---
title: "What Is a Designated Record Set? HIPAA Definition"
description: "A designated record set is the medical, billing and decision records a covered entity keeps on patients. What it covers, who owns it, and Cuvo's approach."
canonical: "https://cuvo.co/glossary/designated-record-set"
last-updated: "Oct 26, 2026"
---
**Definition:** A designated record set is the group of records a HIPAA covered entity keeps about individuals, including a provider's medical and billing records and any records used to make decisions about them; it is what a patient may inspect and copy (45 CFR 164.501).

# What is a designated record set under HIPAA?

HIPAA does not talk about owning records. It defines the designated record set, the records a covered entity keeps and uses about each patient, and gives the patient rights over it. On a white-label platform that set is the treating practice's, and on Cuvo Health the brand owns its own business records, exportable at any time.

Published Oct 26, 2026. Facts reviewed Oct 26, 2026.

A designated record set is the group of records a HIPAA covered entity maintains about individuals. Under 45 CFR 164.501 it covers the medical and billing records about individuals maintained by or for a covered health care provider, plus any other records used to make decisions about individuals; a record is any item that includes protected health information. Because the definition says by or for, records a business associate keeps for the practice count. The set is what a patient may inspect, copy and ask to amend. On Cuvo Health, the brand owns the patient relationship, the customer list and every business record, exportable at any time, while the medical charts belong to the treating professional corporation and its licensed clinicians, as HIPAA and state law require.

**At a glance**
- What it is: The records a covered entity keeps and uses about individuals
- Defined in: 45 CFR 164.501
- Includes: Medical and billing records, plus any records used to make decisions about individuals
- Kept by others: Records a business associate maintains for the covered entity are part of the set
- Why it matters: It is the scope of the patient's rights of access (164.524) and amendment (164.526)
- On Cuvo: The brand owns its business records; charts belong to the treating professional corporation

**What sits in the designated record set in a white-label telehealth model**

| Record | In the designated record set? | Why |
| --- | --- | --- |
| **Medical records kept by or for the treating provider** | Yes | 164.501 names medical records about individuals |
| **Billing records about individuals kept by or for the provider** | Yes | 164.501 names billing records about individuals |
| **Other records used to make decisions about individuals** | Yes | Paragraph (1)(iii) of the 164.501 definition |
| **Psychotherapy notes and material compiled for a legal proceeding** | Excluded from the right of access | 164.524(a)(1) carves both out of access |
| **The brand's customer list and business records** | Not when the brand keeps them for its own business | Owned by the brand and exportable at any time on Cuvo |

## 01. Why does the designated record set matter in telehealth?

It fixes the scope of the patient's rights. Under 45 CFR 164.524 a patient may inspect and obtain a copy of protected health information in the designated record set for as long as it is kept there, and 164.526 lets the patient ask for it to be amended. A telehealth practice therefore needs to know where every piece of the set lives: the chart on the clinical platform, lab results, prescription history and any billing records about the patient's care.

## 02. Who owns the designated record set on a white-label platform?

HIPAA assigns duties rather than ownership: the designated record set is the covered entity's to maintain and to open to the patient. In a white-label model that covered entity is the treating practice. The brand's ownership runs to everything outside the chart. On Cuvo, the brand owns the patient relationship, the customer list and every business record, including orders, subscriptions, invoices and revenue, all exportable at any time; medical charts belong to the treating professional corporation and its licensed clinicians, as HIPAA and state law require.

## 03. How is a designated record set different from a medical record?

It is broader. The medical record is one part of the set; HIPAA adds billing records about individuals and any other records used to make decisions about them, wherever they are kept for the covered entity. A business associate agreement must require the vendor to make protected health information available for access and amendment (164.504(e)(2)(ii)(E) and (F)), which is how records held on a platform stay reachable. This is general information, not legal advice.

**Primary sources**
- [45 CFR 164.501: designated record set](https://www.ecfr.gov/current/title-45/section-164.501): eCFR, checked Oct 26, 2026
- [45 CFR 164.524: right of access](https://www.ecfr.gov/current/title-45/section-164.524): Access to PHI in the designated record set
- [45 CFR 164.504(e): business associate contracts](https://www.ecfr.gov/current/title-45/section-164.504): Access and amendment duties of a business associate

## Frequently asked questions

**Q: What is a designated record set?**

A: It is the group of records a HIPAA covered entity keeps about individuals: a provider's medical and billing records plus any records used to make decisions about them, as defined in 45 CFR 164.501. On Cuvo, the medical charts belong to the treating professional corporation and its licensed clinicians, and the brand owns its own business records.

**Q: What is included in a designated record set?**

A: Medical records and billing records about individuals kept by or for a covered health care provider, and other records used to make decisions about individuals, including those a business associate keeps for the provider. On Cuvo, charts, prescriptions and lab results sit on HIPAA-compliant infrastructure under a business associate agreement on every plan.

**Q: Who owns medical records in telehealth?**

A: The medical chart belongs to the treating practice and its licensed clinicians, who keep it as the designated record set under HIPAA and state law. On Cuvo, the brand owns the patient relationship, the customer list and every business record, exportable at any time, while the charts belong to the treating professional corporation.

**Q: Does a designated record set include billing records?**

A: Yes. 45 CFR 164.501 names billing records about individuals maintained by or for a covered health care provider alongside medical records. On Cuvo, the brand's own orders, subscriptions, invoices and revenue records belong to the brand and are exportable at any time.

**Q: Does a telehealth brand keep a designated record set?**

A: The designated record set belongs to the covered entity, which in a white-label model is the treating practice, not the consumer brand. On Cuvo, the brand keeps its customer list and business records, and the treating professional corporation keeps the charts.

**Related pages**

- [Who owns the patients and data in white label telehealth](/blog/who-owns-the-patients-and-data-on-a-white-label-telehealth-platform): The full ownership guide: records, charts, exports and exit terms
- [HIPAA right of access](/glossary/hipaa-right-of-access): The patient's right over the designated record set
- [Protected health information (PHI)](/glossary/protected-health-information): What every record in the set contains
- [Covered entity (HIPAA)](/glossary/covered-entity): Who maintains the set
- [Cuvo pricing](/pricing): Full data export on every plan
- [Telehealth glossary](/glossary): Every term a telehealth founder meets

Canonical page: https://cuvo.co/glossary/designated-record-set