consent for care by staff bound by secrecy, and pilot hospital records are shared on transfer with no patient setting. We found no opt-out and no access log a patient can read.
Key laws: Law 025/2023 on personal data protection and privacy (amending Law 001/2011) (2023); Law 001/2011 on personal data protection (2011).
Brief and every source: https://healthrecordrights.com/brief/GAB/

### Mali (MLI): 36/100, rank 116= of 198 (likely range 94 to 155), Weak, confidence: medium
In 2026, Mali scores 36 of 100 on a person's right to see, control and share their own health record: rank 116= of 198 countries (likely range 94 to 155), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (48, against a median of 45 across 198 countries); its weakest is clinician access at the point of care (22, median 34).
A 2013 law gives free access to your data, but hospital records sit in separate local systems and patients see them through a doctor.
Scores: patient access to the full record 45; patient control and consent 27; privacy and security 48; connected care journey 27; protection from commercial use 42; clinician access at the point of care 22; research and trial consent 49; clinical AI governance 22.
Access: Law 2013-015 gives a free right to all your data and a copy, granted without delay. The hospital law lets inpatients see their medical file only through a doctor of their choice, and there is no patient portal.
Control: A doctor may open a patient's file held by another hospital only with the patient's agreement, though use in practice was not verified. There is no opt-out or access log, so 27, in the lower half of the 20 to 35 band.
Key laws: Loi n°2013-015 du 21 mai 2013 portant protection des données à caractère personnel (2013); Loi n°2017-070 du 18 décembre 2017 modifiant la loi n°2013-015 (2017).
Brief and every source: https://healthrecordrights.com/brief/MLI/

### Morocco (MAR): 36/100, rank 116= of 198 (likely range 90 to 149), Weak, confidence: low
Weak evidence in 5 of 8 categories: access, privacy, journey, commercial and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Morocco scores 36 of 100 on a person's right to see, control and share their own health record: rank 116= of 198 countries (likely range 90 to 149), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is connected care journey (30, median 38).
Moroccans can ask each doctor for a copy of their file, but no shared record exists yet; a July 2026 bill would create one.
Scores: patient access to the full record 40; patient control and consent 32; privacy and security 45; connected care journey 30; protection from commercial use 42; clinician access at the point of care 26; research and trial consent 49; clinical AI governance 28.
Access: Law 131-13 says patients can obtain a copy of their medical file, and Law 09-08 makes access to personal data free. There is no national patient portal yet, and the law sets no fixed answer deadline.
Control: Law 09-08 requires express consent or a legal basis to process sensitive data, but doctors need only declare health data processing to the CNDP. No national sharing system, opt-out or patient-visible access log exists yet.
Key laws: Law 09-08 on the protection of personal data (2009); Law 131-13 on the practice of medicine (2015).
Brief and every source: https://healthrecordrights.com/brief/MAR/

### The Gambia (GMB): 36/100, rank 116= of 198 (likely range 93 to 154), Weak, confidence: medium
In 2026, The Gambia scores 36 of 100 on a person's right to see, control and share their own health record: rank 116= of 198 countries (likely range 93 to 154), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (48, against a median of 45 across 198 countries); its weakest is connected care journey (22, median 38).
The Gambia passed its first data protection law in 2025, but most patient records are still on paper and no shared record exists.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 48; connected care journey 22; protection from commercial use 48; clinician access at the point of care 18; research and trial consent 46; clinical AI governance 25.
Access: The 2025 Act gives a free copy of your personal data within one month, which covers medical files. Free with a deadline adds 5 to the base of 45, but the deadline can stretch to two months and the new regulator has no enforcement record, so 45.
Control: Where consent is used it must be specific and can be withdrawn, but health data may be processed without consent for managing health services. With no shared record there is no opt-out setting or access log for patients to use.
Key laws: Personal Data Protection and Privacy Act, 2025 (2025); Access to Information Act, 2021 (2021).
Brief and every source: https://healthrecordrights.com/brief/GMB/

### Algeria (DZA): 35/100, rank 121= of 198 (likely range 97 to 157), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Algeria scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 97 to 157), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is privacy and security (45, against a median of 45 across 198 countries); its weakest is connected care journey (32, median 38).
Algeria is rolling out a national electronic record tied to the national ID, but patients get no sharing choices and no portal yet.
Scores: patient access to the full record 40; patient control and consent 25; privacy and security 45; connected care journey 32; protection from commercial use 40; clinician access at the point of care 30; research and trial consent 46; clinical AI governance 25.
Access: Law 18-07 gives a right to a copy of one's data, requested provider by provider, and the controller may ask the regulator for longer reply times. The ministry's citizen app to view the record and test results is announced, not live.
Control: The new national electronic record links each patient by national ID and lets authorised professionals anywhere in the country see it. No patient opt-out, consent setting or patient-visible access log was found.
Key laws: Law 18-07 on protection of natural persons in personal data processing (2018); Law 25-11 amending Law 18-07 (2025).
Brief and every source: https://healthrecordrights.com/brief/DZA/

### Angola (AGO): 35/100, rank 121= of 198 (likely range 97 to 158), Weak, confidence: medium
In 2026, Angola scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 97 to 158), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is privacy and security (52, against a median of 45 across 198 countries); its weakest is connected care journey (22, median 38).
Angola has a strict 2011 data law with an active regulator, but no national health record, patient portal or record-sharing choices.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 52; connected care journey 22; protection from commercial use 50; clinician access at the point of care 20; research and trial consent 50; clinical AI governance 28.
Access: Article 26 of the 2011 data law gives a free right to learn what data is held, but health data is seen only through a doctor the patient chooses. There is no fixed deadline and no national patient portal.
Control: Health data needs written consent or regulator authorisation, but care, diagnosis and health service management are exempt. We found no opt-out from record sharing and no patient-visible access log.
Key laws: Lei n.º 22/11, Lei da Protecção de Dados Pessoais (2011); Lei n.º 21-B/92, Lei de Bases do Sistema Nacional de Saúde (1992).
Brief and every source: https://healthrecordrights.com/brief/AGO/

### Burkina Faso (BFA): 35/100, rank 121= of 198 (likely range 98 to 159), Weak, confidence: medium
In 2026, Burkina Faso scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 98 to 159), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (48, against a median of 45 across 198 countries); its weakest is clinician access at the point of care (20, median 34).
A 2021 data law gives patients rights, but most records sit in paper registers at each facility and the data regulator is being merged.
Scores: patient access to the full record 35; patient control and consent 32; privacy and security 48; connected care journey 25; protection from commercial use 45; clinician access at the point of care 20; research and trial consent 49; clinical AI governance 30.
Access: Article 17 of Law 001-2021 gives a right to see or copy your data, and to read your health data directly or through a health professional. The requester pays copy costs, no deadline is set, and there is no national patient portal.
Control: Health data needs express consent, but care by health professionals bound by secrecy is exempt, so patients have no say over routine sharing. There is a right to object on legitimate grounds, and no patient-visible access log was found.
Key laws: Loi n°001-2021/AN portant protection des personnes à l'égard du traitement des données à caractère personnel (2021); Loi organique n°038-2026/ALP (ARCOD) (2026).
Brief and every source: https://healthrecordrights.com/brief/BFA/

### Burundi (BDI): 35/100, rank 121= of 198 (likely range 99 to 160), Weak, confidence: medium
In 2026, Burundi scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 99 to 160), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is research and trial consent (50, against a median of 46 across 198 countries); its weakest is clinician access at the point of care (22, median 34).
Burundi passed its first data protection law in March 2026, but its regulator is not yet running and hospital records stay in separate systems.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 45; connected care journey 30; protection from commercial use 40; clinician access at the point of care 22; research and trial consent 50; clinical AI governance 20.
Access: Since March 2026, Law 1/03 gives a free copy of your data within one month, but medical information goes only through a doctor you name. No national patient portal was found, and the data regulator does not exist yet, so the score sits at 40.
Control: The 2026 law lets people object and withdraw consent, but there is no opt-out from sharing and no patient-visible access log. A February 2026 health deal commits Burundi to give the US any data access needed to audit facilities.
Key laws: Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (2026); Loi n°1/10 du 16 mars 2022 portant prévention et répression de la cybercriminalité (2022).
Brief and every source: https://healthrecordrights.com/brief/BDI/

### Cuba (CUB): 35/100, rank 121= of 198 (likely range 96 to 158), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Cuba scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 96 to 158), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (40, against a median of 30 across 198 countries); its weakest is connected care journey (25, median 38).
Cuba's new health law grants unlimited access to one's clinical record, but a national digital record is still a project and state exceptions are broad.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 33; connected care journey 25; protection from commercial use 45; clinician access at the point of care 25; research and trial consent 49; clinical AI governance 40.
Access: The Public Health Law regulation (Decreto 133/2025) lets people access their clinical record without limits, and Ley 149 sets a 5 plus 10 working day deadline for data requests. No patient portal was found, and whether copies are free was not verified.
Control: Ley 149 requires express consent for health data but exempts prevention, diagnosis and urgent care, and also anything justified by public order, defence or national security. No access log or opt-out for patients was found.
Key laws: Ley 149/2022 De Proteccion de Datos Personales (2022); Resolucion 58/2022 (Ministerio de Comunicaciones), Reglamento para la Seguridad y Proteccion de los Datos Personales en Soporte Electronico (2022).
Brief and every source: https://healthrecordrights.com/brief/CUB/

### Djibouti (DJI): 35/100, rank 121= of 198 (likely range 97 to 157), Weak, confidence: medium
In 2026, Djibouti scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 97 to 157), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is protection from commercial use (50, against a median of 45 across 198 countries); its weakest is clinician access at the point of care (22, median 34).
Djibouti's 2025 Digital Code gives patients strong rights on paper, but its data commission is not verified as working and records stay in separate systems.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 45; connected care journey 30; protection from commercial use 50; clinician access at the point of care 22; research and trial consent 50; clinical AI governance 22.
Access: The 2025 Digital Code gives a right to a copy within one month, directly or through a chosen doctor, but copies can cost the reproduction price. Public bodies, which run most care, have two years to comply and there is no portal, so 35.
Control: Health data may be processed without consent for care by a professional bound by secrecy, and there is no shared record, opt-out or access log in use. Article 731 makes the national ID number the compulsory health identifier.
Key laws: Law 019/AN/23/9ème L on the Digital Code (Book One, personal data; Book Seven, health data) (2025); Law 18/AN/23/9ème L ratifying the African Union Malabo Convention (2023).
Brief and every source: https://healthrecordrights.com/brief/DJI/

### Lesotho (LSO): 35/100, rank 121= of 198 (likely range 96 to 157), Weak, confidence: medium
In 2026, Lesotho scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 96 to 157), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is patient access to the full record (35, median 43).
Lesotho's 2012 data protection law has no regulator, and only HIV and TB care runs on a shared electronic record.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 45; connected care journey 30; protection from commercial use 40; clinician access at the point of care 30; research and trial consent 49; clinical AI governance 28.
Access: Section 26 of the Data Protection Act gives a right to get your data, but at a prescribed fee and within a prescribed time, and the regulator meant to enforce it was never set up. There is no patient portal.
Control: Providers may process health data without consent for treatment and running the facility, and there is no sharing setting or access log a patient can use. Insurers may assess risk with health data unless the person has objected.
Key laws: Data Protection Act, 2011 (Act No. 5 of 2012) (2012); Lesotho Medicines and Medical Devices Control Authority Act, 2023 (Act No. 6 of 2023) (2023).
Brief and every source: https://healthrecordrights.com/brief/LSO/

### Mauritania (MRT): 35/100, rank 121= of 198 (likely range 99 to 160), Weak, confidence: low
Weak evidence in 5 of 8 categories: access, journey, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Mauritania scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 99 to 160), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (52, against a median of 45 across 198 countries); its weakest is clinician access at the point of care (20, median 34).
Mauritania has a 2017 data law and a working regulator that now reviews health platforms, but patients still have no shared record or portal.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 52; connected care journey 25; protection from commercial use 45; clinician access at the point of care 20; research and trial consent 45; clinical AI governance 25.
Access: Law 2017-020 gives you a right to a copy of your data, directly or through a doctor you choose. The holder may charge reproduction costs, the law sets no deadline, and no portal shows your record, so 35.
Control: Health data processing needs consent, but the law lists care, public health and legal duties as exceptions, and there is no shared record, opt-out or patient-visible access log. Telemedicine is the exception: other doctors need your explicit permission.
Key laws: Law 2017-020 on the protection of personal data (2017); Decree 2022-013 on the composition, organisation and functioning of the APD (2022).
Brief and every source: https://healthrecordrights.com/brief/MRT/

### Niger (NER): 35/100, rank 121= of 198 (likely range 97 to 158), Weak, confidence: medium
In 2026, Niger scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 97 to 158), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (60, against a median of 46 across 198 countries); its weakest is clinician access at the point of care (22, median 34).
A 2022 law gives detailed health data rights, but its regulator was abolished in June 2026 and most records stay inside each facility.
Scores: patient access to the full record 35; patient control and consent 32; privacy and security 42; connected care journey 27; protection from commercial use 45; clinician access at the point of care 22; research and trial consent 60; clinical AI governance 30.
Access: Article 69 of Law 2022-59 gives a right to see your data on site or get a copy, but the copy can be charged at reproduction cost and no deadline is set. There is no national patient portal.
Control: Health professionals may process health data for care without consent, so patients have no say over routine use. The law limits sharing to what care needs and bars insurers and employers, but there is no opt-out and no access log patients can see.
Key laws: Loi n°2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnel (2022); Loi n°2023-31 du 4 juillet 2023 modifiant la loi n°2022-59 (2023).
Brief and every source: https://healthrecordrights.com/brief/NER/

### Nigeria (NGA): 35/100, rank 121= of 198 (likely range 95 to 156), Weak, confidence: high
In 2026, Nigeria scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 95 to 156), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is clinical AI governance (38, against a median of 30 across 198 countries); its weakest is clinician access at the point of care (22, median 34).
A modern data law on paper, but records stay inside each hospital and patients have no tool to see or steer who uses them.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 45; connected care journey 28; protection from commercial use 42; clinician access at the point of care 22; research and trial consent 50; clinical AI governance 38.
Access: Section 34 of the Data Protection Act 2023 gives a right to a copy in a common electronic format, but sets no day limit and lets providers pass on unreasonable costs. There is no national patient portal, so each hospital must be asked separately.
Control: The National Health Act requires written consent to disclose health information, but section 27 lets providers pass records to other providers without asking again. Patients may ask which recipients got their data, but no working opt-out or patient-visible log exists, so control sits with each facility.
Key laws: Nigeria Data Protection Act, 2023 (2023); NDP Act General Application and Implementation Directive (GAID) 2025 (2025).
Brief and every source: https://healthrecordrights.com/brief/NGA/

### Turkmenistan (TKM): 35/100, rank 121= of 198 (likely range 99 to 160), Weak, confidence: medium
In 2026, Turkmenistan scores 35 of 100 on a person's right to see, control and share their own health record: rank 121= of 198 countries (likely range 99 to 160), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is patient access to the full record (45, against a median of 43 across 198 countries); its weakest is privacy and security (30, median 45).
Turkmen law promises people their personal data free within a day, but there is no patient portal, no data regulator and broad state access.
Scores: patient access to the full record 45; patient control and consent 30; privacy and security 30; connected care journey 30; protection from commercial use 40; clinician access at the point of care 30; research and trial consent 46; clinical AI governance 25.
Access: The 2017 data law makes data holders give people any of their personal data free within one working day, though the Health Law promises only information about one's health. With no patient portal found and no data regulator to enforce it, the score is 45.
Control: The Health Law requires patient consent to collect data for electronic health records unless another law says otherwise, and the data law lets people withdraw consent. We found no opt-out from state health systems and no access log patients can see.
Key laws: Law No. 223-V on Protection of the Health of Citizens (2015); Law No. 519-V on Information about Private Life and its Protection (2017).
Brief and every source: https://healthrecordrights.com/brief/TKM/

### Belize (BLZ): 34/100, rank 132= of 198 (likely range 100 to 166), Weak, confidence: medium
In 2026, Belize scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 100 to 166), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (55, against a median of 34 across 198 countries); its weakest is protection from commercial use (25, median 45).
Belize has run one public health record (BHIS) since 2008, but its 2021 data protection law is still not in force.
Scores: patient access to the full record 25; patient control and consent 25; privacy and security 30; connected care journey 55; protection from commercial use 25; clinician access at the point of care 55; research and trial consent 43; clinical AI governance 20.
Access: The Data Protection Act 2021 promises a free copy within one month, but in September 2026 it was still not in force. No patient portal for the BHIS record was found; the only patient app shows the vaccination card.
Control: Every patient gets one client number in BHIS, which public clinicians use to see their history wherever they are treated. No opt-out and no patient-visible access log were found, and the 2021 consent rules are not in force.
Key laws: Data Protection Act, 2021 (Act No. 45 of 2021) (2021); Freedom of Information Act, Cap. 13 (1994).
Brief and every source: https://healthrecordrights.com/brief/BLZ/

### Democratic Republic of the Congo (COD): 34/100, rank 132= of 198 (likely range 101 to 162), Weak, confidence: medium
In 2026, Democratic Republic of the Congo scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 101 to 162), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is clinician access at the point of care (20, median 34).
A 2023 Digital Code gives strong rights on paper, but the data regulator was never set up and records stay in each facility.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 45; connected care journey 28; protection from commercial use 42; clinician access at the point of care 20; research and trial consent 49; clinical AI governance 22.
Access: The 2023 Digital Code gives a right to a copy of your data within 60 days, but the health law only promises a written summary of your condition. No national patient portal works at scale, so the score is 40.
Control: Health data needs explicit consent unless a care, public-health or public-interest exception applies, and people can object for legitimate reasons. There is no opt-out from sharing and no patient-visible access log, so the score is 28.
Key laws: Ordonnance-loi n°23/010 du 13 mars 2023 portant Code du numérique (2023); Loi n°18/035 du 13 décembre 2018 fixant les principes fondamentaux relatifs à l'organisation de la santé publique (2018).
Brief and every source: https://healthrecordrights.com/brief/COD/

### Dominican Republic (DOM): 34/100, rank 132= of 198 (likely range 99 to 160), Weak, confidence: medium
In 2026, Dominican Republic scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 99 to 160), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is privacy and security (35, median 45).
Dominican patients have a legal right to their data but no national record or portal; a single digital record is still in pilots.
Scores: patient access to the full record 40; patient control and consent 30; privacy and security 35; connected care journey 30; protection from commercial use 42; clinician access at the point of care 28; research and trial consent 49; clinical AI governance 25.
Access: Ley 172-13 gives a right to obtain one's data within five business days, but there is no national patient portal and copy fees were not verified. The health law does not name a right to a chart copy, so the score sits below the 45 base.
Control: Health data needs express written consent under Ley 172-13, but the law lets hospitals and clinicians process it for care without that consent. No opt-out from sharing and no patient-visible access log were found.
Key laws: Ley 172-13 (proteccion integral de los datos personales) (2013); Ley 42-01 (Ley General de Salud) (2001).
Brief and every source: https://healthrecordrights.com/brief/DOM/

### Guinea (GIN): 34/100, rank 132= of 198 (likely range 102 to 162), Weak, confidence: low
Weak evidence in 6 of 8 categories: access, control, journey, commercial, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Guinea scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 102 to 162), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is connected care journey (25, median 38).
Guinea's 2016 data law gives patients rights, but the regulator it promised was never created and records sit with each hospital.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 45; connected care journey 25; protection from commercial use 40; clinician access at the point of care 22; research and trial consent 49; clinical AI governance 28.
Access: The 2016 law lets you ask any data holder for your data and, for computer records, a copy in a structured electronic format. There is no national portal, the law sets no deadline, and the regulator meant to enforce it does not exist, so 40.
Control: The law makes express consent the default and bans processing health data except in listed cases, but no shared record, opt-out or access log exists. In practice each hospital decides, and a private vendor runs the records in some.
Key laws: Law L/2016/037/AN on cybersecurity and personal data protection (2016); Law L/97/021/AN, Public Health Code (1997).
Brief and every source: https://healthrecordrights.com/brief/GIN/

### Lebanon (LBN): 34/100, rank 132= of 198 (likely range 102 to 163), Weak, confidence: medium
In 2026, Lebanon scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 102 to 163), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is patient control and consent (40, against a median of 30 across 198 countries); its weakest is privacy and security (32, median 45).
Lebanese patients have a legal right to their paper file, but records stay inside each hospital, with no national record or data regulator.
Scores: patient access to the full record 40; patient control and consent 40; privacy and security 32; connected care journey 25; protection from commercial use 35; clinician access at the point of care 25; research and trial consent 49; clinical AI governance 20.
Access: Law 574 of 2004 gives patients the right to see their medical file and get copies, but at their own cost and with no deadline. There is no national portal; the health ministry app shows only a medication history.
Control: The ethics law bars any doctor from viewing a patient's file except at the patient's request, outside emergencies. Patients have no access log or sharing settings, and insurers' doctors, health authorities and courts have carve-outs.
Key laws: Law No. 574 on Patients' Rights and Informed Consent (2004); Medical Ethics Law No. 288, amended by Law No. 240 (1994/2012).
Brief and every source: https://healthrecordrights.com/brief/LBN/

### Madagascar (MDG): 34/100, rank 132= of 198 (likely range 104 to 165), Weak, confidence: high
In 2026, Madagascar scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 104 to 165), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (48, against a median of 45 across 198 countries); its weakest is connected care journey (22, median 38).
A 2015 data law gives patients a free right to their file, but records stay local and the regulator only started in 2025.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 48; connected care journey 22; protection from commercial use 42; clinician access at the point of care 18; research and trial consent 49; clinical AI governance 22.
Access: Article 23 of Law 2014-038 gives a free right to all your data and a copy, directly or through a doctor you choose. It must be met "without delay" but no number of days is set, and there is no patient portal, so 40.
Control: Health data may be processed without consent when a health professional bound by secrecy uses it for care, so patients have no say over routine use. There is no shared record, no opt-out and no access log a patient can read.
Key laws: Loi n° 2014-038 sur la protection des données à caractère personnel (2015); Loi n° 2011-002 portant Code de la Santé (2011).
Brief and every source: https://healthrecordrights.com/brief/MDG/

### Senegal (SEN): 34/100, rank 132= of 198 (likely range 100 to 161), Weak, confidence: medium
In 2026, Senegal scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 100 to 161), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is clinician access at the point of care (22, median 34).
A 2008 law gives patients a copy of their file, but files stay in each facility; a digital health law is still a draft.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 45; connected care journey 28; protection from commercial use 42; clinician access at the point of care 22; research and trial consent 49; clinical AI governance 30.
Access: Law 2008-12 gives every patient a right to a copy of their data, directly or through a doctor they name. The holder may charge up to the cost of copying, the law sets no reply deadline, and there is no national patient portal.
Control: Health data may be processed with consent or for care, public health and legal purposes, and people may object only on legitimate grounds. There is no sharing opt-out and no access log patients can see.
Key laws: Loi n° 2008-12 sur la protection des données à caractère personnel (2008); Loi n° 2009-17 portant Code d'éthique pour la recherche en santé (2009).
Brief and every source: https://healthrecordrights.com/brief/SEN/

### Somalia (SOM): 34/100, rank 132= of 198 (likely range 102 to 162), Weak, confidence: medium
In 2026, Somalia scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 102 to 162), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is privacy and security (45, against a median of 45 across 198 countries); its weakest is protection from commercial use (35, median 45).
Somalia's 2023 data law gives patients a free copy of their data, but records stay in separate clinics and the regulator has no health cases.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 45; connected care journey 30; protection from commercial use 35; clinician access at the point of care 24; research and trial consent 46; clinical AI governance 22.
Access: Article 20 of the 2023 Data Protection Act gives a free copy in a common electronic format (+5), but only for reasonable purposes and with no fixed deadline (-5 each). There is no patient portal, so base 45 lands at 40.
Control: Article 14 lets clinics process data for medical care without consent, and there is no shared record, opt-out or access log a patient can use. Consent can be withdrawn, but objection is limited to a few legal grounds.
Key laws: Data Protection Act, Law No. 005 of 2023 (2023); Data Protection Act Regulations (2026).
Brief and every source: https://healthrecordrights.com/brief/SOM/

### Togo (TGO): 34/100, rank 132= of 198 (likely range 105 to 166), Weak, confidence: medium
In 2026, Togo scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 105 to 166), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (50, against a median of 46 across 198 countries); its weakest is clinician access at the point of care (20, median 34).
Togo has a 2019 data law and a patient right to see the file, but records stay on paper or inside each facility.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 45; connected care journey 25; protection from commercial use 45; clinician access at the point of care 20; research and trial consent 50; clinical AI governance 20.
Access: The Public Health Code gives patients the right to see what is in their file, and the 2019 data law gives a right to a copy. A fee up to copying cost is allowed, no deadline is set and there is no portal, so 35.
Control: Health data may be processed without consent for diagnosis and care under a health professional, and there is no shared record, opt-out or patient-visible access log. The patient's main tool is a general right to object for legitimate reasons.
Key laws: Law 2019-014 on the protection of personal data (2019); Law 2009-007 on the Public Health Code (2009).
Brief and every source: https://healthrecordrights.com/brief/TGO/

### Vanuatu (VUT): 34/100, rank 132= of 198 (likely range 101 to 163), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Vanuatu scores 34 of 100 on a person's right to see, control and share their own health record: rank 132= of 198 countries (likely range 101 to 163), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is patient access to the full record (45, against a median of 43 across 198 countries); its weakest is connected care journey (22, median 38).
Vanuatu's 2025 data protection law gives patients a free copy of their data, but records are mostly paper and no regulator was verified as appointed.
Scores: patient access to the full record 45; patient control and consent 32; privacy and security 45; connected care journey 22; protection from commercial use 35; clinician access at the point of care 18; research and trial consent 46; clinical AI governance 22.
Access: Since 2 January 2025, section 9 of the Data Protection and Privacy Act gives a free copy of personal data within one month. There is no patient portal, and the regulator who would enforce the right was not verified as appointed.
Control: The 2024 Act lets health workers process health data for care without consent, and no opt-out from record sharing or patient-visible access log was found. A general right to object puts Vanuatu near the top of the 20 to 35 band.
Key laws: Data Protection and Privacy Act No. 13 of 2024 (2024); Digital Safety Authority Act No. 15 of 2024 (2024).
Brief and every source: https://healthrecordrights.com/brief/VUT/

### Antigua and Barbuda (ATG): 33/100, rank 142= of 198 (likely range 106 to 166), Weak, confidence: low
Weak evidence in 5 of 8 categories: access, journey, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Antigua and Barbuda scores 33 of 100 on a person's right to see, control and share their own health record: rank 142= of 198 countries (likely range 106 to 166), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is patient control and consent (30, against a median of 30 across 198 countries); its weakest is connected care journey (28, median 38).
Antigua and Barbuda is digitising its main hospital, but patients have no portal and the privacy regulator still has no office.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 42; connected care journey 28; protection from commercial use 42; clinician access at the point of care 25; research and trial consent 43; clinical AI governance 20.
Access: The Data Protection Act 2013 gives a right to a copy within 30 days, for a prescribed fee, but defines personal data around commercial transactions. There is no patient portal, so access means a written request to each provider.
Control: The Act requires explicit consent for health data but exempts processing for medical purposes by health professionals. No opt-out from record sharing and no patient-visible access log were found as the clinics move to one shared system.
Key laws: Data Protection Act, 2013 (No. 10 of 2013) (2013); Freedom of Information Act, 2004 (No. 19 of 2004) (2004).
Brief and every source: https://healthrecordrights.com/brief/ATG/

### Central African Republic (CAF): 33/100, rank 142= of 198 (likely range 111 to 170), Weak, confidence: medium
In 2026, Central African Republic scores 33 of 100 on a person's right to see, control and share their own health record: rank 142= of 198 countries (likely range 111 to 170), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is clinician access at the point of care (15, median 34).
A 2024 law gives patients a free copy of their data, but no working regulator was found and records stay on paper or donor systems.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 45; connected care journey 20; protection from commercial use 42; clinician access at the point of care 15; research and trial consent 49; clinical AI governance 20.
Access: Law 24.001 of January 2024 gives a free copy of your data, and health data can come directly or through a doctor you choose. There is no national portal, no fixed deadline beyond 'without delay', and no verified regulator.
Control: The law requires express consent for health data and lets people object for a legitimate reason, but care providers may process health data without consent. There is no opt-out from record sharing and no access log a patient can see.
Key laws: Loi n°24.001 portant protection des données à caractère personnel (2024); Loi n°24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité (2024).
Brief and every source: https://healthrecordrights.com/brief/CAF/

### Chad (TCD): 33/100, rank 142= of 198 (likely range 108 to 168), Weak, confidence: medium
In 2026, Chad scores 33 of 100 on a person's right to see, control and share their own health record: rank 142= of 198 countries (likely range 108 to 168), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is clinician access at the point of care (17, median 34).
A 2015 data law gives patients a right to their health data, but records are mostly on paper and stay inside each facility.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 45; connected care journey 22; protection from commercial use 40; clinician access at the point of care 17; research and trial consent 49; clinical AI governance 22.
Access: Articles 38, 39 and 41 of Law 007/PR/2015 give a right to see and copy your health data, directly or through a health professional. A copy can be charged at reproduction cost, a reply is due within one month, and there is no national portal.
Control: Health data needs explicit written consent, but the law exempts care, diagnosis and health service management under a health professional's supervision. Patients have no opt-out from sharing and no access log they can see.
Key laws: Loi n°007/PR/2015 portant protection des données à caractère personnel (2015); Ordonnance n°001/PR/2026 portant réforme de l'ANSICE (ratified by Loi n°003/AN-SENAT/2026) (2026).
Brief and every source: https://healthrecordrights.com/brief/TCD/

### Egypt (EGY): 33/100, rank 142= of 198 (likely range 107 to 167), Weak, confidence: medium
In 2026, Egypt scores 33 of 100 on a person's right to see, control and share their own health record: rank 142= of 198 countries (likely range 107 to 167), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (40, against a median of 30 across 198 countries); its weakest is patient access to the full record (30, median 43).
Egypt links records for about 6.8 million people in seven governorates, but patients get no say over sharing, and data protection enforcement starts November 2026.
Scores: patient access to the full record 30; patient control and consent 25; privacy and security 36; connected care journey 35; protection from commercial use 40; clinician access at the point of care 30; research and trial consent 50; clinical AI governance 40.
Access: Law 151 of 2020 gives a right to access only electronically processed data, with fees up to EGP 20,000, no response deadline, and enforcement from November 2026. Each gap costs 5 points from the base of 45, clamped at 30; what the patient e-portal shows is not verified.
Control: Records are created and shared by default inside the universal insurance system, which is compulsory for citizens living in Egypt, with no opt-out and no patient-visible access log found. Written consent for health data applies only where no law authorises the processing.
Key laws: Personal Data Protection Law No. 151 of 2020 (2020); PDPL Executive Regulations, Ministerial Decree 816 of 2025 (2025).
Brief and every source: https://healthrecordrights.com/brief/EGY/

### Mozambique (MOZ): 33/100, rank 142= of 198 (likely range 106 to 166), Weak, confidence: medium
In 2026, Mozambique scores 33 of 100 on a person's right to see, control and share their own health record: rank 142= of 198 countries (likely range 106 to 166), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (38, against a median of 30 across 198 countries); its weakest is protection from commercial use (35, median 45).
Mozambique has no data protection law yet, so patients rely on a 2007 charter and a 2017 e-commerce law while most records stay paper.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 38; connected care journey 30; protection from commercial use 35; clinician access at the point of care 25; research and trial consent 46; clinical AI governance 38.
Access: Article 63 of the 2017 Electronic Transactions Law lets a person learn what electronic data a controller holds, against a fee and within a 'reasonable period'. The 2007 Patient Charter says patients may know what is in their clinical file, but there is no national portal.
Control: The Patient Charter requires consent for medical acts and HIV status may not be disclosed without consent. We found no opt-out from record sharing and no patient-visible access log.
Key laws: Lei n.º 3/2017, Lei de Transacções Electrónicas (2017); Resolução n.º 73/2007, Carta dos Direitos e Deveres do Doente (2007).
Brief and every source: https://healthrecordrights.com/brief/MOZ/

### Palau (PLW): 33/100, rank 142= of 198 (likely range 108 to 169), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, journey, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Palau scores 33 of 100 on a person's right to see, control and share their own health record: rank 142= of 198 countries (likely range 108 to 169), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (40, against a median of 34 across 198 countries); its weakest is protection from commercial use (18, median 45).
Palau's national hospital keeps one electronic record, but patients lack a copy right or sharing choices, and a 2025 breach leaked medical data.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 32; connected care journey 38; protection from commercial use 18; clinician access at the point of care 40; research and trial consent 49; clinical AI governance 20.
Access: Citizens have a constitutional right to examine any government document, and the Open Government Act sets a 10-day deadline. Whether this covers a patient's own hospital file is not verified, and the Privacy Act has no access right.
Control: No opt-out, granular choice or patient-visible access log was found, and the government has called the Ministry the owner of medical records. The Healthcare Fund needs written consent, valid one year, to release a member's medical information.
Key laws: Constitution of the Republic of Palau, Article IV sections 4 and 12 (1981); Privacy Act, 6 PNCA 201-206 (not verified).
Brief and every source: https://healthrecordrights.com/brief/PLW/

### Paraguay (PRY): 33/100, rank 142= of 198 (likely range 106 to 166), Weak, confidence: medium
In 2026, Paraguay scores 33 of 100 on a person's right to see, control and share their own health record: rank 142= of 198 countries (likely range 106 to 166), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is connected care journey (40, against a median of 38 across 198 countries); its weakest is protection from commercial use (30, median 45).
Paraguay passed a modern data law in 2025 that does not apply until November 2027, and its national e-record bill died in May 2026.
Scores: patient access to the full record 33; patient control and consent 27; privacy and security 35; connected care journey 40; protection from commercial use 30; clinician access at the point of care 33; research and trial consent 46; clinical AI governance 30.
Access: No law in force was found that gives patients a copy of their full clinical record; the constitution's habeas data covers official and public-character registers only. Ley 7593 adds a free access and copy right, but not until November 2027.
Control: Records sit in provider systems such as the Health Ministry's HIS with no patient opt-out or patient-visible access log found. A 2026 rule logs each staff user by e-ID, but for traceability, not for patients.
Key laws: Constitucion Nacional, Articulo 135 (habeas data) (1992); Ley 836/80 (Codigo Sanitario) (1980).
Brief and every source: https://healthrecordrights.com/brief/PRY/

### Republic of the Congo (COG): 33/100, rank 142= of 198 (likely range 106 to 167), Weak, confidence: high
In 2026, Republic of the Congo scores 33 of 100 on a person's right to see, control and share their own health record: rank 142= of 198 countries (likely range 106 to 167), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is privacy and security (48, against a median of 45 across 198 countries); its weakest is connected care journey (22, median 38).
Congo has a 2019 data law and a regulator installed in 2026, but records stay mostly on paper and patients cannot see them online.
Scores: patient access to the full record 35; patient control and consent 30; privacy and security 48; connected care journey 22; protection from commercial use 45; clinician access at the point of care 20; research and trial consent 46; clinical AI governance 20.
Access: Law 29-2019 lets a patient ask for their health data, directly or through a doctor they choose, and get a copy. The provider may charge the cost of copying, no deadline is set, and there is no patient portal, so 35.
Control: Health data may be processed without consent for care under a health professional bound by secrecy, and there is no shared record, opt-out or access log. The patient's main tool is a right to object on legitimate grounds.
Key laws: Law 29-2019 on personal data protection (2019); Law 5-2025 creating the National Personal Data Protection Commission (CNPD) (2025).
Brief and every source: https://healthrecordrights.com/brief/COG/

### Suriname (SUR): 33/100, rank 142= of 198 (likely range 109 to 169), Weak, confidence: medium
In 2026, Suriname scores 33 of 100 on a person's right to see, control and share their own health record: rank 142= of 198 countries (likely range 109 to 169), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is patient control and consent (35, against a median of 30 across 198 countries); its weakest is privacy and security (30, median 45).
Since May 2025 the Civil Code gives Surinamese patients a right to a copy of their file, but no data protection law or regulator exists.
Scores: patient access to the full record 40; patient control and consent 35; privacy and security 30; connected care journey 30; protection from commercial use 30; clinician access at the point of care 25; research and trial consent 46; clinical AI governance 20.
Access: Article 7:456 of the Civil Code, in force since 1 May 2025, gives a right to inspect and copy the medical file, with no fixed deadline and a fee allowed for copies. The My Health app shows part of the record for patients of about 63 listed GPs.
Control: The Civil Code bars providers from sharing the file outside the treating team without consent, and patients can demand its destruction. With no opt-out from sharing and no patient access log, this sits at the top of the 20 to 35 band, like NRU and MCO.
Key laws: Grondwet van de Republiek Suriname, artikel 17 (1987); Burgerlijk Wetboek Boek 7, afdeling geneeskundige behandeling (S.B. 2024 no. 164) (2024).
Brief and every source: https://healthrecordrights.com/brief/SUR/

### Comoros (COM): 32/100, rank 151= of 198 (likely range 113 to 172), Weak, confidence: medium
In 2026, Comoros scores 32 of 100 on a person's right to see, control and share their own health record: rank 151= of 198 countries (likely range 113 to 172), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is clinician access at the point of care (15, median 34).
Comoros has had a data protection law since 2014, but no working regulator was found, and health records stay on paper or in separate systems.
Scores: patient access to the full record 35; patient control and consent 28; privacy and security 45; connected care journey 25; protection from commercial use 40; clinician access at the point of care 15; research and trial consent 49; clinical AI governance 20.
Access: Article 219 of the 2011 Public Health Code gives patients the right to the information in their file. The 2014 data law adds a copy, but for a fee, through a doctor for medical data, with no deadline and no portal, so 35.
Control: The 2014 law requires express consent for health data, but it exempts treatment and health research, and there is no opt-out from sharing and no access log for patients. National health data were hosted in Rwanda before a local server room opened in 2023.
Key laws: Loi N°14-029/AU portant protection des données à caractère personnel (2014); Loi N°11-001/AU portant Code de la Santé Publique (2011).
Brief and every source: https://healthrecordrights.com/brief/COM/

### Equatorial Guinea (GNQ): 32/100, rank 151= of 198 (likely range 113 to 173), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, journey and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Equatorial Guinea scores 32 of 100 on a person's right to see, control and share their own health record: rank 151= of 198 countries (likely range 113 to 173), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is connected care journey (18, median 38).
Equatorial Guinea passed a data law in 2016 but never set up its regulator, and patient records remain on paper in each facility.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 45; connected care journey 18; protection from commercial use 40; clinician access at the point of care 15; research and trial consent 49; clinical AI governance 18.
Access: Law 1/2016 gives a free right to a copy of your personal data, but sets no deadline for answering. There is no patient portal, and the regulator meant to hear complaints has not been set up, so 40.
Control: Health data needs express written consent under Law 1/2016, but care, public health and transfers between state bodies are exempt. There is no shared record, no opt-out and no access log a patient can see.
Key laws: Law 1/2016 on Personal Data Protection (2016); Law 7/2024 on social networks, computer crime and cybercrime (2024).
Brief and every source: https://healthrecordrights.com/brief/GNQ/

### Guatemala (GTM): 32/100, rank 151= of 198 (likely range 112 to 171), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Guatemala scores 32 of 100 on a person's right to see, control and share their own health record: rank 151= of 198 countries (likely range 112 to 171), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (46, against a median of 46 across 198 countries); its weakest is privacy and security (30, median 45).
Guatemala has no general data law; patients can request what the state holds on them, but records stay split between MSPAS, IGSS and private clinics.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 30; connected care journey 30; protection from commercial use 35; clinician access at the point of care 28; research and trial consent 46; clinical AI governance 22.
Access: The Constitution and the 2008 access law let people get what state bodies, including IGSS, hold on them within 10 working days, paying only reproduction costs. Score is the 45 base minus 5 because private clinics are not covered, with no patient portal.
Control: State bodies may pass personal data between themselves without consent, and no opt-out or patient-visible access log was found. IGSS logs every change to its electronic record, but gives the patient no way to see that log.
Key laws: Constitucion Politica de la Republica, Articulo 31 (1985); Decreto 57-2008, Ley de Acceso a la Informacion Publica (2008).
Brief and every source: https://healthrecordrights.com/brief/GTM/

### Nicaragua (NIC): 32/100, rank 151= of 198 (likely range 116 to 174), Weak, confidence: medium
In 2026, Nicaragua scores 32 of 100 on a person's right to see, control and share their own health record: rank 151= of 198 countries (likely range 116 to 174), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (40, against a median of 30 across 198 countries); its weakest is privacy and security (25, median 45).
Nicaragua's public clinics are moving to a digital record, but patients get only summaries, cannot opt out, and the data regulator was never created.
Scores: patient access to the full record 35; patient control and consent 25; privacy and security 25; connected care journey 34; protection from commercial use 35; clinician access at the point of care 30; research and trial consent 46; clinical AI governance 40.
Access: Ley 787 gives a general right to see one's personal data within 10 working days, but the MINSA record norm allows copies only with the facility head's permission. Patients get a discharge summary (epicrisis) and, on written request, a clinical summary, with no national portal.
Control: Patients have no way to opt out of the MINSA record or see who opened it, and the record norm names the police, prosecutors, courts and MINSA as authorities that may request records. Access inside MINSA systems is set by staff role.
Key laws: Ley No. 423, Ley General de Salud (2002); Decreto 001-2003, Reglamento de la Ley General de Salud (texto consolidado) (2023).
Brief and every source: https://healthrecordrights.com/brief/NIC/

### Saint Lucia (LCA): 32/100, rank 151= of 198 (likely range 114 to 173), Weak, confidence: medium
In 2026, Saint Lucia scores 32 of 100 on a person's right to see, control and share their own health record: rank 151= of 198 countries (likely range 114 to 173), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is patient control and consent (30, against a median of 30 across 198 countries); its weakest is patient access to the full record (25, median 43).
Saint Lucia's public clinics share one electronic record, but the patient's legal right to see it has not been switched on since 2011.
Scores: patient access to the full record 25; patient control and consent 30; privacy and security 38; connected care journey 35; protection from commercial use 35; clinician access at the point of care 32; research and trial consent 46; clinical AI governance 20.
Access: The Data Protection Act 2011 gives a right to a copy within 30 days for a fee, but that part of the Act has never been brought into force. There is no patient portal, so no enforceable right to the record exists.
Control: Consent rules for sensitive data have applied since January 2023, but health workers may process health data for care and service management without consent. Records are shared across all public clinics with no opt-out and no patient-visible access log.
Key laws: Data Protection Act, 2011 (No. 11 of 2011), Cap. 8.18 (2011); Data Protection Act (Commencement) Order, 2023 (S.I. 2023 No. 4) (2023).
Brief and every source: https://healthrecordrights.com/brief/LCA/

### Sao Tome and Principe (STP): 32/100, rank 151= of 198 (likely range 116 to 174), Weak, confidence: low
Weak evidence in 4 of 8 categories: control, journey, commercial and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Sao Tome and Principe scores 32 of 100 on a person's right to see, control and share their own health record: rank 151= of 198 countries (likely range 116 to 174), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is privacy and security (45, against a median of 45 across 198 countries); its weakest is clinician access at the point of care (17, median 34).
Sao Tome and Principe has a 2016 data law and an elected regulator, but clinical records are still kept mostly on paper.
Scores: patient access to the full record 35; patient control and consent 28; privacy and security 45; connected care journey 22; protection from commercial use 43; clinician access at the point of care 17; research and trial consent 45; clinical AI governance 18.
Access: The 2016 data law gives a right to obtain your data in intelligible form without excessive delay or cost, but health data must be seen through a doctor you choose. There is no patient portal, and records are mostly on paper.
Control: Health data may be used for care without consent if a professional bound by secrecy handles it and the regulator is notified. There is no shared record, so patients have no sharing setting, opt-out or access log.
Key laws: Lei 03/2016, Protecção de Dados Pessoais (2016); Lei 07/2017, Organisation and Functioning of the ANPDP (2017).
Brief and every source: https://healthrecordrights.com/brief/STP/

### Sri Lanka (LKA): 32/100, rank 151= of 198 (likely range 116 to 174), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, commercial, clinical and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Sri Lanka scores 32 of 100 on a person's right to see, control and share their own health record: rank 151= of 198 countries (likely range 116 to 174), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is clinical AI governance (30, against a median of 30 across 198 countries); its weakest is patient access to the full record (30, median 43).
Sri Lanka has a data protection law and regulator, but core duties start in 2027 and the national health record is still a plan.
Scores: patient access to the full record 30; patient control and consent 25; privacy and security 35; connected care journey 35; protection from commercial use 35; clinician access at the point of care 30; research and trial consent 43; clinical AI governance 30.
Access: The Medical Council says patients may see and copy their records, but this rests on professional rules. The general data access right in the PDPA (Part II) is still not in force, and there is no national patient portal.
Control: Patients have no working consent controls or access log for shared records today. The 2023 Digital Health Blueprint plans consent, opt-out directives and audit trails, but the national record behind them is still only proposed.
Key laws: Personal Data Protection Act, No. 9 of 2022 (2022); Personal Data Protection (Amendment) Act, No. 22 of 2025 (2025).
Brief and every source: https://healthrecordrights.com/brief/LKA/

### Tajikistan (TJK): 32/100, rank 151= of 198 (likely range 113 to 171), Weak, confidence: medium
In 2026, Tajikistan scores 32 of 100 on a person's right to see, control and share their own health record: rank 151= of 198 countries (likely range 113 to 171), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is research and trial consent (46, against a median of 46 across 198 countries); its weakest is privacy and security (30, median 45).
Tajik patients have a right to health information but no verified right to a copy; the national Tandurusti.tj platform was piloting in late 2025.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 30; connected care journey 30; protection from commercial use 35; clinician access at the point of care 25; research and trial consent 46; clinical AI governance 28.
Access: The 2018 data law gives access to one's own data, with replies due in 3 working days, but the Health Code lets doctors withhold harmful information. We found no explicit right to a copy and no patient portal: base 45, minus 5 for limited scope.
Control: Processing needs consent under the 2018 data law, but state bodies may process data without it while doing their legal functions. We found no opt-out from health record sharing, no patient-visible access log and no patient account on the national platform.
Key laws: Health Code of the Republic of Tajikistan (No. 1413) (2017); Law No. 1537 on Personal Data Protection (2018).
Brief and every source: https://healthrecordrights.com/brief/TJK/

### Cameroon (CMR): 31/100, rank 159= of 198 (likely range 118 to 175), Weak, confidence: medium
In 2026, Cameroon scores 31 of 100 on a person's right to see, control and share their own health record: rank 159= of 198 countries (likely range 118 to 175), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (50, against a median of 46 across 198 countries); its weakest is patient access to the full record (30, median 43).
A data law took full effect in June 2026, but no regulator had been set up by August 2026 and records stay inside each facility.
Scores: patient access to the full record 30; patient control and consent 28; privacy and security 40; connected care journey 25; protection from commercial use 42; clinician access at the point of care 22; research and trial consent 50; clinical AI governance 22.
Access: Law 2024/017 gives a right to a copy, but at the cost of reproduction, with deadlines left to a regulation and no regulator to enforce it. There is no patient portal, and the electronic record runs in about 50 pilot facilities.
Control: The law requires prior, specific consent and lets people object, but a health-protection exception applies and patients have no tools to set sharing rules or see who opened their file.
Key laws: Law No. 2024/017 on personal data protection (2024); Law No. 2022/008 on medical research involving humans (2022).
Brief and every source: https://healthrecordrights.com/brief/CMR/

### Nepal (NPL): 31/100, rank 159= of 198 (likely range 119 to 176), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, commercial, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Nepal scores 31 of 100 on a person's right to see, control and share their own health record: rank 159= of 198 countries (likely range 119 to 176), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. Its strongest right against the other countries is research and trial consent (50, against a median of 46 across 198 countries); its weakest is patient access to the full record (28, median 43).
Nepal makes consent the rule for health data, but patients cannot get a copy of their full record and each hospital keeps its own files.
Scores: patient access to the full record 28; patient control and consent 30; privacy and security 35; connected care journey 28; protection from commercial use 38; clinician access at the point of care 25; research and trial consent 50; clinical AI governance 25.
Access: We found no Nepali law that gives patients a right to a copy of their whole medical record. The Constitution and the Public Health Service Act give a right to be told about one's condition, and admitted patients get a discharge summary.
Control: The Privacy Act requires consent before anyone shares health examination details, but treatment, criminal investigations and national security are exempt. Patients have no opt-out tool and no way to see who opened their record.
Key laws: Constitution of Nepal 2015, Articles 28 and 35 (2015); The Privacy Act, 2075 (2018) (2018).
Brief and every source: https://healthrecordrights.com/brief/NPL/

### Syria (SYR): 31/100, rank 159= of 198 (likely range 123 to 177), Weak, confidence: low
Weak evidence in 5 of 8 categories: access, privacy, commercial, clinical and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Syria scores 31 of 100 on a person's right to see, control and share their own health record: rank 159= of 198 countries (likely range 123 to 177), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (42, against a median of 30 across 198 countries); its weakest is connected care journey (20, median 38).
Syria's 2024 data law covers only electronic records, and the new national health portal reached five public hospitals in 2026.
Scores: patient access to the full record 35; patient control and consent 25; privacy and security 36; connected care journey 20; protection from commercial use 42; clinician access at the point of care 18; research and trial consent 45; clinical AI governance 42.
Access: Law No. 12 of 2024 gives a right to obtain your personal data within 7 working days, but only electronic data, so paper hospital files fall outside it. An official portal at five public hospitals since April 2026 puts the score at the band's top.
Control: On paper, Law No. 12 requires written, explicit consent to process health data and lets people withdraw consent. In practice the ministry's portal privacy policy offers no sharing choices, and we found no opt-out or patient-visible access log.
Key laws: Law No. 12 of 2024 on Personal Data Protection (2024); Constitutional Declaration of the Syrian Arab Republic, Articles 13 and 51 (2025).
Brief and every source: https://healthrecordrights.com/brief/SYR/

### Honduras (HND): 30/100, rank 162= of 198 (likely range 127 to 180), Weak, confidence: medium
In 2026, Honduras scores 30 of 100 on a person's right to see, control and share their own health record: rank 162= of 198 countries (likely range 127 to 180), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is patient control and consent (30, against a median of 30 across 198 countries); its weakest is protection from commercial use (25, median 45).
Honduras has no data protection law and, per its health minister, the law still requires paper records, so each hospital keeps its own file.
Scores: patient access to the full record 40; patient control and consent 30; privacy and security 28; connected care journey 25; protection from commercial use 25; clinician access at the point of care 20; research and trial consent 43; clinical AI governance 30.
Access: The Constitution gives a free, fast right to see your own data, and public bodies must answer in 10 days, but there is no national patient portal. A right to a copy of the clinical record was not verified, so the score sits low.
Control: Patients have no tools to choose who sees their record or to view an access log. Protection rests on medical secrecy in the doctors' ethics code and a Transparency Law rule that personal data goes only to the person or a court.
Key laws: Constitucion de la Republica, Articulo 182 (Habeas Data) (2003); Ley de Transparencia y Acceso a la Informacion Publica (Decreto 170-2006) (2006).
Brief and every source: https://healthrecordrights.com/brief/HND/

### Iran (IRN): 30/100, rank 162= of 198 (likely range 122 to 179), Weak, confidence: low
Weak evidence in 5 of 8 categories: access, privacy, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Iran scores 30 of 100 on a person's right to see, control and share their own health record: rank 162= of 198 countries (likely range 122 to 179), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is connected care journey (40, against a median of 38 across 198 countries); its weakest is privacy and security (15, median 45).
Iranians can see insurer prescription records, but there is no data protection law, and in January 2026 security forces reportedly tracked protesters through hospital records.
Scores: patient access to the full record 40; patient control and consent 22; privacy and security 15; connected care journey 40; protection from commercial use 30; clinician access at the point of care 30; research and trial consent 45; clinical AI governance 30.
Access: A 2009 ministerial charter, not a statute, says patients may see their whole clinical record and get a copy. Insurer apps show prescription and treatment history, but no national patient portal to the full record was verified.
Control: The 2024 Seventh Plan Law makes every provider send health data to a central state database in real time. No patient opt-out or access log was found, and a UN report says security forces seized hospital admission lists in January 2026.
Key laws: Patient Rights Charter (منشور حقوق بیمار) (2009); Electronic Commerce Law (قانون تجارت الکترونیکی) (2004).
Brief and every source: https://healthrecordrights.com/brief/IRN/

### Saint Kitts and Nevis (KNA): 30/100, rank 162= of 198 (likely range 127 to 180), Weak, confidence: medium
In 2026, Saint Kitts and Nevis scores 30 of 100 on a person's right to see, control and share their own health record: rank 162= of 198 countries (likely range 127 to 180), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is patient control and consent (30, against a median of 30 across 198 countries); its weakest is protection from commercial use (28, median 45).
Saint Kitts and Nevis began rolling out a national digital health record in 2026, but its 2018 data protection law has never come into force.
Scores: patient access to the full record 30; patient control and consent 30; privacy and security 32; connected care journey 32; protection from commercial use 28; clinician access at the point of care 25; research and trial consent 43; clinical AI governance 20.
Access: The Data Protection Act 2018 would give a right to a copy within 30 days for a fee, but it awaits a commencement order, so no right is enforceable. The Ministry's new system promises access through a patient portal; patient use was not verified.
Control: With the Data Protection Act not in force, patients have no legal say over who sees their health records. The NDHIS website says patients can see who opened their record, but whether that works in practice was not verified.
Key laws: Data Protection Act, 2018 (No. 5 of 2018) (2018); Freedom of Information Act, 2018 (No. 6 of 2018), amended 2023 and 2024 (2018).
Brief and every source: https://healthrecordrights.com/brief/KNA/

### Samoa (WSM): 30/100, rank 162= of 198 (likely range 122 to 180), Weak, confidence: high
In 2026, Samoa scores 30 of 100 on a person's right to see, control and share their own health record: rank 162= of 198 countries (likely range 122 to 180), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinician access at the point of care (48, against a median of 34 across 198 countries); its weakest is protection from commercial use (20, median 45).
Samoa now runs one Ministry electronic record across its main and district hospitals, but has no data protection law and no patient controls.
Scores: patient access to the full record 25; patient control and consent 25; privacy and security 25; connected care journey 45; protection from commercial use 20; clinician access at the point of care 48; research and trial consent 43; clinical AI governance 18.
Access: A 2015 Ministry of Health policy lists a patient right to access health information and to receive a medical report on request, but no law gives that right. There is no patient portal, and no deadline or fee rule was found.
Control: The Ministry's eHealth policy proposes that the Ministry be the authority granting access to health data, and a patient consent law it called for in 2017 was never found. Records are shared inside one central system with no opt-out or patient-visible access log.
Key laws: Constitution of the Independent State of Samoa, Part II (1962); Telecommunications Act 2005, sections 48 to 51 (2005).
Brief and every source: https://healthrecordrights.com/brief/WSM/

### Bolivia (BOL): 29/100, rank 166= of 198 (likely range 134 to 184), Weak, confidence: medium
In 2026, Bolivia scores 29 of 100 on a person's right to see, control and share their own health record: rank 166= of 198 countries (likely range 134 to 184), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is patient control and consent (28, against a median of 30 across 198 countries); its weakest is privacy and security (25, median 45).
Bolivian patients can ask for a copy of their record, but with no data protection law or shared record, the hospital holds the keys.
Scores: patient access to the full record 40; patient control and consent 28; privacy and security 25; connected care journey 25; protection from commercial use 25; clinician access at the point of care 22; research and trial consent 43; clinical AI governance 20.
Access: A 2008 Health Ministry norm says patients may not be refused access to their record and may get a certified paper or digital copy, but it sets no deadline and asks patients not in hospital for a notarised request. No national patient portal exists.
Control: Ley 3131 makes medical secrecy a patient right, and the 2008 norm requires the patient's written authorisation before clinical details go to third parties. There is no opt-out, no patient-visible access log, and the facility, not the patient, controls the record.
Key laws: Constitucion Politica del Estado (2009); Ley 3131 del Ejercicio Profesional Medico (2005).
Brief and every source: https://healthrecordrights.com/brief/BOL/

### Fiji (FJI): 29/100, rank 166= of 198 (likely range 133 to 183), Weak, confidence: low
Weak evidence in 7 of 8 categories: access, privacy, journey, commercial, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Fiji scores 29 of 100 on a person's right to see, control and share their own health record: rank 166= of 198 countries (likely range 133 to 183), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is patient control and consent (28, against a median of 30 across 198 countries); its weakest is protection from commercial use (20, median 45).
Fiji guarantees privacy in its Constitution but has no data protection law or regulator, no patient portal and no patient say over sharing.
Scores: patient access to the full record 35; patient control and consent 28; privacy and security 30; connected care journey 30; protection from commercial use 20; clinician access at the point of care 25; research and trial consent 43; clinical AI governance 18.
Access: Section 25 of the 2013 Constitution gives a right of access to information held by any public office. No health-specific right to a copy, deadline, fee rule or national patient portal was verified.
Control: Ministry systems such as PATISPlus share records among health workers with no opt-out or patient-visible access log that we found. Only HIV information has a statutory consent rule for disclosure.
Key laws: Constitution of the Republic of Fiji 2013, sections 24 and 25 (2013); HIV/AIDS Decree 2011 (Decree No. 5 of 2011) (2011).
Brief and every source: https://healthrecordrights.com/brief/FJI/

### Guyana (GUY): 29/100, rank 166= of 198 (likely range 131 to 182), Weak, confidence: medium
In 2026, Guyana scores 29 of 100 on a person's right to see, control and share their own health record: rank 166= of 198 countries (likely range 131 to 182), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is connected care journey (35, against a median of 38 across 198 countries); its weakest is protection from commercial use (25, median 45).
Guyana began a national electronic health record in 2026, but its 2023 data protection law still has no commencement order.
Scores: patient access to the full record 30; patient control and consent 25; privacy and security 30; connected care journey 35; protection from commercial use 25; clinician access at the point of care 30; research and trial consent 43; clinical AI governance 20.
Access: The Data Protection Act 2023 promises a free copy within one month, but no commencement order had been shown by September 2026. The 2011 Access to Information Act reaches public hospital files, slowly, so this sits near the top of the no-enforceable-right band.
Control: The new EHR follows a "one patient, one record" rule across public facilities, with no opt-out and no access log a patient can see. Access is role-based and staff entries are traceable, but the consent rules of the 2023 Act are not in force.
Key laws: Data Protection Act 2023 (Act No. 18 of 2023) (2023); Access to Information Act 2011 (Act No. 21 of 2011) (2011).
Brief and every source: https://healthrecordrights.com/brief/GUY/

### Kiribati (KIR): 29/100, rank 166= of 198 (likely range 134 to 183), Weak, confidence: low
Weak evidence in 8 of 8 categories: access, control, privacy, journey, commercial, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Kiribati scores 29 of 100 on a person's right to see, control and share their own health record: rank 166= of 198 countries (likely range 134 to 183), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is patient control and consent (28, against a median of 30 across 198 countries); its weakest is protection from commercial use (25, median 45).
Kiribati passed a data protection law in 2025 but no start date was verified, and only its main hospitals keep electronic records.
Scores: patient access to the full record 30; patient control and consent 28; privacy and security 32; connected care journey 28; protection from commercial use 25; clinician access at the point of care 27; research and trial consent 43; clinical AI governance 20.
Access: The Data Protection Act 2025 gives a right to a free electronic copy of personal data, but no commencement notice was found, so it is not verified as in force. There is no patient portal.
Control: Hospital records are shared among staff in the Tamanu system, with no patient opt-out or patient-visible access log found. A 2023 law requires written consent before others access personal data held by public bodies; whether it covers health staff was not verified.
Key laws: Data Protection Act 2025 (2025); Digital Government Act 2023 (2023).
Brief and every source: https://healthrecordrights.com/brief/KIR/

### Laos (LAO): 29/100, rank 166= of 198 (likely range 133 to 183), Weak, confidence: medium
In 2026, Laos scores 29 of 100 on a person's right to see, control and share their own health record: rank 166= of 198 countries (likely range 133 to 183), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (35, against a median of 30 across 198 countries); its weakest is patient access to the full record (25, median 43).
Laos protects electronic data and patient confidentiality on paper, but patients cannot get their records and no shared health record exists.
Scores: patient access to the full record 25; patient control and consent 28; privacy and security 35; connected care journey 26; protection from commercial use 35; clinician access at the point of care 20; research and trial consent 45; clinical AI governance 35.
Access: No law gives patients a right to a copy of their medical record. The 2017 Electronic Data Protection Law lets people access their own electronic data, but most records are not electronic and there is no national portal.
Control: The data law requires the owner's permission before personal data is used or passed on, unless another law says otherwise or a competent state body asks for it. We found no opt-out, no granular choices and no access log patients can see.
Key laws: Law on Electronic Data Protection (No. 25/NA) (2017); Law on Health Care (amended) (2023).
Brief and every source: https://healthrecordrights.com/brief/LAO/

### Trinidad and Tobago (TTO): 29/100, rank 166= of 198 (likely range 132 to 182), Weak, confidence: medium
In 2026, Trinidad and Tobago scores 29 of 100 on a person's right to see, control and share their own health record: rank 166= of 198 countries (likely range 132 to 182), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is privacy and security (28, median 45).
Most of the 2011 Data Protection Act has never come into force, so patients rely on freedom of information requests and mostly paper hospital files.
Scores: patient access to the full record 35; patient control and consent 25; privacy and security 28; connected care journey 30; protection from commercial use 28; clinician access at the point of care 25; research and trial consent 43; clinical AI governance 22.
Access: Public patients can get their hospital file through a Freedom of Information Act request, decided within 30 days, but copies carry a fee. Private clinics are not covered because the data protection rules for business were never brought into force, and there is no portal.
Control: The Act's rule that public bodies need consent to process health data, and may disclose medical information only with consent or a court order, is not in force. No opt-out from sharing and no patient-visible access log were found.
Key laws: Data Protection Act, Chap. 22:04 (Act 13 of 2011), partly proclaimed (2011); Freedom of Information Act, Chap. 22:02 (1999).
Brief and every source: https://healthrecordrights.com/brief/TTO/

### Palestine (PSE): 28/100, rank 172= of 198 (likely range 142 to 187), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, control, clinical and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Palestine scores 28 of 100 on a person's right to see, control and share their own health record: rank 172= of 198 countries (likely range 142 to 187), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-02.
The government decides, with limited individual say. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is patient access to the full record (25, median 43).
No law we found gives Palestinian patients a copy of their record; the ministry's system runs in 15 hospitals and, it says, Gaza's was lost.
Scores: patient access to the full record 25; patient control and consent 25; privacy and security 28; connected care journey 30; protection from commercial use 30; clinician access at the point of care 28; research and trial consent 49; clinical AI governance 20.
Access: We found no Palestinian law that gives patients a right to see or copy their file: the 2004 Public Health Law lists five patient rights, none of them access. The government Hukumati portal shows test results, insurance status and referrals only.
Control: Patients have no opt-out, no consent setting and no access log in the ministry's systems; none was found. The 2018 decree-law bars staff from revealing patient secrets, except to competent bodies in cases set by law.
Key laws: Public Health Law No. 20 of 2004 (2004); Decree-Law No. 31 of 2018 on Medical and Health Protection and Safety (2018).
Brief and every source: https://healthrecordrights.com/brief/PSE/

### Timor-Leste (TLS): 28/100, rank 172= of 198 (likely range 144 to 187), Weak, confidence: medium
In 2026, Timor-Leste scores 28 of 100 on a person's right to see, control and share their own health record: rank 172= of 198 countries (likely range 144 to 187), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is research and trial consent (45, against a median of 46 across 198 countries); its weakest is protection from commercial use (22, median 45).
Timor-Leste's Constitution promises access to personal data, but no data protection law is in force and a draft only went to consultation in August 2026.
Scores: patient access to the full record 30; patient control and consent 28; privacy and security 30; connected care journey 28; protection from commercial use 22; clinician access at the point of care 20; research and trial consent 45; clinical AI governance 20.
Access: Article 38 of the Constitution gives citizens a right of access to personal data in computer and manual records, but the law meant to set its conditions does not exist. We found no right to a copy of a medical record and no patient portal.
Control: The Constitution bans computer processing of private-life data without consent, and the health law lets patients refuse care. There is no data law, no consent tool and no access log, so the Ministry of Health decides how records are used.
Key laws: Constitution of the Democratic Republic of Timor-Leste, Articles 36, 38, 57 (2002); Law No. 10/2004 on the Health System (2004).
Brief and every source: https://healthrecordrights.com/brief/TLS/

### Venezuela (VEN): 28/100, rank 172= of 198 (likely range 140 to 187), Weak, confidence: medium
In 2026, Venezuela scores 28 of 100 on a person's right to see, control and share their own health record: rank 172= of 198 countries (likely range 140 to 187), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is clinical AI governance (35, against a median of 30 across 198 countries); its weakest is privacy and security (25, median 45).
Venezuela tied a national digital health record to the Sistema Patria in 2025, with no data protection law and patients entitled only to a summary.
Scores: patient access to the full record 35; patient control and consent 22; privacy and security 25; connected care journey 25; protection from commercial use 30; clinician access at the point of care 22; research and trial consent 46; clinical AI governance 35.
Access: The 1998 Ley Organica de Salud gives patients a written, certified summary of their record on demand, not a full copy. The doctors' ethics code bars patients from examining the record directly, and patient access to the new national platform is not verified.
Control: The national digital clinical record launched in November 2025 is centralised and tied to the Sistema Patria, and no opt-out, consent switch or access log for patients was found. With no data protection law, the state decides who sees the data.
Key laws: Constitucion de la Republica Bolivariana de Venezuela (1999); Ley Organica de Salud (1998).
Brief and every source: https://healthrecordrights.com/brief/VEN/

### Iraq (IRQ): 27/100, rank 175= of 198 (likely range 149 to 189), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Iraq scores 27 of 100 on a person's right to see, control and share their own health record: rank 175= of 198 countries (likely range 149 to 189), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is research and trial consent (45, against a median of 46 across 198 countries); its weakest is privacy and security (25, median 45).
Iraq has no data protection law and mostly paper records; we found a legal right to a free record copy only in Kurdistan.
Scores: patient access to the full record 30; patient control and consent 25; privacy and security 25; connected care journey 25; protection from commercial use 25; clinician access at the point of care 28; research and trial consent 45; clinical AI governance 20.
Access: Kurdistan's Law No. 4 of 2020 gives patients a free copy of their medical file, but we found no matching federal right for the rest of Iraq. The insurer's Damani platform holds an electronic file, but the patient features described are booking, covered services and remaining visits.
Control: In the state insurer's digital system, records are shared by default: a doctor who enters a Damani insurance number sees the patient's full medical history. We found no opt-out, consent choices or patient-visible access log.
Key laws: Constitution of the Republic of Iraq, Article 17 (2005); Penal Code No. 111 of 1969, Articles 437 and 438 (1969).
Brief and every source: https://healthrecordrights.com/brief/IRQ/

### Sierra Leone (SLE): 27/100, rank 175= of 198 (likely range 153 to 191), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, control, commercial and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Sierra Leone scores 27 of 100 on a person's right to see, control and share their own health record: rank 175= of 198 countries (likely range 153 to 191), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (46, against a median of 46 across 198 countries); its weakest is protection from commercial use (22, median 45).
Sierra Leone has no data protection law yet, so patient rights rest on a health ministry policy while most clinics still keep paper records.
Scores: patient access to the full record 32; patient control and consent 25; privacy and security 28; connected care journey 24; protection from commercial use 22; clinician access at the point of care 17; research and trial consent 46; clinical AI governance 22.
Access: No health law gives patients a right to a copy of their record. The Right to Access Information Act 2013 lets anyone request information from public bodies within 15 working days, but whether hospitals honour it for medical records is not verified.
Control: The 2007 HIV Act requires written consent to disclose an HIV test result, and a 2021 ministry policy asks for written consent before sharing with third parties. There is no opt-out or access log, and the data terms of a December 2025 US health MOU are unpublished.
Key laws: Right to Access Information Act, 2013 (2013); Prevention and Control of HIV and AIDS Act, 2007 (2007).
Brief and every source: https://healthrecordrights.com/brief/SLE/

### Grenada (GRD): 26/100, rank 177= of 198 (likely range 155 to 192), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, journey, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Grenada scores 26 of 100 on a person's right to see, control and share their own health record: rank 177= of 198 countries (likely range 155 to 192), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is protection from commercial use (25, median 45).
Grenada passed a Data Protection Act in 2023 but has not switched it on, so patients still have no enforceable right over their health records.
Scores: patient access to the full record 25; patient control and consent 25; privacy and security 30; connected care journey 25; protection from commercial use 25; clinician access at the point of care 20; research and trial consent 43; clinical AI governance 20.
Access: The Data Protection Act 2023 would give a right to see personal data within 60 days for a fee, but it is not in force, so no enforceable right exists. There is no patient portal, and the hospital records process was not verified.
Control: With the Data Protection Act not in force, patients have no legal say over who sees or shares their health records. The Act, once started, would still let health professionals process health data for medical purposes without written consent.
Key laws: Data Protection Act, No. 1 of 2023 (2023); Electronic Crimes Act, No. 23 of 2013 (2013).
Brief and every source: https://healthrecordrights.com/brief/GRD/

### Liberia (LBR): 26/100, rank 177= of 198 (likely range 154 to 191), Weak, confidence: medium
In 2026, Liberia scores 26 of 100 on a person's right to see, control and share their own health record: rank 177= of 198 countries (likely range 154 to 191), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (46, against a median of 46 across 198 countries); its weakest is protection from commercial use (25, median 45).
Liberia signed its first data protection law in August 2026, but clinic records are mostly paper and a US aid deal allows patient data audits.
Scores: patient access to the full record 28; patient control and consent 25; privacy and security 32; connected care journey 22; protection from commercial use 25; clinician access at the point of care 15; research and trial consent 46; clinical AI governance 25.
Access: No law in force that we opened gives every patient a right to see or copy their medical record. The new Data Protection Act was signed in August 2026, but its access rules are not verified, so this stays in the 15 to 35 band.
Control: Disclosing an HIV test result needs the person's prior written consent, but no general consent rule for health records was verified. A December 2025 US aid deal commits Liberia to give US officials 'any data access' for audits, with no explicit privacy safeguards.
Key laws: Personal Data Protection and Privacy Act of 2024 (signed August 2026) (2026); Act to Amend the Public Health Law, Title 33, Chapter 18 (HIV and AIDS) (2010).
Brief and every source: https://healthrecordrights.com/brief/LBR/

### Namibia (NAM): 26/100, rank 177= of 198 (likely range 157 to 192), Weak, confidence: medium
In 2026, Namibia scores 26 of 100 on a person's right to see, control and share their own health record: rank 177= of 198 countries (likely range 157 to 192), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is protection from commercial use (18, median 45).
Namibia has no data protection law in force and no shared patient record, so patients rely on a charter, ethics rules and the Constitution.
Scores: patient access to the full record 28; patient control and consent 25; privacy and security 28; connected care journey 25; protection from commercial use 18; clinician access at the point of care 22; research and trial consent 43; clinical AI governance 20.
Access: The Ministry's Patient Charter promises you can obtain and inspect a copy of your health information, but no law in force gives an enforceable right. The 2022 Access to Information Act is still not in force.
Control: The Patient Charter says health information will not be disclosed without consent, but no law gives patients sharing choices, an opt-out or an access log. Facilities hold the record and decide how it is used.
Key laws: Namibian Constitution, Article 13 (1990); Public and Environmental Health Act 1 of 2015 (2015).
Brief and every source: https://healthrecordrights.com/brief/NAM/

### Pakistan (PAK): 26/100, rank 177= of 198 (likely range 156 to 192), Weak, confidence: medium
In 2026, Pakistan scores 26 of 100 on a person's right to see, control and share their own health record: rank 177= of 198 countries (likely range 156 to 192), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (45, against a median of 46 across 198 countries); its weakest is patient access to the full record (25, median 43).
Pakistan has no data protection law, mostly paper records and no patient portal, so patients rely on doctors' ethics rules to protect records.
Scores: patient access to the full record 25; patient control and consent 25; privacy and security 28; connected care journey 24; protection from commercial use 27; clinician access at the point of care 20; research and trial consent 45; clinical AI governance 22.
Access: Pakistan has no data protection law giving a right to a copy of one's record; the 2023 bill was withdrawn in a Senate committee. An older doctors' ethics code allows copies or summaries, with no deadline; the 2026 code's wording was not verified, and there is no portal.
Control: The only consent rule is in the doctors' ethics code: records must not be handed to anyone without the patient's consent. There is no opt-out, no access log and no digital consent tool, and providers decide in practice.
Key laws: Prevention of Electronic Crimes Act, 2016 (2016); Digital Nation Pakistan Act, 2025 (2025).
Brief and every source: https://healthrecordrights.com/brief/PAK/

### Papua New Guinea (PNG): 26/100, rank 177= of 198 (likely range 157 to 193), Weak, confidence: medium
In 2026, Papua New Guinea scores 26 of 100 on a person's right to see, control and share their own health record: rank 177= of 198 countries (likely range 157 to 193), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is patient control and consent (28, against a median of 30 across 198 countries); its weakest is protection from commercial use (20, median 45).
Papua New Guinea has no data protection law in force, no patient portal, and electronic records in 4 of 3,234 health facilities.
Scores: patient access to the full record 30; patient control and consent 28; privacy and security 30; connected care journey 20; protection from commercial use 20; clinician access at the point of care 15; research and trial consent 43; clinical AI governance 20.
Access: Section 51 of the Constitution gives citizens reasonable access to official documents, but no law sets a procedure, and the Right to Information Policy was only validated in June 2026. No health-specific right to a copy and no patient portal were verified.
Control: The Health Department decides who can use health data: access to the national eNHIS database is granted by health officials and, for partners, by the Health Secretary under an MOU. Only HIV information has a statutory consent rule for disclosure.
Key laws: Constitution of the Independent State of Papua New Guinea, sections 49 and 51 (1975); HIV/AIDS Management and Prevention Act 2003 (2003).
Brief and every source: https://healthrecordrights.com/brief/PNG/

### Saint Vincent and the Grenadines (VCT): 26/100, rank 177= of 198 (likely range 154 to 191), Weak, confidence: medium
In 2026, Saint Vincent and the Grenadines scores 26 of 100 on a person's right to see, control and share their own health record: rank 177= of 198 countries (likely range 154 to 191), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is protection from commercial use (20, median 45).
Saint Vincent and the Grenadines has an electronic record in its public clinics, but its only privacy law has not been in force since 2003.
Scores: patient access to the full record 25; patient control and consent 25; privacy and security 25; connected care journey 30; protection from commercial use 20; clinician access at the point of care 28; research and trial consent 43; clinical AI governance 20.
Access: No law gives patients an enforceable right to their record: the Privacy Act 2003 and Freedom of Information Act 2003 were never brought into force. A hospital policy promises a free review and a paid copy, but no portal exists.
Control: With no privacy law in force, patients have no legal say over who sees their health data. Records sit in a single ministry system used across public clinics, with no opt-out or patient-visible access log found.
Key laws: Privacy Act, 2003 (No. 18 of 2003) (2003); Freedom of Information Act, 2003 (No. 27 of 2003) (2003).
Brief and every source: https://healthrecordrights.com/brief/VCT/

### Cambodia (KHM): 25/100, rank 183= of 198 (likely range 158 to 193), Weak, confidence: low
Weak evidence in 7 of 8 categories: control, privacy, journey, commercial, clinical, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Cambodia scores 25 of 100 on a person's right to see, control and share their own health record: rank 183= of 198 countries (likely range 158 to 193), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (45, against a median of 46 across 198 countries); its weakest is protection from commercial use (25, median 45).
Cambodia has no data protection law yet, so patient records stay with each provider under a 2003 ethics code while a draft law waits.
Scores: patient access to the full record 25; patient control and consent 25; privacy and security 30; connected care journey 22; protection from commercial use 25; clinician access at the point of care 20; research and trial consent 45; clinical AI governance 18.
Access: No statute gives Cambodian patients a right to a copy of their full record; the 2007 clients' rights guideline is a guideline, not a law. The only national patient view verified is vaccination history in the MyHealth mini-app.
Control: Records are held by each provider, and doctors may share them with other doctors on the patient's request or consent under the 2003 ethics code. No opt-out, granular choice or patient-visible access log was found.
Key laws: Sub-Decree No. 61 on Physicians' Code of Ethics (2003); Law on Electronic Commerce (NS/RKM/1119/017) (2019).
Brief and every source: https://healthrecordrights.com/brief/KHM/

### Micronesia (FSM): 25/100, rank 183= of 198 (likely range 159 to 194), Weak, confidence: low
Weak evidence in 4 of 8 categories: access, journey, clinical and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Micronesia scores 25 of 100 on a person's right to see, control and share their own health record: rank 183= of 198 countries (likely range 159 to 194), in the Weak band (25 to 44). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. Its strongest right against the other countries is research and trial consent (49, against a median of 46 across 198 countries); its weakest is protection from commercial use (15, median 45).
Micronesia is joining its state hospital records into one national system, but no law yet gives patients access, consent or privacy rights.
Scores: patient access to the full record 20; patient control and consent 22; privacy and security 22; connected care journey 34; protection from commercial use 15; clinician access at the point of care 34; research and trial consent 49; clinical AI governance 20.
Access: Micronesia has no data protection law and no statutory right to see or copy a health record was found. The 2025 data protection bill is still pending, covers only national departments, and contains no access right.
Control: Records now sit in one national system that a clinician can open from any state, with no opt-out or patient-visible access log found. The cancer registry law requires reporting every case and only tells the patient it was reported.
Key laws: Constitution of the FSM, Article IV, section 5 (1978); Cancer Registry System Act (PL 15-39), 41 F.S.M.C. 1101-1108 (2008).
Brief and every source: https://healthrecordrights.com/brief/FSM/

### Solomon Islands (SLB): 25/100, rank 183= of 198 (likely range 161 to 194), Weak, confidence: medium
In 2026, Solomon Islands scores 25 of 100 on a person's right to see, control and share their own health record: rank 183= of 198 countries (likely range 161 to 194), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is protection from commercial use (20, median 45).
Solomon Islands has no data protection law, no right-to-information law and no electronic patient record; most patients carry their own paper booklet.
Scores: patient access to the full record 30; patient control and consent 25; privacy and security 25; connected care journey 20; protection from commercial use 20; clinician access at the point of care 20; research and trial consent 43; clinical AI governance 18.
Access: No law gives patients a right to see or copy their health record, and there is no right-to-information law. In practice most patients keep their own paper care booklet, which the World Bank says is at high risk of being lost or damaged.
Control: Patients have no legal say over who sees or uses their health data, no opt-out and no access log. There is no general data protection law, so control rests with the Ministry of Health and individual clinicians.
Key laws: Constitution of Solomon Islands 1978, sections 9 and 12 (1978); Medical and Dental Practitioners Act 1988 (No. 7 of 1988) (1988).
Brief and every source: https://healthrecordrights.com/brief/SLB/

### South Sudan (SSD): 25/100, rank 183= of 198 (likely range 161 to 194), Weak, confidence: medium
In 2026, South Sudan scores 25 of 100 on a person's right to see, control and share their own health record: rank 183= of 198 countries (likely range 161 to 194), in the Weak band (25 to 44). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is protection from commercial use (20, median 45).
South Sudan has no data protection law, mostly paper records and no shared record; a free legal route to your own file exists on paper.
Scores: patient access to the full record 34; patient control and consent 24; privacy and security 22; connected care journey 20; protection from commercial use 20; clinician access at the point of care 18; research and trial consent 43; clinical AI governance 20.
Access: The Right of Access to Information Act 2013 lets citizens request records about themselves free, with a reply in 7 working days. It is not a health records law and its commission has lacked staff and money, so 34, the band of Sierra Leone (32).
Control: No law sets consent rules for health data, and patients have no opt-out and no access log. The only tools are a constitutional privacy right and a rule letting a body refuse to release a third party's personal information unless that person consents.
Key laws: Transitional Constitution 2011 (revised 2013), Articles 22 and 32 (2011); Right of Access to Information Act 2013 (Act No. 65) (2013).
Brief and every source: https://healthrecordrights.com/brief/SSD/

### Dominica (DMA): 24/100, rank 187= of 198 (likely range 167 to 196), Poor, confidence: high
In 2026, Dominica scores 24 of 100 on a person's right to see, control and share their own health record: rank 187= of 198 countries (likely range 167 to 196), in the Poor band (0 to 24). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is protection from commercial use (20, median 45).
Dominica has no data protection law, and the national health record system it has announced was still being prepared for rollout in mid-2026.
Scores: patient access to the full record 20; patient control and consent 25; privacy and security 25; connected care journey 25; protection from commercial use 20; clinician access at the point of care 20; research and trial consent 43; clinical AI governance 20.
Access: No law gives patients a right to see or copy their health record: Dominica has no data protection act and no freedom of information act. A patient portal is planned in the national health information system, but it is not live.
Control: With no data protection law, patients have no legal right to consent to or refuse sharing of their health data. The planned HMIS promises role-based access, an audit trail and patient choice over private doctors, but none of this is live.
Key laws: Constitution of the Commonwealth of Dominica (1978); Dominica Hospitals Authority Act, 2021 (No. 8 of 2021), amended by Act No. 13 of 2024 (2021).
Brief and every source: https://healthrecordrights.com/brief/DMA/

### Haiti (HTI): 24/100, rank 187= of 198 (likely range 167 to 196), Poor, confidence: low
Weak evidence in 4 of 8 categories: access, control, journey and clinical. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Haiti scores 24 of 100 on a person's right to see, control and share their own health record: rank 187= of 198 countries (likely range 167 to 196), in the Poor band (0 to 24). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (46, against a median of 46 across 198 countries); its weakest is patient access to the full record (20, median 43).
Haiti has no data protection law and no verified right to see your record; an HIV-born electronic record links some clinics, not the country.
Scores: patient access to the full record 20; patient control and consent 22; privacy and security 24; connected care journey 28; protection from commercial use 22; clinician access at the point of care 22; research and trial consent 46; clinical AI governance 18.
Access: No Haitian law found gives patients a right to see or copy their medical record, and a June 2026 legal analysis says a decade passed without a data protection law. There is no patient portal; any access right in health regulations is not verified.
Control: Without a data protection law, patients have no legal right to consent, refuse sharing or see who opened their record. The iSantePlus record is shared across connected sites by design, and its fingerprint register held more than 100,000 prints.
Key laws: Code penal (1835, as amended), Article 323 (1835); Decret du 11 mars 2020 portant Code penal (not in force) (2020).
Brief and every source: https://healthrecordrights.com/brief/HTI/

### Libya (LBY): 23/100, rank 189= of 198 (likely range 172 to 197), Poor, confidence: high
In 2026, Libya scores 23 of 100 on a person's right to see, control and share their own health record: rank 189= of 198 countries (likely range 172 to 197), in the Poor band (0 to 24). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (46, against a median of 46 across 198 countries); its weakest is patient access to the full record (20, median 43).
Libya has no data protection law and mostly paper records; a 1986 law protects medical secrets, but patients have no verified right to their file.
Scores: patient access to the full record 20; patient control and consent 22; privacy and security 25; connected care journey 18; protection from commercial use 25; clinician access at the point of care 17; research and trial consent 46; clinical AI governance 25.
Access: No Libyan law we opened gives patients a right to see or copy their medical record, and Libya has no data protection law. Records are still mostly on paper, and no patient portal was found.
Control: Patients have no legal tools to decide who sees their health record: no opt-out, no granular consent and no access log. The main protection is a 1986 duty on medical staff to keep patient secrets.
Key laws: Constitutional Declaration of 2011, Articles 12 and 13 (2011); Health Law No. 106 of 1973 (1973).
Brief and every source: https://healthrecordrights.com/brief/LBY/

### Marshall Islands (MHL): 23/100, rank 189= of 198 (likely range 170 to 196), Poor, confidence: low
Weak evidence in 4 of 8 categories: access, journey, research and AI. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Marshall Islands scores 23 of 100 on a person's right to see, control and share their own health record: rank 189= of 198 countries (likely range 170 to 196), in the Poor band (0 to 24). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is research and trial consent (46, against a median of 46 across 198 countries); its weakest is protection from commercial use (15, median 45).
A 2025 data law covering only government bodies gives no record access right and is not yet in force, while most records stay on paper.
Scores: patient access to the full record 20; patient control and consent 25; privacy and security 30; connected care journey 20; protection from commercial use 15; clinician access at the point of care 18; research and trial consent 46; clinical AI governance 18.
Access: No law giving patients a right to see or copy their health record was found, and there is no patient portal. The 2025 data protection law covers only government bodies, has no access right and takes effect 12 months after its 7 October 2025 certification.
Control: No opt-out, granular choice or patient-visible access log was found. Only sexually transmitted disease information has a statutory consent rule, and the 2025 law lets ministries share personal data with each other without asking the person.
Key laws: Constitution of the Republic of the Marshall Islands, Article II section 13 (1979); Personal Data Protection Act 2025 (P.L. 2025-43) (2025).
Brief and every source: https://healthrecordrights.com/brief/MHL/

### Tuvalu (TUV): 23/100, rank 189= of 198 (likely range 169 to 196), Poor, confidence: medium
In 2026, Tuvalu scores 23 of 100 on a person's right to see, control and share their own health record: rank 189= of 198 countries (likely range 169 to 196), in the Poor band (0 to 24). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is protection from commercial use (15, median 45).
Tuvalu has no data protection law, no regulator and no right to your record; its one hospital runs a closed, poorly maintained system.
Scores: patient access to the full record 20; patient control and consent 25; privacy and security 22; connected care journey 24; protection from commercial use 15; clinician access at the point of care 25; research and trial consent 43; clinical AI governance 25.
Access: No law gives patients a right to see or copy their health record: Tuvalu has no data protection act, and its Constitution protects only against searches of person and property. There is no patient portal.
Control: Patients have no legal say over who sees their records. A new Tamanu record at the Maternal and Child Health clinic lets clinicians at different facilities open the same record; we found no opt-out or patient-visible access log.
Key laws: Constitution of Tuvalu Act 2023, section 21 (2023); Health Professionals Act 2016 (2016).
Brief and every source: https://healthrecordrights.com/brief/TUV/

### Yemen (YEM): 23/100, rank 189= of 198 (likely range 169 to 196), Poor, confidence: medium
In 2026, Yemen scores 23 of 100 on a person's right to see, control and share their own health record: rank 189= of 198 countries (likely range 169 to 196), in the Poor band (0 to 24). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (46, against a median of 46 across 198 countries); its weakest is privacy and security (22, median 45).
Yemen, split between rival authorities and at war, has no data protection law; most clinics still keep paper records and no patient portal exists.
Scores: patient access to the full record 25; patient control and consent 25; privacy and security 22; connected care journey 20; protection from commercial use 22; clinician access at the point of care 15; research and trial consent 46; clinical AI governance 18.
Access: Law No. 13 of 2012 lets a person see only the personal data they gave a public body, so it is not a right to the whole chart. With paper records in most facilities and no portal, Yemen sits between Sudan (22) and Iraq (30).
Control: Patients have no consent tools, no opt-out and no access log. Law No. 13 does require written consent before a public body passes personal data to a third party, which puts Yemen just above Sudan (22).
Key laws: Constitution of the Republic of Yemen, Article 53 (1991); Law No. 13 of 2012 on the Right of Access to Information (2012).
Brief and every source: https://healthrecordrights.com/brief/YEM/

### Eritrea (ERI): 22/100, rank 193= of 198 (likely range 176 to 197), Poor, confidence: low
Weak evidence in 4 of 8 categories: access, journey, commercial and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Eritrea scores 22 of 100 on a person's right to see, control and share their own health record: rank 193= of 198 countries (likely range 176 to 197), in the Poor band (0 to 24). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is patient access to the full record (18, median 43).
Eritrea has no data protection law and mostly paper records; doctors face prison for revealing secrets, but patients have no verified right to their records.
Scores: patient access to the full record 18; patient control and consent 22; privacy and security 25; connected care journey 20; protection from commercial use 25; clinician access at the point of care 15; research and trial consent 43; clinical AI governance 18.
Access: We found no legal right for a patient to see or copy their medical record: the 2015 Civil Code's medical contract chapter is silent on records, and any such rule in other health proclamations is not verified. There is no patient portal.
Control: The Civil Code lets a person refuse treatment and stop a professional revealing what they confided. Beyond that, no consent choices, opt-out or access log for health records were found, and data runs to a ministry system.
Key laws: Penal Code of the State of Eritrea (2015); Civil Code of the State of Eritrea (2015).
Brief and every source: https://healthrecordrights.com/brief/ERI/

### Myanmar (MMR): 22/100, rank 193= of 198 (likely range 173 to 197), Poor, confidence: medium
In 2026, Myanmar scores 22 of 100 on a person's right to see, control and share their own health record: rank 193= of 198 countries (likely range 173 to 197), in the Poor band (0 to 24). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is patient access to the full record (18, median 43).
Myanmar has no data protection law or patient record rights, records stay in each facility, and the state can demand health information.
Scores: patient access to the full record 18; patient control and consent 24; privacy and security 22; connected care journey 20; protection from commercial use 28; clinician access at the point of care 15; research and trial consent 43; clinical AI governance 25.
Access: No law we found gives patients a right to see or copy their medical record, and there is no patient portal. The 2007 private health care law only makes private hospitals and clinics keep a systematic medical record.
Control: The Electronic Transactions Law bars disclosing personal information without the owner's permission, but exempts security, investigations and 'stability of state sovereignty'. Private providers must hand over health information on official request, and there is no opt-out or access log.
Key laws: Law Relating to Private Health Care Services (SPDC Law No. 5/2007) (2007); Law Amending the Private Health Care Services Law (Law No. 7/2026) (2026).
Brief and every source: https://healthrecordrights.com/brief/MMR/

### Sudan (SDN): 22/100, rank 193= of 198 (likely range 176 to 197), Poor, confidence: medium
In 2026, Sudan scores 22 of 100 on a person's right to see, control and share their own health record: rank 193= of 198 countries (likely range 176 to 197), in the Poor band (0 to 24). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (46, against a median of 46 across 198 countries); its weakest is privacy and security (20, median 45).
Sudan, at war since 2023, has no data protection law or patient right to a record copy; electronic records reached two sites in 2026.
Scores: patient access to the full record 22; patient control and consent 22; privacy and security 20; connected care journey 18; protection from commercial use 20; clinician access at the point of care 15; research and trial consent 46; clinical AI governance 25.
Access: No Sudanese law we opened gives patients a right to a copy of their record, and the 2015 information law exempts medical records from disclosure. A 2011 rule obliging lab staff to give patients their results puts Sudan just above Libya (20).
Control: Patients have no legal tools to decide who sees their record: no consent rules for sharing, no opt-out and no access log. Protection rests on a professional secrecy duty and a constitutional privacy right.
Key laws: Constitutional Charter 2019, Article 55 (2019); Right to Access Information Act 2015 (2015).
Brief and every source: https://healthrecordrights.com/brief/SDN/

### Guinea-Bissau (GNB): 21/100, rank 196 of 198 (likely range 180 to 198), Poor, confidence: low
Weak evidence in 4 of 8 categories: access, privacy, clinical and research. The evidence grade rates all our sources together; confidence looks at each category. Neither changes the score.
In 2026, Guinea-Bissau scores 21 of 100 on a person's right to see, control and share their own health record: rank 196 of 198 countries (likely range 180 to 198), in the Poor band (0 to 24). Who holds the keys: Institutional. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
Providers and insurers decide. No right sits above the 198-country median; the closest is research and trial consent (43, against a median of 46 across 198 countries); its weakest is protection from commercial use (20, median 45).
Guinea-Bissau has no data protection law and keeps clinical records on paper, so patients have almost no legal or practical hold on their health data.
Scores: patient access to the full record 20; patient control and consent 20; privacy and security 22; connected care journey 20; protection from commercial use 20; clinician access at the point of care 15; research and trial consent 43; clinical AI governance 15.
Access: No law gives patients a right to see or copy their medical record, and Guinea-Bissau has no data protection law. Clinical records in every health centre and hospital are kept on paper, so there is nothing to view online.
Control: There is no data law, so patients have no legal consent, objection or access-log rights over health data. Records sit on paper in each facility, and providers and programmes decide how data moves.
Key laws: Constitution of the Republic of Guinea-Bissau (1984, revised 1996), Article 44 (1996); Penal Code, Decree-Law 4/93, Articles 142 and 143 (1993).
Brief and every source: https://healthrecordrights.com/brief/GNB/

### Afghanistan (AFG): 20/100, rank 197 of 198 (likely range 183 to 198), Poor, confidence: medium
In 2026, Afghanistan scores 20 of 100 on a person's right to see, control and share their own health record: rank 197 of 198 countries (likely range 183 to 198), in the Poor band (0 to 24). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is patient control and consent (20, against a median of 30 across 198 countries); its weakest is privacy and security (20, median 45).
Afghanistan has no data protection law and mostly paper records, and its health policy says the ministry owns all health data.
Scores: patient access to the full record 20; patient control and consent 20; privacy and security 20; connected care journey 18; protection from commercial use 22; clinician access at the point of care 15; research and trial consent 30; clinical AI governance 15.
Access: Only private clinics have a written duty to give patients a copy of their clinical records, under a 2012 regulation. There is no national patient portal, and records are still mostly on paper.
Control: The 2025 to 2030 National Health Policy states that the Ministry of Public Health owns all health-related data. We found no patient consent choices, opt-out or access log for health records.
Key laws: Public Health Law (2006); Private Health Centres Regulation (Official Gazette No. 1084) (2012).
Brief and every source: https://healthrecordrights.com/brief/AFG/

### North Korea (PRK): 19/100, rank 198 of 198 (likely range 187 to 198), Poor, confidence: medium
In 2026, North Korea scores 19 of 100 on a person's right to see, control and share their own health record: rank 198 of 198 countries (likely range 187 to 198), in the Poor band (0 to 24). Who holds the keys: State. Source: Health Record Rights Index, SuperTruth, this country's data as of 2026-10-01.
The government decides, with limited individual say. No right sits above the 198-country median; the closest is research and trial consent (40, against a median of 46 across 198 countries); its weakest is privacy and security (15, median 45).
North Korean law gives patients no right to their records and no say over sharing, while the UN finds state surveillance growing.
Scores: patient access to the full record 15; patient control and consent 20; privacy and security 15; connected care journey 20; protection from commercial use 20; clinician access at the point of care 15; research and trial consent 40; clinical AI governance 18.
Access: No law we read gives a patient the right to see or copy their medical record. The Medical Law says a diagnosis is told to the patient, but a diagnosis judged harmful to treatment may be told only to the guardian.
Control: Patients must consent to surgery and to the use of organs, but the Medical Law makes hospitals register every patient found in check-ups and report them to the 'relevant bodies'. We found no choice over sharing and no access log.
Key laws: Medical Law (1997 (amended 2012)); Public Health Law (1980 (amended 2012)).
Brief and every source: https://healthrecordrights.com/brief/PRK/

## Limits
Not legal advice. SuperTruth sells health data verification products; no one paid to be included. Countries not listed have not been rated yet.