DHHS Home Page NC DHHS On-Line Manuals  
     DHHS Manual Home Manual Admin Letters Change Notices Archive Search Index Help Feedback

Previous PageTable of ContentsNext Page



Section VIII:

Privacy and Security


Privacy Manual


Client Rights Policies, Designated Record Sets

Current Effective Date:

2/1/16, 11/15/15, 5/1/05

Revision History:

4/14/03, 11/15/15

Original Effective Date:




DHHS agencies shall identify categories of records maintained, collected, used, or disseminated by the agency that contain individually identifiable health information including medical records and billing records maintained by health care providers, specified records maintained by health plans and other records used in making decisions about clients.

Such records shall be termed "Designated Record Sets" and shall be considered the only personal health information records to which clients have a right to request access, amendment, and copies.


A Designated Record Set is a description of health and/or business information that can be maintained in one or many areas within an agency.

The term record means any item, collection, or grouping of information that includes information (including individually identifiable health information) and is maintained, collected, used, or disseminated by or for a health plan or health care provider.

Designated Record Sets are maintained by or for a health plan or health care provider and include:

Records created and/or maintained by an External Business Associate for services rendered to a DHHS agency must be considered when evaluating documentation for Designated Record Sets.

It is the responsibility of each DHHS agency to ensure that a Business Associate Agreement is in place when required.

Health information specifically created and/or maintained by External Business Associates, when acting on behalf of a DHHS agency, is subject to the client rights provisions to request access to or amendment of such information in accordance with the Business Associate Agreement. Copies of information that are also maintained by a health care provider or health care plan should not be included in the Business Associate's Designated Record Set.

DHHS agencies are not required to allow clients access to Designated Record Sets if a licensed health care professional determines that access to such information would not be in the best interest of the client or another individual, and such determination is documented.

DHHS agencies are not required to amend, at a client's request, any information in a record that the agency knows to be true and accurate.

Internal Business Associates who maintain individually identifiable health information are subject to the requirements of this policy in identifying Designated Record Sets. This is accomplished by joint agreement of the DHHS agency and its Internal Business Associate(s).

A process must be developed to evaluate the documentation maintained by the agency to determine those groups of records that should be categorized as Designated Record Sets. The defined process should ensure that the following information is gathered about the evaluated records:

The first step in the implementation of Designated Record Sets that are to be made available to clients is to identify and assess those health information records within the agency that may be classified as a Designated Record Set.

Identifying categories of Designated Record Sets requires an assessment of all documentation to determine which records should be included or excluded before further consideration is given to the categories to be classified as Designated Record Sets.

Documentation requirements must be assessed in order to identify those records that meet the intent of this policy. Health information in all types of media (e.g., paper, oral, video, electronic, film, digital) must be considered. Minimally, the following categories of records should be considered Designated Record Sets:

Medical Records

Business Records

Specify if the Designated Record Set is an automated system or a hard copy report produced by an automated system for the following:

Other records used by health plans and health care providers to make decisions about individuals. For example, documentation such as raw test data and laboratory reports maintained by various programs in the agency are considered "working records" and should be evaluated as to the benefit to clients to request access and amendment. Reports developed from working records that are filed in the medical record should be evaluated with the medical record as a whole and not as separate documentation. Examples of working records may include:


Documentation must be maintained that supports the agency's assessment of its records for determination of its Designated Record Sets. Documentation may be maintained electronically or on paper.

Such information must be kept current and available for reference should a client request access to his/her health information, including comments that identify any information included in a Designated Record Set that the client would not have a right of access, amendment, or copies.

Documentation requirements must be maintained for a period of at least six (6) y

For questions or clarification on any of the information contained in this policy, please contact DHHS Privacy Officer. For general questions about department-wide policies and procedures, contact the DHHS Policy Coordinator.

Previous PageTop Of PageNext Page


     DHHS Manual Home Manual Admin Letters Change Notices Archive Search Index Help Feedback