Patients have a right of access―that is, to inspect and copy―all PHI in a "designated record set," which consists of medical records, billing records, and other records used to make decisions about them. Patient portals raise both privacy and security concerns under HIPAA. The main privacy issues involve the aforementioned patient right ....