Your health record should belong to you. Not to a hospital, not to an insurer, not to a platform. The individual is the only party present at every encounter of their life, so the individual, not any institution, is the natural owner of the record.
Why this matters now
AI is only as good as the data it can see. A model reading one institution's fragment of a person's history reasons from an incomplete picture, and in healthcare an incomplete picture produces wrong answers.
Health data is also becoming the raw material for AI products. Whoever holds the record decides which model reads it, for what purpose, and who profits. Today that is the institution. It should be the person.
People already bring their health data to AI tools on their own, with no structure, no audit trail, and no way to revoke. A sovereign record is what lets a person say yes to those tools safely: the full history, shared on specific terms, with every access visible.
The problem
A lifetime of health data is scattered across every provider, payer, lab, pharmacy, and device a person has ever touched. Each institution holds its fragment, in its format, behind its portal. No single party, including the person, can see the whole picture. Records are lost when practices close, duplicated when systems don't talk, and inaccessible at the moment they matter most.
Portals didn't fix this. A portal is a window into an institution's copy; switch providers or close the account, and the window shuts. The record stayed theirs.
The principle
Sovereignty inverts the custody model. The individual holds the single, lifetime record; institutions contribute to it rather than own fragments of it. Everything else follows from that inversion:
- Ownership: the record is the person's asset, for life. It survives every change of provider, insurer, employer, and address.
- Portability: the record is built on FHIR, the open standard for exchanging health data, so it moves with the person instead of being reconstructed at every door.
- Completeness: one record spans clinical care, prescriptions, labs, imaging, and self-generated data from wearables and devices. A whole life, not an episode.
- Consent: sharing is granular, purpose-bound, and revocable. The person decides who sees what, for what, and for how long.
- Accountability: every access to the record is visible to its owner. Who looked, when, and why is part of the record itself.
How the record is built
The record is a folder tree, not a database or an account. It has numbered folders 00 through 19 for the content of a life in care (identity, encounters, labs, imaging, medications, conditions, devices, lifestyle, environment, education support, and more) plus governance and reference folders. Any file system, phone, or drive can hold it.
Every clinical fact is stored twice: once as FHIR R4 JSON for software (FHIR is the open interoperability standard hospital systems already speak) and once as a plain-language twin anyone can read without a clinician.
Every entry carries two clocks: when it happened and when it was recorded. Nothing is overwritten. A correction is a new entry that points at the old one, and every fact carries its provenance: the source document, the instrument or device, and who or what entered it.
Each folder is encrypted under keys only the person holds. Where the record is stored says nothing about who can read it: a cloud copy is ciphertext to the host. Recovery is a written phrase and, if the person chooses, split shares held by people they trust. Emergency access requires two named approvers, is logged, and notifies the person.
Sharing is a signed grant with a scope and an expiry date. Every read produces a receipt the person can see. A person can prove a single fact (vaccinated, eligible for a program, cleared to return to play) without handing over the underlying document.
Legally protected categories, such as substance use treatment, mental health notes, genetic results, and reproductive health, are pinned to the law of the record's jurisdiction and never leave the person's sole control. A record that moves across borders carries both jurisdictions' protections until the person reviews them.
The record works with any model. By default, open-weight models (models whose weights are published, so they can be deployed anywhere, including a phone or laptop) run on the person's own device and the record never leaves it. A cloud service sees the record only under a grant, for the purpose the grant names.
Any automated action on the record runs under Earned Autonomy, the companion governance framework: it begins as a proposal a person approves, earns independence only on a recorded track record, and is reversed automatically when its measured quality falls.
The record and the AI that reads it
Consent extends to AI. The same granular, purpose-bound, revocable sharing that applies to a clinician applies to any model, agent, or tool: scope, purpose, and duration, set by the owner.
Accountability extends to AI. Every read of the record by a model and every change a model proposes appears in the owner's access log, the same as a human's.
A model does not write to the record unsupervised. The PSHR specification adopts Earned Autonomy for every automated action on the record. A person approves any change a model proposes. A model earns greater independence only on a recorded track record, and that independence is reversed automatically when its measured quality falls. Some actions can never be earned and always require a person. Here the person who approves is the record's owner. The division is plain: the Person-Sovereign Health Record governs who owns and sees the data; Earned Autonomy governs what a model is allowed to do with it.
One consult, end to end
A person wants a second opinion. They grant a new specialist and an AI analysis tool access to their full history for 30 days, for that consult only. Each read appears in their access log as it happens: who, when, and why. When the consult ends, they revoke both grants, and the record closes behind them.
Why it matters
A complete, person-held record changes what care can be. Clinicians treat the whole person instead of the visible fragment. AI reads the full signal, clinical history alongside daily data, under the consent and access rules above. And the person can bring their entire history to any clinician, second opinion, or analysis tool they choose, because consent is theirs to give.
This specification is the common foundation under the health ventures on this site: tools that let people securely manage their own health records and care, owned by the person rather than provider groups. SHIRLe Health and HealthDigits, by Precision Health Ventures, are built on it.
Who it is for
- Individuals and families get one complete record for life, and the final say on who sees it. The first implementation is SHIRLe Health, with HealthDigits for capturing labs, visit summaries, and device screens by photo through a proprietary AI image analysis capability.
- Clinicians and health systems get the whole person at the first encounter, with consent already on record. Records arrive with their provenance and a receipt for the disclosure, so a receiving provider can accept them without repeating tests or assessments.
- Health-tech builders get a consented, complete, standards-based data source instead of scraping portals. At publication, a conformance program will define Core and Complete tiers, self-certification against a public checklist, and no-cost use of the PSHR mark for conforming implementations.
What it is not
It is not another portal or provider silo: the record does not live inside any one institution's system. It is not a data broker: sovereignty means the record is never monetized without its owner's explicit, revocable consent. It is not a training-data source: the record is never used to train AI models without the owner's explicit, revocable consent. And it is not a medical device or a source of medical advice: it is the data foundation that clinicians and tools build on.
Status
The Person-Sovereign Health Record is an open specification. This page describes the concept. Specification: PSHR Architecture v0.20, First Public Release Candidate, September 29, 2026. Publication under Creative Commons Attribution 4.0 is pending. Patent pending. The specification is published at github.com/ahendo026/person-sovereign-health-record.
If you want your own record, care for people, or build on health data, let's talk. Reach out on LinkedIn or email ahenderson@PrecisionHealthVentures.com.