• E-mail
• Print
• RSS

Are records held by a business associate part of our "designated record set"?

HIPAA Weekly Advisor, July 19, 2002

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: Are records held by a business associate part of our "designated record set"?

A: The rules define a "designated record set" as a group of records maintained by or for a covered entity that are:

• medical records and billing records about individuals maintained by or for a covered health care provider
• enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan
• used, in whole or in part, by or for the covered entity to make decisions about individuals.

If the records meet the above criteria, they qualify regardless of whether they're held by a business associate.

A designated record set is a description of information that can be stored in one or many places within the organization. As the commentary to the regulations notes: "We do not use the means of retrieval of a record as a defining criteria."

According to the commentary in the privacy regulations, for covered health care providers, designated record sets include, at a minimum, the medical record and billing record about individuals maintained by or for the provider. In addition to these records, designated record sets include any other group of records that are used, in whole or in part, by or for a covered entity to make decisions about individuals.

The HHS commentary provides the following guidance:

"We do not require a covered entity to provide access to all individually identifiable health information, because the benefits of access to information not used to make decisions about individuals is limited and is outweighed by the burdens on covered entities of locating, retrieving, and providing access to such information. Such information may be found in many types of records that include significant information not relevant to the individual as well as information about other persons. For example, a hospital's peer review files that include protected health information about many patients but are used only to improve patient care at the hospital, and not to make decisions about individuals, are not part of that hospital's designated record sets."

Editor's note: Brought to you by attorneys Marty Baxter and Gretchen McBeath at Bricker and Eckler, LLP (http://www.bricker.com) and The Quality Management Consulting Group, Ltd. (http://www.qmcg.com). E-mail: mbaxter@bricker.com or gmcbeath@bricker.com.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive