Lab Results Reporting, Ethics, and the 21st Century Cures Act Rule on Information Blocking

ACP Ethics Case Study Series

Authors, Case History 

Deepti Pandita, MD, FACP, FAMIA

Hennepin Healthcare
Plymouth, Minnesota

Dejaih Johnson, JD, MPA

American College of Physicians
Philadelphia, Pennsylvania

Thomas A. Bledsoe, MD

Warren Alpert Medical School of Brown University
Providence, Rhode Island

Author, Commentary

Thomas A. Bledsoe, MD

As seen above.


Lois Snyder Sulmasy, JD
Center for Ethics and Professionalism
American College of Physicians
Philadelphia, Pennsylvania

Ethics case studies are developed by the American College of Physicians Ethics, Professionalism and Human Rights Committee and the ACP Center for Ethics and Professionalism. The series uses hypothetical examples to elaborate on controversial or subtle aspects of issues in the College's Ethics Manual or other College position statements. The current edition of the ACP Ethics Manual and additional case studies and College policy on ethics, professionalism, and human rights issues are available at or by contacting the Center for Ethics and Professionalism at 215/351-2839.


Case History

Ms. Maxwell is a 23-year-old female patient of Dr. Cameron who knows that she has a history of sexual abuse as a teen and other social and mental health comorbidities, including post-traumatic stress disorder symptoms. Ms. Maxwell’s past experiences have led to a great deal of mistrust in the health care system and inconsistent follow up with her clinicians. Historically, she has declined cervical cancer screenings but this year, after a number of discussions with Dr. Cameron, Ms. Maxwell agreed to screening.

Most of Dr. Cameron’s patients have lab work done through a local health care system, HS Health Systems. While Dr. Cameron thoughtfully reassured Ms. Maxwell that she would be in touch with her as soon as the results were reviewed, they did not discuss the likelihood that Ms. Maxwell would see the electronic results before Dr. Cameron had a chance to contact her because the information blocking section of the 21st Century Cures Act is now in effect.

Ms. Maxwell’s screening showed evidence of cervical cancer. That evening, at home, Dr. Cameron reviewed the results and made a note in the patient’s chart that further follow up with Ms. Maxwell was necessary, resolving to reach out to her in the morning between patients. Unfortunately, Ms. Maxwell signed onto the patient portal that very evening and read the technical language in the pathology report, assuming the worst. After seeing the results, Ms. Maxwell had a mental health crisis that resulted in a trip to the ER that night. The whole experience escalated her underlying mistrust of the health care system. Dr. Cameron’s office reached out several times, but Ms. Maxwell refused the offered appointments.

Dr. Cameron feels awful about the whole episode. She was sure that it was important that her patient have the Pap smear and thought she could manage the results and the patient’s reaction to them. Had she failed the first lesson she learned in medical school to “first, do no harm”? Is she doing more harm than good?


Test results review: By whom, why, and when?

How does a well-meaning attempt to empower a patient turn into a painful experience for a vulnerable patient and a frustrating and demoralizing episode for a physician trying to do her best for that patient? From time immemorial, results of tests have been reported to the ordering physician because the ordering physician was best positioned to interpret those results and share the appropriate interpretation with the patient. The clinical significance of a test result is rarely a binary “normal” or “diagnostic” event; it requires deep understanding of disease processes and test characteristics, including but not limited to sensitivity and specificity in a specific clinical context. The correct interpretation of results is a crucial aspect of being a skilled clinician in both diagnosis and treatment. That interpretation in the context of a patient-physician relationship includes development of appropriate further diagnostic and then treatment strategies together with the patient. The case presented here demonstrates how release of information alone risks harming both the patient in the moment and also the patient-physician relationship going forward. Historically, for tests with “high emotional impact”, patients have preferred in person review of the results. Current practice realities have made this approach more difficult to achieve.1

In the case above, the results are released directly to the patient the moment they are available. The 12-hour gap between the patient receiving her results and those results subsequently coming to the attention of her physician was enough to cause her significant harm, even though the patient was assured of being notified of those results “as soon as they were received.” The AMA says, “Patients should be able to be confident that they will receive the results of clinical tests in a timely fashion. Physicians have a corresponding obligation to be considerate of patient concerns and anxieties and ensure that patients receive test results within a reasonable time frame.”2  Two key words in this opinion are “timely” and “considerate.” Timely is not explicitly defined but a considerate physician would know that the period between test completion and test result availability can be a time of high anxiety for the patient, especially if the differential diagnosis includes potentially serious diseases. An egregious example would be a patient who undergoes a breast biopsy, whose results are reported to the physician at the beginning of the physician’s one-week vacation, making the patient wait that extra week to hear the diagnosis of “benign lesion.” Both the patient’s expectations and the physician’s access to test results have changed in the current electronic health systems environment, redefining “timely” and raising new issues for the “considerate” clinician.

21st Century Cures Act final rule on information blocking: What and why?

Patients cannot be informed and active participants in their health care without the information needed to make informed choices. Electronic health information systems present opportunities for more effective patient participation. In seeking to leverage those opportunities, the information sharing standards in the 21st Century Cures Act Rule on Information Blocking3 (confusingly referred to in the negative as exceptions to restrictions on information blocking) are intended to standardize information formats in order to allow easy patient access to their clinical information through secure application programming interfaces (APIs).

The APIs will provide that direct access securely, obviating the need for cumbersome procedures currently in use to protect patient privacy. Patients having this information gives them more control of their health care. It is hoped that this expanded access will also result in improvements in the patient-physician relationship, including enhanced trust, transparency, communication, and informed decision-making.

These benefits notwithstanding, the case history highlights just some of the possible risks in immediate patient access to unfiltered medical information. Release of information without counselling may result in misinterpretation, which may cause real harm for the patient in terms of stress and anxiety. Even results correctly interpreted without being connected to a treatment plan may cause distress for patients or their representatives. Deficits such as these would not be easily corrected by an app that simply allows access to pieces of information without context.

Apps will likely become more sophisticated over time in providing some of the context needed for understanding by patients, but they will never replace a human relationship with a trusted clinician. In the meantime, the negative consequences highlighted above are all too likely, and place practitioners in the difficult position of considering every test as an opportunity for harm beyond the risk of the test itself.

Dr. Cameron has an ethics problem

Dr. Cameron has several clinical decisions that have important ethical considerations in her interaction with Ms. Maxwell. Should she raise the issue of cervical cancer screening at this visit or defer it for “a better time”? If she raises the issue, should she just offer the test or seek to persuade the patient to undergo the test? When discussing the benefits and burdens of the test, beyond discussing the discomfort of the procedure should she also talk about the benefits and burdens of how the results will be first available to the patient? Should she take the additional time required to counsel Ms. Maxwell on all the outcome possibilities and consequences of all the possible test results in detail prior to ordering the test to begin with? When the results became available (to patient and physician), should she have made the patients in the waiting room wait while she arranged next steps and then called Ms. Maxwell, gave her the information, helped her understand the information, conveyed her arrangements for next steps and then arranged for follow-up for her? When she saw the results late in the evening, should she have interrupted story time for her young children and called the patient at home, perhaps increasing the concern of the patient with the late phone call?

The pathologist, the hospital lab director, and the hospital president have ethics problems, too (they just don’t know it)

A pathologist reviewed this Pap smear and posted the results, knowing that both patient and clinician would have immediate access to the results. Pathologists and radiologists are bound by the same codes of ethics as other physicians.2,3 These physicians must keep in mind that this technical information is about a real person with hopes and fears, with personal and family connections and responsibilities and usually without medical training. With implementation of the final rule, these physicians have an obligation to protect (their) patients from harm, too.

Circumstances in which delay in release of information is allowable

The 21st Century Cures Act allows for delayed release (“information blocking”) by “actors” (i.e., clinicians and health care entities) when such release is likely to cause harm, but only under strict requirements. The considerate physician knows that “results should be shared in a manner that does not cause harm.”2 The final rule on “information blocking” (i.e., interfering with the immediate release of medical information) stipulates a number of exceptions that speak to physician concerns about immediate access of such information. The final rule lists eight justifications to “block” direct release, including “preventing harm.”5 “Individual determinations made in good faith by an ordering clinician, in the exercise of professional judgment and in the context of the treatment relationship within which they order the test, could meet the ‘preventing harm’ exception as long as the ordering clinician can document the rationale for delaying the release of the results. These determinations must be made at the individual patient and individual test level at the time of ordering the test." Blanket delay for all of a certain type of results or all results for a certain individual or class of patients is not allowed.3 On a case-by-case basis, physicians might be able to mitigate the risk of harm by discussing with their patients in advance what possible test results might mean for them in their unique medical situation when individual patient- and test-level blocking is not feasible. In those cases, informed consent to proceed with the test would include information about the manner and timing of release of results. Some circumstances might result in advice by the clinician that the patient not seek the results on their own, coupled with a commitment by the clinician to provide timely and considerate discussion of both the results and the meaning of those results. Could such advice from the clinician to the patient to not seek the results actually create a perverse incentive for the patient to do just that?

Many physician practices utilize private or health system-based testing facilities and feel they have no control over how those organizations manage their compliance with the final rule and its accompanying regulations. For facilities, the default may be a blanket release of information directly to the patient in all cases. With little control over (or even knowledge of) the communication between patient and physician either before or after the performance of a test, these larger organizations may find the required individual patient/individual result requirement infeasible. While compliance with the 21st Century Cures Act is achieved by releasing all results at the moment the pathologist or radiologist enters the report without care or concern for the patient and their response to seeing them on their own computer, at home and alone, hospital systems and testing facilities have an obligation to attend to the welfare of the population they serve6 and should be challenged to do better.

In effectively straddling the tension between “the information belongs to the patient” and “an important obligation of the physician is in interpreting test results for patients,” the AMA Opinion goes on to say that physicians should advocate for policies [at those testing facilities] to ensure that the patient is informed both when to expect test results and how they will be informed, as well as that “test results are conveyed sensitively, in a way that is understandable to the patient.” Importantly, the Opinion goes on to state that physicians should advocate for policies that allow notification of the physician before disclosure to the patient takes place.

Whole system whole patient orientation

Clumsy enactment of complicated regulations has resulted not only in an ethical dilemma but in an existential crisis for Dr. Cameron, while the pathologist sleeps soundly and the hospital president heads out to a fund-raising banquet. Has the hospital and testing facility fulfilled their obligations? Have the physicians who use that testing facility fulfilled theirs?

Surely we can do better than “all or none” access by a patient to medical records. While the final rule admits that some disclosures will cause harm and may justifiably be delayed, practically speaking, even the AMA notes that “Abnormal Medical Test Findings” is a descriptor so broad as to be useless, making “Abnormal Medical Test Findings that might cause harm to the patient” an even less useful category that is practically not actionable. In any case, such “blanket exceptions” are not, as noted, allowable exceptions.

As medical practitioners, we are all obligated to care for the whole patient. For valid informed decision-making (i.e., informed consent) we are obligated to inform the patient about both the rationale for and the burdens of our diagnostic testing strategies and help them make decisions on how to proceed in keeping with their health-related values.4,7  “How and when to disclose information… must be addressed with respect for patient wishes” and “physicians should be sensitive to the patient’s response in setting the pace of communication…”4 says the ACP Ethics Manual.

Abnormal test results happen and should be planned for at both the exam room and the system levels.8 Test results need to be converted from facts to meaning and that meaning must by specified to a person. “Here are your test results and here is what they mean for you” and, “Here are your test results and we are in this together so let us talk about what we should do next?” Similarly, pathologists, radiologists, and health systems need to think more broadly about the effect of hitting that “publish” button on a report that will be instantly available in raw form to the patient. A better system is possible.

What then must we do…?

It is likely that the health care system in this case also has a cancer center. What message has the system sent to Ms. Maxwell in bluntly releasing her unfiltered test result with the knowledge that the results may be devastating to the patient as presented? An argument from virtue ethics is that such behavior is not consistent with what a good doctor would do. An argument from pragmatism is that the system may lose business from patients who are put off by such inconsiderate handling of this sensitive information. An argument from deontology is that the system and the practitioners who work there have an obligation to protect the patient’s interests and an argument from principlism argues that physicians (and their institutions) should not cause harm.

The health care system must attend to the effect published results and the “downstream costs” such releases will have for patients. Resources should be put in place to support compassionate reporting of important results to patients, especially of serious or life-threatening results. Pathologists and radiologists must either present information in a way that has meaning to the patient or design a method to temporarily “block” those results, within permissibility, from patient access until the ordering physician is able to share the meaning of those results with the patient in an appropriate and compassionate way. “Dump and run” reporting of serious medical results (i.e., publishing results indiscriminately without regard for either the seriousness of the findings or the needs of the individual patient) is not justifiable for physicians of any sort. Dr. Cameron and her colleagues must speak up and to testing facility administrators to advocate for systems that both honor patient needs for timely presentation of results and also protect patients from facts without meaning or context. They must also speak up individually or through their national organizations to help the regulatory institutions come up with workable solutions that allow them to honor their professional obligations to care for patients. We can do better.  

Claim CME Credit and MOC Points


  1. Shultz SK, Wu R, Matelski JJ, et al. Patient preferences for test result notification. J Gen Intern Med. 2015;30:1651–56.
  2. American Medical Association. Reporting clinical test results. Accessed at on 19 July 2022.
  3. U.S. Department of Health and Human Services. 21st century cures act: interoperability, information blocking, and the ONC health IT certification program. Fed Regist. 2020 May 1;85:25642-961.
  4. Sulmasy LS, Bledsoe TA, for the American College of Physicians Ethics, Professionalism and Human Rights Committee. American College of Physicians ethics manual: Seventh edition. Ann Intern Med. 2019;170:S1-32.
  5. Black JR, Hulkower RL, Ramanathan T. Health information blocking: responses under the 21st century cures act. Public Health Rep. 2018;133:610-13.
  6. DeCamp M, Snyder Sulmasy L. Ethical and professionalism implications of physician employment and health care business practices: a policy paper from the American College of Physicians. Ann Intern Med. 2021;174:844-51.
  7. Emanuel EJ, Emanuel LL. Four models of the physician-patient relationship. JAMA. 1992;267:2221-26.
  8. Christensen K, Sue VM. Viewing laboratory test results online: patients’ actions and reactions. J  Particip Med. 2013;5:e38.