Also, HHS has indicated that records that otherwise meet the definition of designated record set, and which are held by a CE's business associate, are part of the CE's designated record set (see Standard Document, HIPAA Business Associate Policy) (65 Fed. Reg. 82462, 82489). This information includes:
Individuals have a right to access their PHI in a designated record set. However, in responding to a request for access, a CE is not required to create new information (for example, explanatory materials or analyses), that does not already exist in the designated record set (see Practice Note, HIPAA Privacy and Security (Individual Rights): Right of Access to PHI).