On February 3, 2014 the Department of Health and Human Services (“HHS”) issued a Final Rule granting a patient, or his/her personal representative or designee, direct access to the patient’s completed laboratory test reports, if so requested. In addition, the Final Rule eliminates the exception under the HIPAA Privacy Rule to an individual’s right to access his or her protected health information when it is held by a CLIA-certified or CLIA-exempt laboratory.

Under the Clinical Laboratory Improvement Amendments of 1988 (“CLIA”), labs were only permitted to release test results to the person authorized under state law to order or receive the results, the person responsible for using the test results for treatment, or the referring lab that requested the test.

Kentucky has no law addressing patients’ right to lab results, but a handful of other states do. Laws that prohibited a lab from releasing test results directly to a requesting individual or restrict release of such information without the ordering health care provider’s consent are now preempted in light of the Final Rule. State laws that require physicians to counsel patients about specific test results (such as HIV), however, are still applicable.

Labs are not required to notify the physician when a patient requests his or her records, but have the option to do so. It would make sense for labs to share this information; if a patient already has his or her records, the physician could be saved the administrative burden of requesting them and the lab could avoid duplicative responses to requests. A lab generally has 30 days to comply with a patient request and is not permitted to withhold records because of nonpayment for the lab’s services.

Physician Best Practices

Though this rule has the commendable goal of increasing transparency and patient knowledge, physicians should be careful to not let go of the reigns completely. In most cases, patients who obtain their own reports will still need an explanation of the results. It is possible that reports may be deceiving without the watchful eye of a physician who is familiar with the patient’s history (i.e., a report that shows false positives).

Ordering physicians are not required to inform patients of their right to receive test results from HIPAA-covered laboratories, but HHS encourages providers to be open about the available option.  Physician practices should consider revising Notices of Privacy Practices and establishing a uniform procedure for informing patients of this new right.

The Final Rule allows patients to choose whether they want their reports mailed or sent electronically from the lab. Physician practices could bridge the gap between lab and patient by establishing a secure online portal that enables a patient to view lab results online. This way, both the physician and patient have access to the reports. The site would allow a direct venue to stress the importance of follow-up appointments and communication with the ordering physician.

Covered entities must be in compliance with the Final Rule by October 4, 2014.