By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Designated Record Set
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
A designated record set (DRS) is the HIPAA term for the group of records a covered entity maintains, or that is maintained for it, that individuals have rights to inspect, obtain, and ask to amend. The HIMSS Dictionary notes that it includes medical and billing records kept by or for a covered provider, enrollment, payment, claims, and case management records kept by or for a health plan, and other records used to make decisions about individuals.
The regulation, 45 CFR 164.501, builds the definition from three categories. A record, for this purpose, means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity.
| DRS Component | Who It Applies To | Examples |
|---|---|---|
| Medical and billing records | Covered health care providers | Clinical notes, orders, results, charges |
| Enrollment, payment, claims, and case management records | Health plans | Eligibility files, claims adjudication data |
| Records used to make decisions about individuals | Any covered entity | Records that influence care, coverage, or services |
⚠️ Exam Alert: The designated record set defines what patients can access and amend under HIPAA. It is not identical to the legal health record, which is the set of records an organization designates as its official business record for legal purposes. Some information, such as psychotherapy notes, is excluded from the right of access.
🌐 Why It Matters: Real-World Healthcare IT Context
Under 45 CFR 164.524, an individual has a right of access to inspect and obtain a copy of protected health information in a designated record set for as long as it is maintained there. The rule carves out psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding, and it lists limited grounds on which access may be denied. A covered entity must act on a request no later than 30 days after receiving it, with a provision for limited extension. Another provision, 45 CFR 164.526, gives individuals the right to ask the covered entity to amend information in the designated record set.
Because both rights hinge on the same phrase, deciding what belongs in the DRS is a practical task. Health information management teams, privacy officers, and informatics staff usually do this together. Questions arise constantly: do patient portal messages belong? Scanned outside documents? Imaging and device data? Audit information? Genomic results? The answer depends on the regulatory definition, including whether the information is used to make decisions about the individual, and organizations document their determinations in policy.
The legal health record is a related but separate idea. A 2021 article in Perspectives in Health Information Management, which examined the relationships among the legal medical record, the designated record set, and the electronic health record, explained that people once treated the paper chart as the legal record by definition, and that two persistent myths have followed the move to electronic systems: that a patient’s EHR is the legal medical record, and that printouts or screen views are necessarily equivalent to the paper chart of the past. The author argued that organizations must define at the outset what the legal record and the designated record set include so that what is retained and released is accurate. The distinction is useful: the legal health record answers what the organization will produce as its official record in legal proceedings, while the DRS answers what individuals can access and amend.
Medical specialties raise new questions. The American College of Medical Genetics and Genomics published a points-to-consider statement on how the designated record set applies to clinical genetic and genomic testing, an area where raw data, variant files, and evolving interpretations make the boundary harder to draw.
Federal interoperability rules build on the same concept. ONC’s information blocking regulations define electronic health information by reference to electronic protected health information that is or would be in a designated record set, so decisions about the DRS affect what must be shared with patients and other authorized parties. The HHS guidance on the right of access reminds covered entities that patients can obtain their records in the form and format they request when readily producible, and that fees are limited.
Informatics systems complicate the boundaries. Records live in the core EHR, ancillary departmental systems, document imaging, patient portals, billing systems, and sometimes vendor-hosted tools. A DRS map that lists each source, who owns it, and how it is retrieved helps release of information teams respond on time and completely.
Common designated record set problems:
- No written definition of what is in the DRS
- Treating the DRS and the legal health record as the same thing
- Records in ancillary systems missed in access requests
- Confusion over whether portal messages and outside documents are included
- Delays that exceed the required response time
- Amendment requests routed to staff who do not know the process
What supports clear DRS management:
- A documented DRS definition approved by compliance and health information management
- A source system inventory mapped to the DRS
- Defined handling of excluded information such as psychotherapy notes
- Release of information workflows with deadline tracking
- Clear process for amendment requests and addenda
- Training for staff who receive patient requests
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses document in the record patients may someday read, request, or ask to correct, so the DRS has everyday consequences.
At the Bedside
Patients can see more of their charts than in the past, through portals and open notes. Clear, factual, respectful documentation serves both clinical care and patient access. Nurses who understand that patients may read what is written tend to avoid jargon and judgmental language, and they document observations and quotes rather than assumptions.
When a patient says an entry is wrong, nurses direct the request through the organization’s amendment process rather than editing the note or promising a change.
In Clinical Workflow
Nurses are often the first to hear record requests, especially on discharge. Knowing who handles release of information, and giving patients the right contact, avoids delays. Nurse managers help with questions such as which unit-level paper logs or worksheets, if any, are part of the record and how they are retained.
Nurse informaticists contribute to DRS decisions by explaining how documentation flows into systems, which data are used for decisions, and where information might sit outside the core record. They also advise on how amendments and addenda should appear without erasing the original entry.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live changes where information lives, which can change the DRS map. Analysts confirm that the legacy system’s records remain accessible, that scanned documents and outside records are filed to places that release of information can reach, and that portal visibility settings match organizational policy. At-the-elbow support analysts help staff understand where to document so that entries land in the part of the chart that can be released.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
The designated record set appears in privacy, health information management, and patient rights questions:
| CAHIMS Domain | How the DRS Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA Privacy Rule, access and amendment rights, information blocking |
| Clinical Informatics | Documentation practices, patient-visible notes, portals |
| Healthcare Information & Systems Management | Source system inventory, release of information, retention |
| Management & Leadership | Policy decisions, compliance oversight, patient request timelines |
Key Terms to Know Alongside the Designated Record Set
- Legal Health Record — records an organization designates as its official business record
- Right of Access — individual’s right to inspect and obtain PHI in the DRS
- Right to Amend — individual’s right to request correction of PHI in the DRS
- Psychotherapy Notes — notes excluded from the right of access
- Release of Information — process of fulfilling record requests
- Electronic Health Information (EHI) — data covered by information blocking rules, defined with reference to the DRS
HIMSS Organizational Position
HIMSS supports patient access to health information, privacy, and interoperability through its public policy work, research, and communities. Members can find related resources through the HIMSS Resource Center and Public Policy and Advocacy pages.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.501, Definitions (Designated Record Set) https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.501
- eCFR — 45 CFR 164.524, Access of Individuals to Protected Health Information https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
- eCFR — 45 CFR 164.526, Amendment of Protected Health Information https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.526
- HHS — Individuals’ Right under HIPAA to Access their Health Information https://www.hhs.gov/hipaa/for-individuals/right-to-access/index.html
- Floyd (2021), Perspectives in Health Information Management — Defining the Medical Record: Relationships of the Legal Medical Record, the Designated Record Set, and the Electronic Health Record https://pubmed.ncbi.nlm.nih.gov/34975357/
- Tayeh et al. (2023), Genetics in Medicine — The Designated Record Set for Clinical Genetic and Genomic Testing: A Points to Consider Statement of the American College of Medical Genetics and Genomics (ACMG) https://pubmed.ncbi.nlm.nih.gov/36547466/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply