medical records. twenty-one states have laws stating that the providers are the owners of the records. only one state, new hampshire, has a law ascribing ownership of medical records to the patient. canadian law and customs under canadian federal law, the patient owns the information contained in a medical record, but the healthcare provider owns the records themselves. the same is true for both nursing home and dental records. in cases where the provider is an employee of a clinic or hospital, it is the employer that has ownership of the records. by law, all providers must keep medical records for a period of 15 years beyond the last entry. the precedent for the law is the 1992 canadian supreme court ruling in mcinerney v macdonald. in that ruling, an appeal by a physician, dr. elizabeth mcinerney, challenging a patient's access to their own medical record was denied. the patient, margaret macdonald, won a court order granting her full access to her own medical record. the case was complicated by the fact that the records were in electronic form and contained information supplied by other providers. mcinerney maintained that she didn't have the right to release records she herself did not author. the courts ruled otherwise. legislation followed, codifying into law the principles of the ruling. it is that legislation which deems providers the owner of medical records, but requires that access to the records be granted to the patient themselves. uk law and customs in the united kingdom, ownership of the nhs's medical records has in the past generally been described as belonging to the secretary of state for health and this is taken by some to mean copyright also belongs to the authorities. german law and customs in germany, a relatively new law, which has been established in 2013, strengthens the rights of patients. it states, amongst other things, the statutory duty of medical personnel to document the treatment of the patient in either hard copy or within the electronic patient record (epr). this documentation must happen in a timely manner and encompass each and every form of treatment the patient receives, as well as other necessary information, such as the patient's case history, diagnoses, findings, treatment results, therapies and their effects, surgical interventions and their effects, as well as informed consents. the information must include virtually everything that is of functional importance for the actual, but also for future treatment. this documentation must also include the medical report and must be archived by the attending physician for at least 10 years. the law clearly states that these records are not only memory aids for the physicians, but also should be kept for the patient and must be presented on request. in addition, an electronic health insurance card was issued in january 2014 which is applicable in germany (elektronische gesundheitskarte or egk), but also in the other member states of the european union (european health insurance card). it contains data such as: the name of the health insurance company, the validity period of the card, and personal information about the patient (name, date of birth, sex, address, health insurance number) as well information about the patient's insurance status and additional charges. furthermore, it can contain medical data if agreed to by the patient. this data can include information concerning emergency care, prescriptions, an electronic medical record, and electronic physician's letters. however, due to the limited storage space (32kb), some information is deposited on servers. united states in the united states, the most basic rules governing access to a medical record dictate that only the patient and the health-care providers directly involved in delivering care have the right to view the record. the patient, however, may grant consent for any person or entity to evaluate the record. the full rules regarding access and security for medical records are set forth under the guidelines of the health insurance portability and accountability act (hipaa). the rules become more complicated in special situations. a 2018 study found discrepancies in how major hospitals handle record requests, with forms displaying limited information relative to phone conversations. capacity when a patient does not have capacity (is not legally able) to make decisions regarding his or her own care, a legal guardian is designated (either through next of kin or by action of a court of law if no kin exists). legal guardians have the ability to access the medical record in order to make medical decisions on the patient’s behalf. those without capacity include the comatose, minors (unless emancipated), and patients with incapacitating psychiatric illness or intoxication. medical emergency in the event of a medical emergency involving a non-communicative patient, consent to access medical records is assumed unless written documentation has been previously drafted (such as an advance directive) research, auditing, and evaluation individuals involved in medical research, financial or management audits, or program evaluation have access to the medical record. they are not allowed access to any identifying information, however. risk of death or harm information within the record can be shared with authorities without permission when failure to do so would result in death or harm, either to the patient or to others. information cannot be used, however, to initiate or substantiate a charge unless the previous criteria are met (i.e., information from illicit drug testing cannot be used to bring charges of possession against a patient). this rule was established in the united states supreme court case jaffe v. redmond. canada in the 1992 canadian supreme court ruling in mcinerney v. macdonald gave patients the right to copy and examine all information in their medical records, while the records themselves remained the property of the healthcare provider. the 2004 personal health information protection act (phipa) contains regulatory guidelines to protect the confidentiality of patient information for healthcare organizations acting as stewards of their medical records. despite legal precedent for access nationwide, there is still some variance in laws depending on the province. there is also some confusion among providers as to the scope of the patient information they have to give access to, but the language in the supreme court ruling gives patient access rights to their entire record. united kingdom in the united kingdom, the data protection acts and later the freedom of information act 2000 gave patients or their representatives the right to a copy of their record, except where information breaches confidentiality (e.g., information from another family member or where a patient has asked for information not to be disclosed to third parties) or would be harmful to the patient's wellbeing (e.g., some psychiatric assessments). also, the legislation gives patients the right to check for any errors in their record and insist that amendments be made if required. destruction in general, entities in possession of medical records are required to maintain those records for a given period. in the united kingdom, medical records are required for the lifetime of a patient and legally for as long as that complaint action can be brought. generally in the uk, any recorded information should be kept legally for 7 years, but for medical records additional time must be allowed for any child to reach the age of responsibility (20 years). medical records are required many years after a patient's death to investigate illnesses within a community (e.g., industrial or environmental disease or even deaths at the hands of doctors committing murders, as in the harold shipman case). abuses the outsourcing of medical record transcription and storage has the potential to violate patient–physician confidentiality by possibly allowing unaccountable persons access to patient data. falsification of a medical record by a medical professional is a felony in most united states jurisdictions. governments have often refused to disclose medical records of military personnel who have been used as experimental subjects. data breaches given the series of medical data breaches and the lack of public trust, some countries have enacted laws requiring safeguards to be put in place to protect the security and confidentiality of medical information as it is shared electronically and to give patients some important rights to monitor their medical records and receive notification for loss and unauthorized acquisition of health information. the united states and the eu have imposed mandatory medical data breach notifications. patients' medical information can be shared by a number of people both within the health care industry and beyond. the health insurance portability and accessibility act (hipaa) is a united states federal law pertaining to medical privacy that went into effect in 2003. this law established standards for patient privacy in all 50 states, including the right of patients to access to their own records. hipaa provides some protection, but does not resolve the issues involving medical records privacy. medical and health care providers experienced 767 security breaches resulting in the compromised confidential health information of 23,625,933 patients during the period of 2006–2012. privacy the federal health insurance portability and accessibility act (hipaa) addresses the issue of privacy by providing medical information handling guidelines. not only is it bound by the code of ethics of its profession (in the case of doctors and nurses), but also by the legislation on data protection and criminal law. professional secrecy applies to practitioners, psychologists, nursing, physiotherapists, occupational therapists, nursing assistants, chiropodists, and administrative personnel, as well as auxiliary hospital staff. the maintenance of the confidentiality and privacy of patients implies first of all in the medical history, which must be adequately guarded, remaining accessible only to the authorized personnel. however, the precepts of privacy must be observed in all fields of hospital life: privacy at the time of the conduct of the anamnesis and physical exploration, the privacy at the time of the information to the relatives, the conversations between healthcare providers in the corridors, maintenance of adequate patient data collection in hospital nursing controls (planks, slates), telephone conversations, open intercoms etc.