Designated Record Set vs Legal Health Record

No, and the difference is not merely terminological. The designated record set is defined in regulation at 45 CFR 164.501 and sets the boundary of the individual's rights of access and amendment. The legal health record is an institutional designation with no federal definition - a direct search of the current text of 45 CFR part 164 returns zero occurrences of the phrase. In most institutional policies the designated record set is the broader of the two, because it expressly includes billing records and because its third limb captures anything 'used, in whole or in part, by or for the covered entity to make decisions about individuals', wherever that information lives. The legal health record is typically the clinical subset an organisation will produce and authenticate in litigation.

A group of records maintained by or for a covered entity that is either: the medical records and billing records about individuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or used, in whole or in part, by or for the covered entity to make decisions about individuals. The same section then defines 'record' extremely broadly, as 'any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity'. That breadth is deliberate: the test is functional, not system-based, so a spreadsheet used to make decisions about patients is inside the designated record set even though it is not in the EHR.

The designated record set, without qualification. 45 CFR 164.524(a)(1) gives the individual a right to inspect and obtain a copy of protected health information about them 'in a designated record set', for as long as it is maintained there, subject to two exclusions - psychotherapy notes, and information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative proceeding. The covered entity must act within 30 days of receipt, with one permitted extension of no more than 30 days on written notice giving the reasons and the completion date. Fulfilling a 164.524 request from a legal health record definition is a common and consequential error: it produces a smaller set than the statute requires, and it does so invisibly, because the requester has no way to know what was omitted.

Because the information blocking regulations borrowed the definition. 45 CFR 171.102 defines electronic health information as electronic protected health information as defined in 45 CFR 160.103 'to the extent that it would be included in a designated record set as defined in 45 CFR 164.501, regardless of whether the group of records are used or maintained by or for a covered entity', excluding psychotherapy notes and information compiled in anticipation of litigation. Two consequences follow. An institution's designated record set boundary is now doing double duty - it scopes HIPAA rights and it scopes information blocking obligations. And the 'regardless of whether' clause deliberately extends the concept beyond covered entities, so actors who are not covered entities still have to reason about what would be in a designated record set.

Directly, because two of the four permitted denial grounds are defined by reference to it. 45 CFR 164.526(a)(2) allows a covered entity to deny an amendment request only where the information was not created by the covered entity (unless the individual gives a reasonable basis to believe the originator is no longer available to act), is not part of the designated record set, would not be available for inspection under 164.524, or is accurate and complete. The second and third grounds both turn on the designated record set. An institution whose designated record set definition is narrower than the regulation requires will therefore issue amendment denials that are wrong on their face. Amendment decisions are due within 60 days of receipt, with one extension of up to 30 days on written notice.

At minimum, six things. First, that the designated record set and the legal health record are distinct, and which one governs which process. Second, an enumeration of systems and record types inside the designated record set that goes beyond the EHR - registries, care management systems, decision-support outputs, billing systems, and any departmental system used to make decisions about individuals. Third, how the 'used to make decisions about individuals' test is applied when a new system is procured, and who makes that call. Fourth, what constitutes the legal health record, who authenticates it, and what is excluded and why. Fifth, whether the organisation operates as an affiliated covered entity, because that changes the boundary across corporate entities. Sixth, an explicit instruction that access and amendment requests are fulfilled against the designated record set, not the legal health record.

Some do, and the ones that rank well in search do so because an institutional policy document is genuinely the right format for this question - there is no single federal answer to copy. The University of Nebraska Medical Center, for example, maintains a policy titled 'Access and Amendment to Designated Record Set' (Policy 6059), and its guidance also records that UNMC, The Nebraska Medical Center, UMA and UDA constitute one affiliated covered entity for HIPAA purposes and may share protected health information with one another. That last point is worth generalising: in an academic medical centre the designated record set can span legally separate organisations, which is exactly the situation a narrowly system-based legal health record definition will fail to describe.

The legal health record is the concept that governs what you assert as your official business record, but the legal instrument governs whether you may release anything at all and how much. Under 45 CFR 164.512(e) a court order authorises disclosure of only the protected health information expressly authorized by the order, while a subpoena with no court order requires satisfactory assurances from the requesting party before any disclosure is permitted. Minimum necessary under 164.502(b) applies to a permissive disclosure, which is the basis for producing what the instrument identifies rather than the whole record. So the sequence is: establish the legal authority first, then scope the production, then apply your legal health record definition to what you assemble and authenticate.

In practice it usually is, for two structural reasons - it expressly includes billing records, and its third limb sweeps in anything used to make decisions about individuals regardless of which system holds it. But this is a pattern in how institutions draft, not a rule of law, and there is no federal requirement that the legal health record be a subset. What is fixed is the direction of the risk: because patient access and amendment rights are measured against the designated record set, defining that set too narrowly creates statutory exposure, whereas defining the legal health record too narrowly creates evidentiary and litigation exposure. They are different failure modes with different owners, which is another reason the policy should name both explicitly rather than treating them as one concept with two names.