The Health Record Rights Index: Who Holds the Record in 198 Countries?

What it is. We scored 198 countries and territories (all 193 UN member states, plus Greenland, Kosovo, Palestine, Taiwan and Vatican City) from 0 to 100 on one question: does a person get to see, control and share their own health record? Eight weighted categories cover access to the full record, control and consent, privacy and security, protection from commercial use, a connected care journey, clinician access at the point of care, research consent, and clinical AI governance. How it was built. Research agents built on Anthropic's Claude models did the research and scoring against a written rubric, and the authors ruled on every finding and every change for the countries; Section 11.7 sets out how rulings were made for the US state layer. The rubric requires an agent to open every source it cites; a later check of every cited link found 7156 cited links checked: 7011 opened, 0 dead (HTTP 404 or 410), 88 blocked by bot protection and 57 unreachable, unresolved or answering with a server error. Every score cites the public pages it rests on: 5147 cited sources (979 undated). What we found. Finland (71), Denmark (70), Estonia (68), Hungary (68) and Sweden (67) have the highest scores; allowing for scoring error, each of them is first, alone or tied, in at least 5% of draws. The median is 39, and scores track national income closely: Spearman +0.72 (95% interval +0.64 to +0.79, n 188). By band, with the range each count takes when weights and scores are varied: 9 Strong (7 to 14 across draws), 66 Mixed (58 to 72), 111 Weak (101 to 115) and 12 Poor (10 to 19). No country reaches the top band in any draw; 12 countries are Poor as published (10 to 19 across draws). How far to trust it. A blind re-scoring of 58 sampled cells from the first 65 countries by a separate session of the same model family, run before the 2 October re-research, agreed with the scores at that time at an intraclass correlation of 0.82, and a second, of 108 cells from the 133 countries added on 2 October 2026, at 0.84, though single access scores there agree less well (0.68); no human rater has scored the index. A single cell can move by about 17 points. Once a country's scoring error and the weights are both allowed for, a country's likely rank typically spans 43 places. Who holds the keys. Confidence labels are computed from each country file by a fixed rule: 27 high, 105 medium and 66 low. We also classed where control over the record sits by default, which we call who holds the keys: 51 Shared, 81 Institutional and 66 State; 0 Individual. No country gives the person the default say over who sees the record; our definition of that class requires that nothing flow into a state or provider system by default, which no national system does. Audit and context. An audit of our own scores found that the same legal situation was sometimes scored differently in different regions. We tightened the rubric, rescored, and report every change. A separate context layer, which changes no score, asks whether strained public systems push care to private providers whose records do not reach the public record. Real cases. Alongside the scores we collected 451 published accounts of real problems with health records. They illustrate the scores and do not change them. New in version 1.1: the 50 states and DC. Version 1.1 adds a layer for the United States: what the law of each of the 50 states, and of Washington, DC, adds to federal law for a person's health record, on six legal dimensions and four kinds of sensitive record. It gives no state score and no state rank, and it changes no country score. A blind re-reading of 150 sampled cells, by agent sessions that could read only stored copies of the cited pages, agreed with the published cells at an intraclass correlation of 0.965 on the 114 cells with ordered levels where the rater settled a level (a bootstrap interval clustered by state runs from 0.92 to 1.00). Other sessions that searched on their own reported a law the research sessions had not found in 4 of 25 sampled cells, which set off a second search for missed laws. License. The paper and data are released under CC BY 4.0 and the code under the MIT license. Changes in version 1.1. Version 1.1 (4 October 2026) adds Section 11, on the 50 states and Washington, DC, with Tables 11 to 13 and Figure 11. It updates the abstract, the use-of-AI statement in Section 3, the limitations, the conflict of interest, the intended use and the data statement to cover the new layer. Sections 11 and 12 of version 1.0 are now Sections 12 and 13. No country score, rank, band, keys class or confidence label changed since version 1.0. The file for the United States was edited in text only and its sources, on 3 October 2026, after a federal law audit and before the main state run began: the US cells now describe the information-blocking rule and the FTC's breach rule (Section 7.3). The main state run did not touch the country data: the hash of the country files was the same before and after it (its first eight characters are 8b590f01). The published accounts grew from 446 to 451, and the counts drawn from them and from the link and evidence checks were recomputed. The limits that version 1.0 named for this version (Section 7.4, item 11) are still open. The global context strip planned in the version 1.1 plan (context figures for every country, like Table 13 for the states) is not included, because its data have not been collected; it is planned for version 1.2. No human inter-rater study has been done. Working paper, version 1.1, not peer reviewed. 4 October 2026. Version 1.0 was dated 2 October 2026; the changes are listed after the abstract. Interactive index: https://healthrecordrights.com. Data and code: https://github.com/evil-robot/who-holds-the-record-open and the linked dataset record.