Paper 022: The Inverted EHR — What Happens When the Patient Holds the Master Record

Position paper. Hypothesis, not conclusion.

Every electronic health record system on the market is built on the same architectural assumption: the institution holds the master record. The hospital. The insurer. The health system. The patient gets a copy — a portal login, a downloadable summary, or a PDF handed to them on request.

What if this was inverted?

What if the patient held the master record, and the institution got a copy?

This is not a technical question about APIs or FHIR standards. It is an architectural question about who owns the authoritative version of a human life.

In the current model, the hospital's EHR is the source of truth. Every encounter generates data that flows into the hospital's system. If the patient moves to a different hospital, the records do not follow. The patient must request them. The receiving hospital must import them. The process is slow, incomplete, and error-prone.

The patient is the subject of the data but not the controller of it. They can view portions of their record through a portal. They can download a summary. But they cannot assemble their complete history across providers, correct errors, add context, or share selectively with a new clinician.

The architecture assumes the patient is stationary. One health system. One set of providers. One country. This assumption is false for millions of people.

In an inverted EHR, the patient's device holds the authoritative longitudinal health context. Every encounter — a doctor's visit, a lab result, a prescription, an imaging report — generates data that flows to the patient first. The patient holds the authoritative copy. The institution gets a copy for its own records, with the patient's consent.

The patient can assemble their complete history across all providers, across all countries, across their entire life. They can attach context, corrections, and provenance to their lifelong record, rather than relying solely on institutional amendment processes. They can share selectively with any clinician, for any purpose, for any duration, using the Handshake protocol described in Paper 020.

This is not a hypothetical. The architecture exists in prototype form within the ZKOMI application. The patient's data lives on their device, encrypted with keys only they hold. No central breach can expose a population-scale health database because no central copy exists. The patient becomes the sovereign holder of their longitudinal health context.

If the patient holds the master record, several things become possible that are impossible in the current architecture.

Continuity across borders. A patient who sees doctors in three countries has one unified record, not three partial ones.

Selective sharing. A patient can share exactly the context a specialist needs — medications and allergies, not their entire gynecological history.

Context and correction. A patient who finds an error in their record can attach context, corrections, and provenance to their lifelong record, rather than relying solely on institutional amendment processes.

Lifespan continuity. A patient who moves, changes jobs, changes insurers, or ages out of one health system does not lose their history.

Audit from the patient's perspective. The patient can see who accessed what, when, and for what purpose.

Wearable devices capable of continuous physiological monitoring — such as rings tracking heart rate variability (HRV), nocturnal body temperature, respiratory rate, and sleep architecture — generate rich streams of biological context that are currently fragmented across apps and time. In an inverted EHR, these wearable-derived signals become first-class citizens in the patient's master record. Indicators of recovery, physiological stress, or sleep consistency — often absent from institutional records — can provide additional longitudinal context. The patient decides which slices are shared via Health Context Tokens, preserving privacy while enriching clinical decision-making.

The inverted EHR does not mean the patient modifies clinical facts. The record of a diagnosis remains the record of a diagnosis. The lab result remains the lab result. What changes is the container.

Patient sovereignty does not mean patient modification of clinical facts. It means ownership of the longitudinal health context, with every data element retaining its source and provenance.

The patient owns the container. The ecosystem verifies the contents.

The most common objection to patient-held master records is that patients are not reliable custodians. They lose devices. They forget passwords. They cannot be trusted to maintain the integrity of their own data.

These are real concerns. They are also engineering problems, not architectural impossibilities. Encrypted backups can protect against device loss. Biometric authentication can protect against unauthorized access. Audit trails can detect tampering. The same cryptographic infrastructure that protects financial transactions can protect health records.

A deeper objection is institutional resistance. Hospitals derive power from holding the master record. They derive revenue from releasing it. An inverted architecture threatens both. This is not a technical barrier. It is a political one.

The ZKOMI application implements a partial inverted EHR. The patient holds their medication history, conditions, allergies, lab results, and the timeline of every expert opinion — all on their device, encrypted, with keys only they hold. The Handshake protocol enables selective sharing with any provider. Health Context Tokens enable purpose-specific, time-limited sharing.

What we have not built is institutional adoption. No hospital system currently accepts a patient-held master record as authoritative. No regulatory framework currently requires it. The architecture exists. The ecosystem does not.

What would it take for a hospital system to accept a patient-held record as authoritative? What liability framework would need to exist? What standards would need to be agreed upon? Would this architecture reduce or increase the cost of health data management? Would it improve or worsen clinical outcomes?

We do not have answers. We offer this paper as a provocation and an invitation.

Published: July 2026
Archived: Internet Archive
Repository: GitHub
Hash: [SHA-256 — upon final publication]

Key Sources:

• Zkomi Research Team. (2026). Paper 019: Health Context Tokens. The Continuity Project.
• Zkomi Research Team. (2026). Paper 020: The ZKOMI Handshake. The Continuity Project.
• Zkomi Research Team. (2026). Paper 016: Memory Without Custody. The Continuity Project.