The law states that medical and health care records are the property of the hospital or physician. The HIPAA Privacy Rule makes it clear that patients should be given access to their records, in a timely matter, and at a reasonable cost, but the patients do not own the records, they belong to the hospital/health care.