Who Holds the Chart

Three of the world's largest jurisdictions have ordered institutions to hand patients their medical records, and what moved was the copy, not the control.

The clipboard at the front desk of a new clinic is a small monument to a settled question. You write out your name, your allergies, the year of a surgery you half remember, because the record of all of it exists and is not yours to hand over. It sits in a system you cannot query, held by an institution that owes you a copy on request and nothing faster. Part II of these papers argued that the ledger was the first instrument of the state, the technology that made a population legible to a center. Medicine keeps its own ledger, and for almost all of its history you have been its subject rather than its keeper.

That arrangement has now been rewritten in law across three of the largest jurisdictions on earth, which makes it the most instructive natural experiment decentralizers have. The United States prohibited information blocking. The European Union legislated a health data space. India built a federated exchange with consent in the middle of it. In each case the state ordered institutions to loosen their grip, and in each case what moved was the copy rather than the control. That gap recurs wherever power is asked to travel to the edge: a right to receive is cheap to grant and changes less than it promises, while a right to govern is expensive and changes almost everything.

Take the American version, the bluntest of the three. The rule implementing the 21st Century Cures Act was published in May 2020; it made information blocking unlawful for providers, certified health IT developers and health information networks, and required certified developers to expose electronic health information through standardized programming interfaces that patients could use at no cost. The effect was not nothing. In the federal health IT office's brief on the 2024 national survey, 77 percent of American adults were offered online access to their records and 65 percent used it at least once that year. Read the same brief further: 59 percent of individuals nationally held more than one portal, and 7 percent used an application that pulled several together. The scattering the law was written against survived the law, in a politer form: not sealed records but several open ones, each still in its own building. The right had been drafted as a right to be handed a copy, not as a right to hold a record of your own.

India's answer is architecturally the most interesting. The Ayushman Bharat Digital Mission does not build a national vault. Clinical data stays where it was generated; a health account number makes it addressable; a consent manager brokers each transfer while holding no clinical data itself. The Software Freedom Law Center, India, describes that broker as "data-blind by design", which is the property that separates an index from an owner. By June 2026 the National Health Authority reported more than a billion records linked to health accounts, roughly double the figure of fifteen months earlier. Read that number carefully. It counts records made addressable, not the times a patient actually moved one.

Part V of these papers set out Elinor Ostrom's conditions for institutions that keep power distributed: behavior members can see, verification they can perform cheaply, rules they can change, exit that is real. The best implementation of the first two sits outside all three regimes. Estonia has run a national health information system since 2008. Its state health IT agency tells citizens they can "verify who has seen your health information and when", and the integrity of those access logs is protected by KSI hash-linked timestamping. Note what that does and does not do. The hospital still holds the record. The citizen holds the audit. That is nearer to the watchfulness of Part I's forager bands than any custody arrangement, and it suggests the sharper question is not who stores the file but who can watch the storer.

The strongest objection came from clinicians, and it deserves better than dismissal. When Vanderbilt University Medical Center moved to immediate release in January 2021, the share of test results patients saw before their ordering clinician rose from 10.4 percent to 40.3 percent, and daily patient messages sent within six hours of viewing a previously delayed result roughly doubled, according to a study published in JAMA Network Open that October. People were learning about tumors from a phone at midnight with nobody to call. The evidence that followed was harder on the objection than on the patients: in a survey of more than eight thousand patients at four American medical centers, published in the same journal in 2023, 96 percent wanted immediate release to continue, and more than 95 percent of those who had received abnormal findings said the same. The distress the profession predicted largely did not arrive. The unfunded labor of answering the messages did, and it is still unpaid.

There is a deeper limit that patient access does not touch, and Europe's statute is honest enough to show it. The European Health Data Space regulation, in force since March 2025 and phasing in across the decade after, gives individuals fast and free access to their own data, the ability to restrict parts of it, a record of who looked, and a right to corrections. It also constructs a second regime for secondary use, in which researchers, industry and governments obtain permits to work with health data in bulk, subject to an opt-out. Both halves sit in one law and run in opposite directions. The individual gains a window onto a file; the aggregate, which is where the value and the power actually sit, gains a new set of institutions to govern it. That is a trade, not a contradiction, and it should be argued as one rather than sold as empowerment.

Which leaves a conclusion less satisfying than the slogan, and more useful. Your medical record is not a possession waiting to be handed back. It is a commons: made by many hands, useful mainly when pooled, dangerous when a single keeper controls both the pooling and the terms of access. Ownership is the wrong frame; governance is the right one. Ask of any health data regime what Part VI asked of any protocol. Can you see what is held about you, can you see who looked, can you move it without asking permission, and can the rules be changed by the people they bind? The United States has delivered the first and part of the third. Estonia has delivered the second. India has built the plumbing for the third and left the fourth open. Nobody has delivered all four, and the obstacle has not been the technology for years.