What Does a Designated Record Set Consist Of? HIPAA Definition, What’s Included, and What’s Not

Definition of Designated Record Set

A designated record set (DRS) is the organized group of records maintained by or for a HIPAA covered entity that is used to make decisions about you. It focuses on your Protected Health Information (PHI) and spans paper and electronic formats.

For health care providers, the DRS includes medical and billing records about you. For health plans, it includes enrollment, payment, Claims Adjudication, and Case Management Records, along with any other records used to decide your eligibility, coverage, or benefits.

The DRS is purpose-based, not location-based. If a record is used to make decisions about you, it belongs in the DRS whether it lives in an EHR, a billing system, a scanned archive, or a call-center platform.

Components of Designated Record Set

For health care providers

• Medical records: histories and physicals, diagnoses, problem lists, allergies, medication lists, lab and imaging results, operative and procedure notes, discharge summaries, and Clinical Case Notes.
• Billing records: claims, coding and charge details, payer correspondence, remittance advice tied to your encounters.
• Decision-making materials: care plans, consult letters, referrals, patient-reported data, portal messages where clinicians use the content to inform care.

For health plans

• Health Plan Enrollment Records and coverage elections.
• Payment and premium billing records tied to your coverage.
• Claims Adjudication files, including determinations, edits, and notes supporting payment or denial decisions.
• Case Management Records and disease/medical management notes used to coordinate your care and benefits.
• Utilization management and prior authorization decisions affecting your services.

Other records used to make decisions

• Coverage determinations, benefit exception reviews, and appeals materials about you.
• Provider or member call notes if they inform your treatment, payment, or coverage decisions.
• Records held by business associates on a covered entity’s behalf when used to make decisions about you.

Exclusions from Designated Record Set

Some materials are outside the DRS either because HIPAA explicitly excludes them or because they are not used to make decisions about you. Key exclusions include:

• Psychotherapy Notes Exclusion: Psychotherapy notes kept separate by a mental health professional and analyzing counseling session content.
• Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.
• Quality improvement, peer review, accreditation files, provider performance evaluations, business planning, and formulary development documents not used for individual decisions.
• System logs, audit trails, metadata, test environments, and duplicate or convenience copies.
• Research records and data sets not used to make decisions about you, or where you agreed to temporary access suspension during an active study.
• Employment records held by a covered entity in its role as employer (e.g., occupational health files maintained for HR purposes).
• De-identified data sets and purely statistical analyses that cannot identify you.

Note on CLIA Exemption

Completed lab test reports from CLIA-certified and CLIA-exempt state program laboratories are typically part of the DRS and accessible to you. Pure research laboratories that are exempt because they do not report patient-specific results for diagnosis may fall outside these access obligations.

Access Rights Under HIPAA

You have the right to inspect and obtain a copy of your PHI in the DRS. Covered entities must respond within 30 days (with one permissible 30‑day extension if they provide a written reason and a new date).

• Form and format: You can request electronic or paper copies; if a format is readily producible, it must be used. If not, you and the entity should agree on an alternative readable format.
• Third-party direction: You may direct the entity to send your DRS information to a designated third party in the format you specify, if readily producible.
• Fees: Only reasonable, cost-based fees for labor, supplies, and postage are allowed; no per-page fees for electronic copies.
• Summaries/explanations: Available if you agree in advance, including any fees.
• Denials: Limited. Psychotherapy notes and information prepared for legal proceedings are not accessible. Some denials are reviewable by another licensed professional.
• Verification and representation: The entity must verify your identity and honor rights of legally authorized personal representatives consistent with state law.

Examples of Included Records

• EHR components: demographics, problem lists, vitals, medications, allergies, immunizations, Clinical Case Notes, care plans, and test results.
• Diagnostic reports: labs, imaging, pathology, cardiology tracings and interpretations.
• Hospital documents: operative notes, procedure reports, discharge summaries, anesthesia records.
• Therapy notes used for care: physical, occupational, speech, and behavioral health progress notes (excluding separate psychotherapy notes).
• Provider–patient messages when used to inform diagnosis or treatment decisions.
• Billing and claims data tied to your encounters, including codes and adjudication outcomes.
• Health Plan Enrollment Records, coverage determinations, prior authorization approvals/denials.
• Claims Adjudication files and Case Management Records reflecting coordination of your services.
• Appeals and grievance decisions about your benefits or payments.

Examples of Excluded Records

• Psychotherapy notes kept separate from the medical record (Psychotherapy Notes Exclusion).
• Incident reports, root-cause analyses, patient safety work product, and peer review deliberations not used to make decisions about you.
• Business planning documents, budgeting files, network strategy, and formulary design materials.
• De-identified research data sets and study notes not used for your clinical decisions.
• System backups, audit logs, change tickets, and test database records.
• Employment records held by a provider as your employer (e.g., fitness-for-duty files) rather than for care or benefits.
• Duplicate copies kept only for convenience, personal provider notes not shared or used for decisions, and tool-specific calculation sheets.

Record Definition

Within HIPAA, a “record” for DRS purposes is any item, collection, or grouping of information that contains your PHI and is maintained by or for a covered entity to make decisions about you. The definition is media-neutral and includes paper, electronic, images, and audio.

A DRS can span multiple systems and vendors. What binds it together is use: if a component informs your treatment, payment, coverage, or other decisions about you, it belongs in the designated record set.

In practice, mapping the DRS means identifying every location where decision-making information about you is kept—clinical modules, billing platforms, case and utilization management tools—and ensuring consistent access and disclosure workflows.

Bottom line: the designated record set is the decision-making core about you—comprehensive for care and coverage, respectful of exclusions like psychotherapy notes and legal files, and accessible to you under HIPAA.

FAQs

What records are included in a designated record set?

Records used to make decisions about you are included: provider medical and billing records, lab and imaging reports, Clinical Case Notes, care plans, and for health plans, Health Plan Enrollment Records, Claims Adjudication files, and Case Management Records.

What records are excluded from a designated record set?

Psychotherapy notes kept separate, information prepared for legal proceedings, quality and peer review materials not used for individual decisions, system logs and metadata, de-identified data, employment records held in the employer role, and research records not used to make decisions about you.

How does HIPAA define access rights to a designated record set?

You have the right to inspect and obtain a copy of PHI in the DRS, typically within 30 days. You can choose the format if readily producible, direct copies to a third party, and pay only reasonable, cost-based fees. Certain denials are permitted and, in some cases, reviewable.

Can psychotherapy notes be accessed as part of a designated record set?

No. Under the Psychotherapy Notes Exclusion, separately maintained psychotherapy notes are not part of the DRS and are not accessible through HIPAA’s right of access. Other mental health information used for treatment or billing is generally included.