Designated record set

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The definition follows record function

HHS access guidance describes three main groups: medical and billing records maintained by or for a covered provider; enrollment, payment, claims-adjudication, and case or medical-management systems maintained by or for a health plan; and other records used in whole or in part to make decisions about individuals.

The decisive question is how the record is maintained and used. A label such as “administrative,” “clinical,” or “quality” does not settle the classification.

For an ABA provider, likely candidates can include intake and assessment records, treatment plans, session documentation, billing records, authorization and utilization records, client communications, and other material used to decide about care or payment. The answer still depends on the covered entity's actual use and maintenance, not this example list.

A record can qualify even when the person reviewing it ultimately makes no change. Ask whether the record is used in whole or in part to make decisions about individuals as a class of records. Do not classify one request by whether a particular employee happened to open the file that day.

It differs from the full data inventory

A practice's security and retention inventories can be broader. They may include system logs, workforce records, business planning, facility records, peer-review material, and data that never supports a decision about an individual. This Privacy Rule category is narrower than every record subject to security, discovery, retention, or contract duties.

The current HIPAA Privacy Rule overview applies to covered entities and their relevant PHI workflows. Confirm entity status and any state-law rights separately.

Access and amendment use the category

45 CFR 164.524 places the access right on PHI in one or more designated record sets, subject to exclusions and denial provisions. Section 164.526 uses the same category for amendment requests while adding its own rules.

A business associate may maintain part of the covered entity's set. The covered entity remains responsible for fulfilling applicable individual rights through its arrangements.

This does not mean every item in a designated record set must be produced without analysis. The access rule has specific exclusions and limited denial grounds. For example, psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a legal proceeding receive separate treatment. Apply the current rule to the requested records and provide the accessible remainder when only part is excluded or denied.

Access and amendment are also different workflows. Access concerns inspection or a copy in the requested form and format when readily producible. Amendment asks the covered entity to change or append to eligible information and has separate acceptance, denial, disagreement, and notification rules. A disagreement should not be handled by silently deleting the original clinical record.

Business associates belong in the map

HHS explains that access can extend to PHI in a designated record set maintained by a business associate for the covered entity. The business associate agreement should support timely retrieval, amendment coordination, and other required assistance. A duplicate held by both parties generally does not need to be produced twice, but the covered entity must know which copy is authoritative and available.

For each vendor, record the data families held, decision use, system of record, export method, contact, response time, access controls, amendment method, retention, termination return or destruction process, and test evidence. A contract promise without a working export is an operational gap.

A practice needs a record map

Map each system, record family, owner, purpose, decision use, covered-entity relationship, and source supporting the classification. Revisit the map when a new portal, billing vendor, assessment tool, data warehouse, or archive changes where decision records live.

In a fictional review, 14 record families are assessed. Ten meet the documented scope rule, two remain under legal review, and two support only general business decisions. Report 10 classified in scope, two pending, and two outside this category, while keeping all 14 in the broader information inventory.

Do not release the two pending families as outside scope merely to close the map. Assign an owner, legal question, source, and deadline. If an access request arrives first, preserve the records and route the scope question through the request workflow rather than waiting for the annual inventory review.

Route each request through a controlled workflow

Record the requester and authority, request date and scope, designated record sets searched, systems and vendors queried, identity verification, requested format, exclusions or denial analysis, reviewing official when applicable, fees, delivery, and completion date. The current HHS access guidance generally requires action within 30 calendar days and describes one written 30-day extension when necessary.

Keep three denominators visible: record families due to be searched, families searched, and responsive records resolved. A request can be timely while a vendor search is incomplete, so the completion gate should require evidence from every due source or a documented lawful resolution.

Questions owners should ask

• Which records does the practice use to make decisions about individuals?
• Which business associates maintain any part of those sets?
• Can each system export the record in an accessible, readable format?
• Who decides exclusions, denials, reviews, and amendment outcomes?
• Which state law or contract supplies a broader right?
• What change in workflow, vendor, or record use triggers remapping?

Test the map with a fictional request before relying on it. Time the search, open the exports, reconcile duplicates, confirm authority and secure delivery, and document any source that cannot meet the workflow.