On February 6, 2014, the Department of Health and Human Services (HHS) released a Final Rule that amends the Clinical Laboratory Improvement Amendments of 1988 (CLIA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA).  The Final Rule provides that, by October 6, 2014, laboratories qualifying as covered entities under HIPAA must comply with an individual’s request for access to certain protected health information, including laboratory test results concerning that individual that are part of the laboratory’s designated record set. 

Previously, laboratories that were either subject to CLIA or CLIA-exempt and that received such requests were not required to provide record access to an individual.  Rather, laboratories were allowed to disclose results only to specific individuals authorized under state law to order or receive test results – generally a health care provider.  HHS has made clear that its goal in issuing the Final Rule is to empower individuals “to take a more active role in managing their health and health care.”  Several commentators have raised legitimate concerns, however, about whether the new access rights will help to achieve that goal.  Among the concerns is that individuals who are able to access test results directly from a lab (rather than through their treating provider) will misread and misinterpret the results without the benefit of their provider’s explanation.  HHS responded to this concern by stating that it does not anticipate that individuals will bypass their health care providers’ consultation, predicting instead that the changes brought about by the Final Rule will “encourage ordering and treating providers to more proactively discuss with patients the range of possible test results and what the results may mean for the particular patient before or at the time the test is ordered.”  Moreover, HHS emphasized that the Final Rule does not require laboratories to interpret test results for an individual, and that laboratories may refer an individual back to his or her provider if they receive such requests for interpretation.

An additional concern is that laboratories (particularly reference laboratories that receive referrals from primary laboratories to conduct testing) often do not have any pre-existing relationship or interaction with a patient, and thus provision of record access to those patients poses a challenge operationally.  While acknowledging this concern, HHS noted that in many cases, a patient will not even be aware of the fact that a reference lab is involved, and will only request access to records from his or her provider.  In those cases where a laboratory does receive a direct request from an individual, HHS determined that the operational difficulties were not sufficient reason to exempt such laboratories from providing record access to individuals, especially in light of the interest of promoting uniformity with respect to an individual’s right of access to protected health information.

While the clinical impact of individuals’ expanded right of access to laboratory records may be somewhat uncertain, the legal ramifications are more apparent.  As noted in the Final Rule, several state laws currently prohibit a laboratory’s disclosure of test results to a requesting individual, or condition disclosure on the treating provider’s consent.  To the extent those laws are applicable to HIPAA-covered laboratories, they will be preempted as of April 7, 2014 -- the effective date of the Final Rule.  Furthermore, HIPAA-covered laboratories that have not described an individual’s right of access to protected health information in their notice of privacy practices will need to amend their notice by October 6, 2014, to describe this right, as HHS has determined that the new access rights constitute a “material change” affecting laboratories’ privacy practices.  HIPAA-covered laboratories are advised to review their notice of privacy practices document as soon as practicable to evaluate the need for revisions.

The Final Rule is available available here.