The United States Department of Health and Human Services (HHS) recently released its final rule amending Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to allow patients direct access to lab results. The final rule will amend the CLIA regulations at 42 C.F.R. § 493.1291 and the Privacy Rule at 45 C.F.R. § 164.524.

CLIA

The final rule permits CLIA laboratories to provide patient test reports directly to patients (or their personal representatives) upon request. Prior to the final rule, laboratories were allowed to disclose results to specific individuals, including individuals authorized under state law to order or receive test results, generally meaning a health care provider. For states that did not permit patients to receive their own results, the patient had to contact his or her provider.

HIPAA

The final rule also removes barriers to a patient’s right of access under HIPAA. Consistent with CLIA regulations, historically patients could not inspect or copy medical records from a CLIA laboratory or a laboratory exempt from CLIA. However, the final rule now requires CLIA and non-CLIA laboratories to permit access to patients directly.

Compliance

As a result to the rule’s changes to CLIA and HIPAA, HIPAA-covered laboratories must, as of the compliance date, provide patients (and their personal representatives) with direct access to completed test reports (and other information in a designated record set) within 30 days and in accordance with the Privacy Rule. This access extends beyond completed test reports to the protected health information about the patient maintained in a designated record set (e.g., test orders, ordering provider information, and billing and insurance information) by the laboratory, including information generated prior to publication of the final rule.

While the Privacy Rule requires verification of identity of the person requesting access, in its preamble discussion, HHS explains that laboratories may not impose unreasonable verification measures, e.g., laboratories may not require an individual who wants a report mailed to a home address to physically come to the lab to request access and provide proof of identity in person.

In the preamble to the final rule, HHS also explains that the rule will encourage providers to more proactively discuss the range of possible test results and what the results may mean for the particular patient before or at the time a test is ordered. However, HHS clarifies that the rule does not require laboratories to interpret test results for patients. Instead, the rule gives patients the right to inspect and receive a copy of competed test reports, and laboratories may refer patients with questions back to providers.

The effective date of the final rule is April 7, 2014 and the compliance date is October 4, 2014.

A copy of the final rule is available here.