iOn September 14, 2011 the Department of Health and Human Services (HHS) issued a Proposed Rule that will require nearly every laboratory to provide patients with their completed test results upon the request of the patient. If adopted, this new rule will preempt state law in those states that currently allow laboratories to only furnish test results to the healthcare provider which ordered the test or which is responsible for using the test results in the treatment context.
HHS is heralding the Proposed Rule as assisting patients to become more involved in their own healthcare (and possibly reducing overall healthcare costs) when patients are able to directly access laboratory results without the need for a follow-up visit to the healthcare provider who ordered the test. However, some physicians are concerned that patients who access their own laboratory results will be overwhelmed by the information and may misinterpret the results if the physician is not able to explain the significance of the test results in the context of the patient’s overall treatment plan. Many laboratories already provide direct patient access to test results through secure electronic portals or provide written test results upon the request of the patient.
Under the Proposed Rule (available at http://www.gpo.gov/fdsys/pkg/FR-2011-09-14/html/2011-23525.htm) HHS will amend the Clinical Laboratory Improvement Act of 1988 (CLIA) regulations to specify that, upon a patient’s request, the laboratory may provide patient access to the completed test reports so long as the laboratory can confirm the identity of the patient. Under current CLIA rules, a laboratory is only authorized to disclose test results to an “authorized person,” the person responsible for using the test results in the treatment context, and in the case of reference laboratories, to the referring laboratory. An “authorized person” is the individual authorized under state law to order or receive the test results. In 13 states, laboratories are only authorized to furnish test results to the healthcare provider, and in seven additional states, provider approval is required before a laboratory can furnish test results directly to patients. The Proposed Rule will amend CLIA and preempt these state laws to allow laboratories to provide test results directly to the patient.
The Proposed Rule will also amend the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. While individuals generally have the right to access (and obtain a copy of) their protected health information from healthcare providers subject to HIPAA, this right of access under the HIPAA Privacy Rule does not apply to laboratories subject to CLIA to the extent that patient access is prohibited by (state) law. The proposed amendment to HIPAA will remove this exception so that all laboratories subject to HIPAA will be required to provide patient access to protected health information. Thus, the HIPAA amendments under the Proposed Rule will preempt any contrary state laws that prohibit HIPAA-covered laboratories from directly providing test results to patients.
In summary, if enacted, the provisions of the Proposed Rule will require HIPAA-covered laboratories to provide direct patient access to completed test reports that, using the laboratory’s authentication processes, the laboratory can identify as belonging to that patient. Laboratories will have 240 days to comply with these requirements following the publication of the Final Rule. The deadline for comments on the Proposed Rule is November 14, 2011.
