Designated Record Set

Layout for printing

Policy Number:

UW-111

Old Policy Number:

3.10

Responsible Office:

Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by state or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a federal floor of safeguards to protect the confidentiality of medical information. State laws that provide stronger privacy protections apply over and above the federal privacy standards.

Definitions:

Protected health information(PHI)

Health information or health care payment information, including demographic information collected from an individual, which identifies the individual or can be used to identify the individual. Protected health information does not include student records held by educational institutions or employment records held by employers.

Record

Any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a unit in the UW–Madison health care component.

UW–Madison health care component (UW HCC)

Those units of the UW–Madison that have been designated by the university as part of its health care component under HIPAA. See UW-100 Designation of UW-Madison Health Care Component for a listing of these units.

Scope:

Applies to all members of the UW HCC.

Policy:

Policy Summary

Under the HIPAA Privacy Rule, patients/clients have access to, may request copies of, and may request amendments of their protected health information in their designated record set. This document describes how the UW HCC specifies the designated record set.

Policy Detail

1. Each unit in the UW HCC should specify in writing its designated record set as defined under the HIPAA Privacy Rule.
2. The designated record set must include:
   1. The medical records and billings records about patients/clients maintained by or for the UW HCC unit;
   2. Any enrollment, payment, claims adjudication, and case or medical management records systems maintained by a UW HCC unit for a health plan; and
   3. Any other record used, in whole or in part, by or for the UW HCC unit to make decisions about a patient/client.
3. The designated record set does not include, for example:
   1. Research records (note: information from research that is entered into a patients/client’s medical record becomes part of the medical record, which is a designated record set);
   2. Student education records (e.g., records protected under the Family Educational Rights and Privacy Act (“FERPA”));
   3. Employee records; and
   4. Administrative records created or maintained by UW–Madison administrative personnel and offices that perform support functions on behalf of other HCC units as defined in UW-100 Designation of the UW-Madison Health Care Component.

Consequences for Noncompliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.

Further, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.

Supporting Tools

Additional information may be found at www.compliance.wisc.edu/hipaa.

Related UW-Madison Policies:

UW-100 Designation of the UW-Madison Health Care Component

UW-120 Requests by Patients to Amend Protected Health Information

UW-122 Requests By Patients For Access to Inspect and Obtain a Copy of Protected Health Information 

Related UW–Madison Documents, Web Pages, or Other Resources:

Office of Compliance Policies and Forms

External References:

45 C.F.R. § 164.501

45 C.F.R. § 164.524(e)

Policy Administration

Approval Authority:

Vice Chancellor for Legal Affairs

Policy Manager:

HIPAA Privacy Officer

Contact:

HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077

Effective Date:

03-15-2004

Revised Dates:

07-13-2014: Effective date of the revised policy: 07-13-2014.
03-26-2020: Effective date of the revised policy: 03-26-2020.

Retrieved:

01-19-2025 21:42:30