This issue is regulated by laws and standards depending on the country or state you choose. In most cases, the actual data owner of EHR is the healthcare facility itself. The responsibility for secure data storage is regulated by contracts you sign with a software engineering company. Data processing agreements regulate the access of your partners to data and give you security guarantees.