November 4, 2026 - Xavier Flanagan, Founder

How to choose a health record app: a US checklist (2026)

Your medical records are probably spread across a patient portal for each health system you have used, a few PDFs in your email, insurance statements, and paper from a doctor who retired. A health record app promises to put it all in one place. They work in very different ways, and the differences matter more than the feature lists.

This is a checklist, not a ranking. It tells you what to ask of any app, including ours.

Disclosure: I founded exora, which is one of these apps. I have kept this to questions you can check for yourself, and at the end I answer them for exora too.

Start with what you already have for free

Before you choose an app, use the free options. They are often enough.

Your patient portals. Most health systems and many practices have one. Under federal information blocking rules, once you ask for your electronic health information, including test results, providers generally may not delay or block access without a reason the rules allow. The catch: each portal shows only that provider’s records.
Your HIPAA right of access. You can ask any doctor, hospital or health plan for a copy of your records, in electronic form if they keep them that way. They have 30 days, with one 30-day extension, and for a copy sent to you they can charge only a reasonable, cost-based fee. Our guide to your HIPAA right of access explains how.
Medicare’s Blue Button. If you have Medicare, you can download your claims data from your Medicare account, or connect it to apps you authorize, and stop sharing at any time. If you are in a Medicare Advantage plan, this covers your drug claims only; ask your plan for the rest.
The health app on your phone. On an iPhone, Apple Health can download records from many US health systems’ portals. It shows what those portals hold, in one place on your phone.

If your care is mostly with one health system, its portal may be all you need. A separate app earns its place when your records are spread across several systems, include paper or PDFs, or come from before portals existed.

The checklist

1. Where does the data come from?

Apps fill your record in one of three ways:

Connecting to portals, which brings in structured data from the systems that offer it.
Reading documents you upload, such as PDFs, scans and photos of letters.
Typing it in yourself.

Ask which of these an app does, and what happens to everything it cannot connect to. An app that only connects to portals will miss the paper, the old records and the out-of-network specialist. An app that only takes manual entry leaves the work to you.

2. Can you check where each fact came from?

If an app reads documents with AI, it will sometimes get things wrong. The question is whether you can tell. Look for an app that shows you the original page behind each medication, diagnosis or result, so you can verify it in a tap. If it cannot show its source, treat what it says with caution.

3. What protects your data once it is in the app?

This is the one most people get wrong. HIPAA protects your records while your doctor, hospital or health plan holds them. When you send your records to an app you chose, and that app is not working for your provider, HIPAA no longer covers the app’s copy. Your provider also generally cannot refuse to send your records to an app you chose, as long as it can produce them in the form the app uses, just because it is worried about what the app will do with them.

Apps outside HIPAA are not unregulated. The Federal Trade Commission’s Health Breach Notification Rule covers many health apps, and requires them to notify you if your health information is breached or shared without your authorization. But the real protection is the app’s own privacy policy. So read it, and check:

Does it sell or share your health data, or use it for advertising?
Does it use your data to train AI models?
Where is your data stored, and who processes it?

4. Who can you share it with, and can you take it back?

A good app lets you share a part of your record with a doctor or a family member, for a set time, and end it whenever you like. Check whether you can see who has looked. If you manage a parent’s or a child’s care, check whether the app supports more than one person’s record.

5. What does it cost, now and later?

Look for the price after any free trial, what the free tier leaves out, and whether the features you need are behind a subscription. An app that is free because it sells data is not free.

6. Can you get your records out, and delete them?

Apps come and go. Check that you can download your documents and data, and that deleting your account actually deletes them, with a stated time frame. Keep the originals your providers gave you either way.

How exora answers the checklist

Where the data comes from: documents you upload, from any provider in any country. exora reads them and pulls out your medications, conditions, results, procedures and vaccinations. It does not connect to US patient portals, so you download what they hold and upload it.
Checking the source: every fact links back to the page it came from.
Protection: exora is not a HIPAA covered entity, so HIPAA does not cover the copy you upload. How we handle it, including where it is stored and what we never do with it, is in our privacy policy.
Sharing: you choose who sees your record, for how long, and you can see who looked. One account can hold records for several people.
Cost: free to start. Current prices are on our pricing page.
Deleting: you can delete your account and your data. The privacy policy sets out how and when.