<![CDATA[Introduction: Patient autonomy and information privacy have become central pillars of modern healthcare legislation. In Indonesia, the enactment of the current Health Law has significantly reshaped the legal framework governing medical records, balancing a patient's right to access their personal health data with the healthcare provider's duty of confidentiality. This study explores the legal landscape surrounding these rights, highlighting the shift toward digital health architecture and increased patient empowerment. Methods: This research employs a normative juridical legal method. It analyzes primary legal materials, including the Health Law and its implementing regulations, alongside secondary legal sources such as academic journals, jurisprudence, and legal doctrines regarding medical privacy and patient rights. Results: The analysis reveals that under the current legislative framework, patients possess ownership of the informational content within their medical records, while healthcare facilities retain physical or digital custody of the record matrix. Furthermore, the mandatory transition to electronic medical records introduces stringent data protection standards aligned with personal data protection principles, though ambiguities persist regarding cross-border data flows and liability in systemic breaches. Discussion: The integration of patient rights within the broader health law framework creates a critical intersection between medical ethics, healthcare administrative law, and privacy statutes. While the current law successfully strengthens the legal standing of patients to demand full data transparency, the lack of granular enforcement mechanisms creates a compliance gap for rural healthcare facilities. A comprehensive literature review indicates that achieving a balance between data accessibility for patients and data security for providers requires clearer technical guidelines and robust state-led oversight. Conclusions: The Health Law provides a solid normative foundation for patient data rights, but its realization relies heavily on technical harmonization and infrastructure readiness. It is recommended that regulatory bodies issue specific administrative guidelines to penalize institutional non-compliance and establish clear standard operating procedures for patient data access.]]>
