HIPAA Challenges: The Clearly Defined Designated Record Set

Many HIM leaders are aware that a well-defined designated record set (DRS) is a necessity in today’s regulatory landscape, but few know exactly what that looks like—and we understand why! While regulatory guidance like HIPAA provides some direction, it often leaves much room for interpretation. In the 2023 Fall Issue of For the Record Magazine, HealthMark CEO and AHIOS president Bart Howe shines the light on how clearly defining your DRS is essential for HIPAA compliance and protects your organization from potential penalties.

The designated record set refers to a defined collection of records that is maintained by or for a health care provider. Before we dive into legal-infested waters, let’s start at the high level.

What qualifies for inclusion as part of the designated record set?

• patient data created by your organization;
• patient data transmitted to your EMR from another provider;
• patient data you can access from your EMR; and
• patient data housed and maintained by your EMR.

It’s important to note that records maintained by a health care organization can qualify for inclusion in the designated record set regardless of whether the data were added to the record directly by your providers or if they originated from an outside provider or source. An example here is a primary care patient who sees a specialist who can directly access and input data into the primary care practice’s EMR. In this example, the data and chart information from that specialist’s visit can qualify as part of the designated record set for that patient.

As you can see, the designated record set includes various types of patient information—and usually more than you may think. So, when it comes to the designated record set, what’s in and what’s out?

You can read the full article in For the Record here.