The rights of patients to access and control their health information (along with other personal information) has been recognized In legislation that protects privacy.
Use of health information must serve the presumed interests of the individual whose information it is; that is, health information can be shared at the request of the patient or with others who are directly involved in providing care. The health record belongs to the patient, not the health care provider or the organization. The expectation is that the minimum amount of information necessary will be shared, and wherever possible (for quality improvement, for example) aggregate or de-identified data will be used.