Electronic health records have been way oversold. Expecting every little medical office to have industrial-grade data protection makes them far more of a liability than they are worth.
At best mostly subjective observations, at worst full of outright errors, they're largely useless from a health care perspective let alone for research purposes.
In my (relatively limited) experience, most small medical offices pay for cloud-based EHRs on a subscription basis for this exact reason. Have you observed differently?
With regards to the usefulness of medical records, I don't know enough on the topic to address that point.
At best mostly subjective observations, at worst full of outright errors, they're largely useless from a health care perspective let alone for research purposes.