I don't know who told you that - but that's not true.
Hospitals can only release medical records to law enforcement or federal government entities without warrant. No one else can get your medical records without written permission release from you.
In order to get my own CAT scan records I had to fill out two pages authorizing the hospital to release them to me. I recognize these are my records but they are the ones held responsible for their security if they cannot produce the forms releasing them to me.