Summary
This final rule makes amendments to the Clinical Laboratory Improvement and Amendments of 1988 (CLIA) regulations and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to provide individuals the right to receive their test reports directly from laboratories. Under this final rule, patients (and their authorized personal representatives) have the right to receive requested laboratory results within 30 days of making a request. In a 2011 comment letter on the corresponding proposed rule, the College indicated that these changes were "broadly consistent with College policy that promotes the transparency of a patient's healthcare information."2 The College furthermore recommended that all directly accessed laboratory reports include a standard statement that provides general guidance on understanding lab results to limit misinterpretation—"both unwarranted concerns and inappropriate reassurances"—and encourages patients to review the results with the ordering physician or healthcare professional. The final rule does not require the recommended statement.
The mandating of direct access to laboratory reports was also supported by multiple additional stakeholders including patient advocate groups, other physician/healthcare professional organizations, health policy experts, health plans, test laboratory organizations, and various health information technology groups. Benefits anticipated include allowing patients to have increased control over their personal health information, facilitating their ability to receive this information in a timelier manner, and, in general, appropriately reinforcing patients' active participation in their healthcare.
What laboratories does this rule specifically affect?
The rule mandating direct access to requested laboratory information covers all CLIA and CLIA-Exempt laboratories covered under HIPAA3. In essence, the rule covers almost all laboratories used by our members.
Who can request the laboratory results?
The laboratory results can be directly requested by the patient and the patient's authorized representative or given to another person or entity specifically designated by the patient or authorized representative.
Are there any exceptions to the release of this information directly to the patient?
There is a limited exception for cases where a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person. Under this limited exception, the requesting individual is provided a right to have the denial of access reviewed by an unaffiliated health care professional.
How must covered laboratories handle requests from individuals for direct access to their results?
The rule, in recognition of the varied circumstances of each laboratory, provides laboratories with substantial flexibility regarding the systems used to receive, authenticate, process, and respond to requests for access to laboratory results by individuals.
Is the laboratory required to provide any interpretation with the results?
The final rule does not require laboratories to interpret test reports for individuals. However, while not required, a laboratory may also provide additional educational or explanatory materials regarding the test results to individuals if it chooses to do so.
How must the information be provided?
The laboratory is required to provide the Individual with a copy of the requested information in the form and format requested by the individual, if a copy in that form or format is readily producible. If not, the copy must be either a readable hard copy or in another form or format as agreed to by the covered entity and the individual.
How does the final rule address concerns about patients receiving test reports without physician or other qualified healthcare professional interpretation?
Commentary emphasizes that this rule does not alter the role of the ordering or treating physician and qualified other healthcare professional in reporting and explaining test results to patients. It is expected that patients will continue to obtain test results and advice about what those test results mean through their ordering or treating physician and other qualified healthcare professional. Further, for those individuals who do or will request access to test reports from a laboratory, it was the experience of one large laboratory that many patients do not request access to their test reports from a laboratory until they have spoken with their physicians.
Furthermore, it is believed that the rule will further encourage ordering and treating physicians and other qualified healthcare professionals to more proactively discuss with patients the range of possible test results and what the results may mean for the particular patient before or at the time the test is ordered.
Finally, laboratories will be required to provide individuals with access to their laboratory test reports within 30 days of the request. It is believed that 30 days will generally be sufficient to allow the ordering or treating physician or other qualified healthcare professional to receive the test report in advance of the patient's receipt of the report, to communicate the result to the patient, and counsel the patient as necessary with regard to the result.
Are ordering physicians and other healthcare professionals required to inform their patients of their right to direct access to their laboratory results?
The rule encourages, but does not require, treating health care professionals to inform individuals of their right to receive test reports directly from HIPAA-covered laboratories. It was believed that requiring doing so would create an unwarranted burden.
The rule does require laboratories to modify their HIPAA privacy notices to specify the right to direct access of their laboratory results.
Does the rule pre-empt related state laws?
This final rule pre-empts all related state laws, except those that require greater access (e.g. information needs to be provided in less than 30 days) than indicated in this final rule.
Which states are affected by this final rule?
Currently, only the following states allow direct access to laboratory results:
Delaware
District of Columbia
Maryland
New Hampshire
New Jersey
Nevada
Oregon
Puerto Rico
West Virginia
Thus, this final rule affects all other states/territories, which have no law regarding receipt of test reports, require the report to only go to the physician or other qualified healthcare professional, or allow direct access only with physician or other qualified healthcare professional approval.4
When does this final rule take effect?
HIPAA-covered laboratories have a total of 240 days after publication of this final rule in the Federal Register to come into compliance. The rule was published on February 6, 2013; thus full compliance for HIPAA covered laboratories is required as of October 6, 2014.
1 CLIA Programs and HIPAA Privacy Rule; Patients'
Access to Test Reports (CMS-2319-F)” Final Rule available at
http://www.gpo.gov/fdsys/pkg/FR-2014-02-06/pdf/2014-02280.pdf.
2
http://www.acponline.org/acp_policy/letters/cms_clia_hipaa_test_reports_2011.pdf
3 A laboratory would only not be covered under the
relevant HIPAA regulations if it did not conduct its covered
healthcare transactions (e.g. transmission of healthcare claims)
electronically.
4http://www.gpo.gov/fdsys/pkg/FR-2014-02-06/pdf/2014-02280.pdf.
See table 4 on page 7308.