Publications: HHS Proposes Rules Requiring Laboratories to Give Patients Direct Access to Test Results

On September 14, 2011, three operating divisions of Department of Health and Human Services jointly issued proposed rules requiring clinical labs to directly provide patients with their test results upon request.

Currently, patients are only able to obtain their test results through the ordering provider, unless state law expressly provides for direct access by patients. The Centers for Medicare and Medicaid Services, the Centers for Disease Control and Prevention and the Office for Civil Rights collectively propose to amend the Clinical Laboratory Improvement Amendments of 1988 (CLIA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to allow patients direct access to lab results.

The current HIPAA regulations provide an individual right of access to protected health information (PHI). However, the regulations contain a carve-out which states that individuals do not have a right of access to obtain their test results directly from labs. The proposed rule would eliminate this carve-out, bringing test results directly from labs back within the PHI to which persons are afforded an individual right of access. The proposed rule also amends the CLIA regulations to specify that a lab may provide individuals with access to completed test results upon request.

Importantly, the proposed rule would preempt the laws of 13 states (including Illinois, Wisconsin and Missouri) that allow test results to be reported only to the ordering provider, and impact 23 states (including Indiana, Iowa and Minnesota) that have no law regarding who can receive test results. However, states would be free to enforce laws that give individuals greater access to PHI.

Although patients are currently able to obtain test results through the ordering provider, the agencies believe that direct access to test results will help animate certain health reform goals, such as encouraging patients to be actively involved in their health care.

Under the proposed rule, test results would be required to be provided to individuals in manner that complies with the Privacy Rule. Specifically, the results must be provided in the format requested by the patient, if they are readily producible in such format. Entities may charge a reasonable fee reflecting the actual cost of: (i) supplies and labor for copying the requested information, (ii) postage, if the patient requests that the information be mailed, and (iii) summarizing the information, if the patient requests a summary or explanation.

The agencies seek public comment on numerous issues regarding the proposed rule. Comments must be submitted no later than 5 p.m. on November 14, 2011. If finalized, the proposed rule would become effective 60 days after it is published in the Federal Register, and HIPAA-covered labs would be required to comply within 180 days of the effective date, a total of 240 days after publication.

The full text of the proposed rule, including information on submitting public comments, can be found here.

Should you have any questions regarding the proposed rule, or laws and regulations associated with clinical laboratories or HIPAA, please contact a member of the Ungaretti & Harris Healthcare Group.