Designated Record Set is a variable that appears in the Business Associate Agreement Cover Page, in the Key Terms section. This section is for your agreements' key legal terms.
This term allows you to specify whether you, the Provider, are maintaining PHI as designated record sets for the Covered Entity or Business Associate.
A designated record set is the collective group of records related to the patient’s treatment that are maintained by a Covered Entity or Business Associate. This could include records related to treatment, test or diagnostic results, payment history, billing information, etc. that are maintained collectively to assist with the patient’s care.
This concept is important because patients have a right to request some or subsets of their designated record set. This means that a Covered Entity has to have an idea what records make up the designated record set and who maintains it. It is possible in the chain of services that a Business Associate (or even their sub-contractor) may create or even maintain part of that record set on behalf of the Covered Entity.
How to fill this out
Generally, companies that support patient treatment or payments maintain designated record sets, while companies who support the operational needs of a Covered Entity or Business Associate (like AWS) do not maintain designated record sets. If you're unsure, be sure to consult your lawyer.
Factors to consider when selecting whether you maintain a designated record set:
Do the services your company provides involve the creation of new records related to the patient’s treatment?
Do you maintain some or parts of the patient’s records as part of your services?
Are your services involved in patient payments?
If your company’s services require use or disclosure of PHI, but you do not create or maintain such records, you likely do not maintain PHI as a designated record set.
Default: Provider does NOT maintain PHI as designated record sets.