During a compliance audit, a facility defines its legal health record (LHR) as all documents generated within the EHR plus scanned paper consents. A patient requests access to a pathology report maintained by an affiliated reference laboratory that is not interfaced into the EHR but was used for treatment decisions. Which statement best describes what the organization must provide?
Tap an answer to reveal the correct answer, rationale and source.
Answer:
Under HIPAA, the designated record set includes records a covered entity maintains and uses to make decisions about the individual. Externally generated reports relied upon for treatment may be included even if not stored in the EHR. Option A incorrectly treats the legal health record and designated record set as identical and excludes external reports. Option C incorrectly limits the designated record set to EHR-stored documents and excludes the pathology report used for treatment.
Source: HIPAA Privacy Rule, 45 CFR 164.501 (designated record set) and 164.524
