What Counts as Part of a Patient’s Medical Record?

Medical Answer

A patient’s medical record can include much more than the physician’s progress notes inside the EHR. Information generated or maintained as part of the patient’s treatment may include clinical notes, diagnostic results, monitoring data, medication information, treatment records, certain patient communications, and other information used to make decisions about the patient’s care.

Medical practices should clearly define what constitutes their legal health record and designated record set, identify where that information is stored, and make sure staff understand which systems and records may need to be searched when responding to a patient access request, legal request, audit, or other record-related issue.

A Medical Record Is More Than an Office Note

When someone asks for a medical record, staff may immediately open the EHR and print the progress notes. But a patient’s healthcare information may exist in many different places. Examples can include:

• History and physical information
• Progress notes
• Diagnoses
• Treatment plans
• Medication records
• Laboratory results
• Diagnostic testing
• Imaging-related information
• Monitoring data
• Procedure documentation
• Clinical communications
• Other information generated during treatment

The key is that the record tells the story of the patient’s care—not simply what one provider typed during an office visit.

Diagnostic Data May Be Part of the Record

Suppose your practice performs testing. The provider reviews a diagnostic report but the actual test produces additional data stored somewhere else.

Don’t automatically assume “The report is in the EHR, so that’s the entire record.” Information generated during treatment that relates to the patient’s:

• Medical history
• Diagnosis
• Prognosis
• Medical condition

may be important to consider when determining what constitutes the patient’s record.  This is particularly relevant for practices that use separate systems for:

• Imaging
• Cardiac monitoring
• Laboratory testing
• Other diagnostic services

Patient Information May Live in Multiple Systems

This is increasingly common. A practice may have an EHR plus a practice management system plus a patient portal plus an imaging system plus a laboratory interface plus an external cloud storage plus paper records. The fact that information isn’t stored inside the main EHR does not automatically mean it should be ignored.

Your practice needs to know what you keep, where you keep it, and how you retrieve it. That becomes critical when someone requests the patient’s record.

What Is the Legal Health Record?

The legal health record is generally the organization’s official record for business and evidentiary purposes. It may include information supporting:

• Patient-care decisions
• Services provided
• Claims for reimbursement
• Documentation of illness or injury
• The organization’s business and legal record

In practical terms, it helps establish what happened, what care was provides, and why decisions were made. Your practice should define this in writing rather than waiting until a lawsuit, an audit, or patient request to decide what counts.

What Is the Designated Record Set?

The designated record set, or DRS, is a HIPAA concept and can be broader than the legal health record. It can include records maintained by or for a covered entity such as:

• Medical records
• Billing records
• Payment information
• Claims information
• Certain care-management information
• Information used in whole or in part to make decisions about an individual

That distinction matters because HIPAA patient access rights generally center on information contained within the designated record set.

Legal Health Record and Designated Record Set Are Not the Same Thing

This can confuse practices.

Think: Legal Health Record = Official Business/Clinical Record

while: Designated Record Set = Broader Group of Records Relevant to HIPAA Access Rights

There can be overlap. But they serve different purposes. That’s why your written policy should define both. If staff simply use the phrase “The Medical Record” to mean everything without defining it, you may create problems when responding to patient requests.

Billing Information May Matter Too

Staff sometimes assume the medical records is clinical information only. That’s not always correct.

Certain billing, payment, claims, or other information maintained by the practice may fall within the designated record set, particularly when it is used to make decisions about the individual. Your billing team therefore may maintain patient information that has to be considered when defining your organization’s records.

This is another reason record management can’t be left solely to the medical records department or clinical staff. It often requires input from multiple departments.

Good Faith Estimates May Become Part of the Record

Practices subject to applicable No Surprises Act requirements may also generate Good Faith Estimates.

Those estimates should not automatically be viewed as disposable administrative paperwork simply because they relate to anticipated charges. Information generated as part of these patient-care and financial processes may need to be incorporated into your broader medical-record management procedures.

What About Patient Portal Messages?

Patient portals can contain substantial clinical information. Patients may use them to:

• Report symptoms
• Ask medication questions
• Describe side effects
• Request treatment guidance
• Discuss follow-up
• Provide information used in care decisions

Your practice should understand how portal communications are incorporated into or associated with the patient’s record. Don’t assume its just a message. The content and how it is used may matter.

What About Telephone Messages?

The same concern applies to telephone communications.

Imagine a patient says “I’ve been having chest pain since yesterday.” The employee documents the message and routes it to the provider. That communication can become important clinical information.

Your practice should have a process for documenting patient communications that: Affect Care → Trigger Clinical Decisions → Require Follow-Up

What About Emails?

If your practice communicates with patients through approved electronic channels, those communications may contain information relevant to care. The operational problem arises when information becomes scattered across EHR, personal inbox, shared inbox, portal, etc. and nobody knows which information has been incorporated into the patient’s record.

Your policy should define where clinical patient communications belong and who is responsible for ensuring they’re preserved appropriately.

What About Images and Diagnostic Reports?

Your practice may generate or receive:

• X-rays
• Ultrasound images
• Photographs
• Scans
• Other diagnostic images
• Corresponding interpretations

Don’t assume only the final report matters. Depending on the type of information, applicable requirements, and how the information is maintained and used, your practice may need to account for the underlying images or data as well. This is another area where state-specific retention requirements may also matter.

What About Paper Records?

Paper isn’t automatically obsolete simply because your practice uses an EHR. You may still receive:

• Outside records
• Patient forms
• Historical charts
• Signed documents
• Paper diagnostic reports

If these documents become part of the patient’s medical information, make sure they enter your established record-management process. If paper documents are scanned, verify that the electronic copy is complete, legible, accessible, and reproducible before destroying the original according to your policies and applicable requirements.

Psychotherapy Notes Require Special Attention

Psychotherapy notes are not simply another behavioral-health progress note.

They refer to notes recorded by a mental-health professional documenting or analyzing the contents of counseling conversations and are afforded special treatment under HIPAA. They should be maintained separately from the rest of the patient’s medical record.

This distinction matters when patients request their record. If your practice provides behavioral-health services, make sure clinicians understand exactly what Is a psychotherapy note versus what belongs in the general medical record.

Behavioral Health Records Are Broader Than Psychotherapy Notes

Don’t make the opposite mistake either. Behavioral-health records can include information such as:

• Prescriptions
• Session information
• Treatment frequency
• Clinical tests
• Diagnoses
• Symptoms
• Prognoses

Those aren’t automatically excluded merely because they relate to behavioral health. Psychotherapy notes are a specific category requiring separate treatment.

Substance Use Disorder Records May Have Additional Protections

If your practice provides substance use disorder services, you may need to consider 42 CFR Part 2 in addition to HIPAA. Certain federally assisted programs providing SUD services are subject to additional requirements for protecting patient-identifying information.

That means your medical-record policy may need a special section for SUD records rather than treating every category of PHI exactly the same.

Why Does Defining the Medical Record Matter?

Because almost every record-management question depends on it. You can’t confidently answer:

• How Long Do We Keep It?
• Can We Destroy It?
• Does the Patient Have Access?
• Should We Release It?
• Where Should We Store It?

until you answer what is it.

Defining your records is the foundation for: Retention + Access + Disclosure + Amendment + Destruction

Create a Record Inventory

One of the most useful things a practice can do is create a simple inventory.

List:

Record/System	Information Stored	Responsible Department
EHR	Clinical documentation	Clinical
Practice Management	Billing/claims	Billing
Patient Portal	Patient communications	Clinical/Admin
Imaging System	Diagnostic images	Clinical
Paper Archive	Historical records	Medical Records

Your actual inventory may be much more detailed. The important point is to know where patient information exists.

Include Clinical and Administrative Staff When Defining the Record

Don’t have one person write the entire policy in isolation.

Clinical staff understand how care is actually delivered.  Administrative staff understand how information is stored, billed, requested, released, and managed.

You need both perspectives. A practical record policy should reflect what happens in the actual practice—not simply what someone assumes happens.

Don’t Forget Outside Vendors

Some patient information may be maintained by:

• Cloud EHR vendor
• Billing company
• Laboratory
• Imaging vendor
• Record-storage vendor
• Other business associates

Ask: Does our practice know which vendors maintain information on our behalf? And: Can we retrieve that information when required?

You cannot solve a record request by saying “Our vendor has it, not us.” Your vendor relationships need to support your record-management obligations.

Make Sure Records Can Be Retrieved

A record that technically exists but cannot be found isn’t especially helpful. Your system should allow your practice to retrieve records when needed for:

• Patient care
• Patient access
• Audits
• Litigation
• Billing questions
• Other legitimate purposes

That’s why your record inventory should include where it lives and how we get it back not simply: Yes, We Have It Somewhere

Use the WHERE Test when defining your patient’s medical record:

1. W — WHAT information do we create?
2. H — HOW is that information used?
3. E — ELECTRONIC or paper—where is it stored?
4. R — RECORD category—legal health record, designated record set, or special record type?
5. E — EMPLOYEE responsible for maintaining and retrieving it?

If your practice can’t answer those five questions, you may not have full control of your medical record.

Real Practice Example

A patient requests their complete medical record. The staff print the office notes & lab results and send them. Several weeks later, the patient says important information is missing.

The practice then discovers:

• Diagnostic monitoring data is stored in a separate system.
• Patient portal communications contain medication instructions.
• Billing information relevant to the patient’s request is in the practice-management system.
• Historical paper records were scanned into a separate archive.

The problem wasn’t that the practice had no records. The problem was that nobody has defined where the complete record lived. A record inventory and written policy could have prevented the confusion.

Does Everything in the EHR Automatically Count as the Medical Record?

Not necessarily.

Your organization should define its legal health record and designated record set based on applicable requirements and how information is used. The fact that something is stored in a particular system isn’t the only consideration.

Are Billing Records Part of the Medical Record?

Billing information may be included in the HIPAA designated record set, particularly records maintained by or for the covered entity that are relevant to decisions about the individual.

That’s why your patient-record policy should account for both clinical and certain administrative information.

Are Psychotherapy Notes Part of the Regular Medical Record?

They should be treated differently. Psychotherapy notes have special protections and should be kept separate from the remainder of the patient’s medical record.

Are Patient Portal Messages Part of the Medical Record?

Clinical communications through a portal may contain information relevant to the patient’s treatment or care decisions.

Your practice should have a policy determining how those messages are retained and incorporated into the patient’s records rather than assuming they’re merely disposable communications.

Medical Record Definition Checklist

Identify Your Records

☐ Clinical notes
☐ History and physical information
☐ Diagnoses
☐ Treatment plans
☐ Medications
☐ Laboratory results
☐ Diagnostic reports
☐ Monitoring data
☐ Imaging information
☐ Patient communications
☐ Relevant billing information
☐ Other information used in patient-care decisions

Identify Your Systems

☐ EHR
☐ Practice-management system
☐ Patient portal
☐ Imaging system
☐ Laboratory systems/interfaces
☐ Cloud storage
☐ Paper archives
☐ Outside vendors

Define

☐ Legal health record
☐ Designated record set
☐ Psychotherapy notes
☐ Substance use disorder records when applicable
☐ Other special record categories

Assign Responsibility

☐ Who creates the information?
☐ Who maintains it?
☐ Who can retrieve it?
☐ Who responds to access requests?
☐ Who reviews the policy?

Bottom Line

A patient’s medical record is much more than the physician’s progress note.

Depending on your practice, it may include information spread across clinical notes, diagnostic data, test results, treatment information, patient communications, billing records, and other systems.

Your first step is to identify what information you maintain, where it lives, how it is used,  which record category it belongs to. Then clearly define your legal health record, designated record set, and special record categories.

You can’t manage medical records correctly if your practice doesn’t first know what the record actually includes.

Key Takeaways

• A medical record is not limited to the physician’s office note.
• Information created during treatment may be part of the record even if it is stored outside the primary EHR.
• Diagnostic test data and other clinical information may qualify as part of the medical record.
• Practices should identify every system that stores patient information.
• The legal health record and designated record set are not necessarily identical.
• Billing and other information used in making decisions about a patient may be included in the designated record set.
• Psychotherapy notes have special treatment and should be maintained separately from the rest of the medical record.
• Substance use disorder records may be subject to additional requirements under 42 CFR Part 2.
• Practices should create written policies defining their records and where those records are maintained.
• Knowing what constitutes the record is essential for retention, access, amendment, disclosure, and destruction.

Get More Practical Medical Records Guidance With an All-Access Pass Managing patient records requires much more than documenting the office visit. Your team needs to understand what belongs in the record, how long information must be retained, how access requests should be handled, when records can be destroyed, and how sensitive information must be protected. With a Healthcare Training Leader All-Access Pass, your entire team gets access to expert-led training covering medical records, HIPAA, compliance, billing, coding, practice management, credentialing, front desk operations, HR, and other challenges affecting medical practices. Give your staff practical guidance they can use to manage patient information more consistently, reduce compliance risk, and respond confidently when record questions arise. Why Trust Healthcare Training Leader? Healthcare Training Leader has helped more than 68,000 healthcare professionals at 10,000+ practices strengthen their skills and tackle the operational, financial, and compliance challenges they face every day. Our expert-led training focuses on turning complicated medical-record, HIPAA, compliance, billing, coding, and practice-management issues into clear, actionable guidance your team can put to work.