In the Final Rule published on Feb. 6, 2014, the U.S. Department of Health and Human Services (HHS), the Centers for Medicare and Medicaid Services (CMS), the Centers for Disease Control and Prevention (CDC) and the Office for Civil Rights (OCR) (together, the HHS Agencies) amended the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to provide individuals (or their personal representatives) with the right to access test reports directly from clinical laboratories that are subject to HIPAA. Such HIPAA-covered laboratories must comply with the applicable requirements of the Final Rule by Oct. 6, 2014. Further, by Oct. 6, 2014, a HIPAA-covered laboratory must revise its notice of privacy practices to inform individuals of this right, provide a brief description of how to exercise the right, remove any contrary statements and make the revised notice available as required by the HIPAA Privacy Rule. The Final Rule implemented revisions proposed by the HHS Agencies on Sept. 14, 2011.
There were several comments submitted in response to the proposed amendments to CLIA and HIPAA. For example, the Health Information Technology (HIT) Committee, established through the Health Information Technology for Economic and Clinical Health (HITECH) Act, noted that some stakeholders perceived the then-current CLIA regulations as imposing barriers to the exchange of health information, impeding an individual’s access to his or her own records and preventing patients from having a more active role in their personal health. Conversely, several commenters expressed concerns about giving individuals a way to receive laboratory test reports without the benefit of provider interpretation and without contextual knowledge that may be necessary to properly read and understand the reports. The HHS Agencies noted that the Final Rule does not require that laboratories interpret test results for patients and that patients merely have the right to inspect and receive a copy of their completed test reports and other individually identifiable information maintained in a designated record set by a HIPAA-covered laboratory.
HIPAA-covered laboratories will be required to provide an individual with access to his or her laboratory reports within 30 days of receiving the request. This new right extends to laboratory reports and other information about the individual held by the laboratory prior to the publication and effective date of the Final Rule. HIPAA-covered laboratories must comply with the fee limitations of the HIPAA Privacy Rule and state law in providing individuals with copies of their health information.
The HHS Agencies noted that the requirement to provide a patient with access to test reports will result in the preemption of a number of state laws that currently prohibit a laboratory from releasing a test report directly to the individual or that prohibit such release without the consent of the ordering provider, as such state laws will be contrary to the access provisions of the HIPAA Privacy Rule. However, the Final Rule will not preempt a state law that requires a laboratory to provide an individual with more timely access to test reports or that limits the types of identification a laboratory can ask an individual to provide for purposes of determining whether an individual is authorized to receive the laboratory test results. The HHS Agencies also clarified that the Final Rule applies only to laboratories. Thus, state laws that place requirements on other types of health care providers, such as those that require a provider to discuss certain test results with a patient, are not preempted by the Final Rule.
Overall, the HHS Agencies determined that the individual access provisions in the Final Rule affect laboratories in 39 states and territories. Further, laboratories in 46 states and territories will be affected by the requirement to update HIPAA notices of privacy practices as a result of the Final Rule.
If you have questions regarding achieving compliance with the Final Rule, including required updates to the Notice of Privacy Practices, please contact one of the authors.