On February 3, 2014, the Centers for Medicare and Medicaid Services (CMS) released a final rule that permits patients or their representatives to have direct access to the results of their lab tests. This rule change is significant because under the prior rule, labs could only release test results directly to patients if the ordering medical provider expressly authorized the lab to do so at the time the test was ordered, or if disclosure was explicitly provided by state law.

Under the new rule, prior regulations under the Health Insurance Portability and Accountability Act (HIPAA) and the Clinical Laboratory Improvement Amendments (CLIA) that restrict patient access to lab tests will be modified. The new HIPAA regulations will require labs to provide patients with test results within 30 days of a request; however, the labs will not be required to provide an explanation of the test results. In comparison, the CLIA regulations will maintain the current role of medical providers in ordering lab tests and providing explanations of the test results to their patients.

Overall, the impact of the final rule permitting individual access to lab results will be broad. Currently, 26 states do not have a law allowing direct disclosure of test results to patients, and 13 states specifically prohibit direct access of lab results by patients. Furthermore, labs in 46 states and territories will need to update their HIPAA notice of privacy practices to show the new “direct” patient access to lab results.

Although CMS has touted the rule change as “empowering” patients with information to assist them in tracking their health, making healthcare decisions, and adhering to treatment plans, not everyone believes that direct access of lab results will enhance patient health care. In fact, the Association of American Medical Colleges (AAMC) is on the record as stating that there can be “serious negative consequences” because patients will have access to raw data without having the requisite medical knowledge to properly interpret the test results.

Nevertheless, despite the warning from the AAMC, the final rule is scheduled to take effect on April 7, 2014 and HIPAA covered labs will have 180 days from this date to come into compliance. Moreover, any state law which is contrary to the final rule will be preempted.