Key Takeaways
- Clinical laboratories are subject to federal information blocking rules that generally prohibit interfering with patient access to electronic health information.
- Once a laboratory result is complete, delaying patient access — including to allow physician review first — may constitute prohibited interference.
- Exceptions exist for compliance with federal and state privacy laws and for preventing harm tied to specific patient circumstances, but blanket policies delaying sensitive results do not qualify.
- Laboratories operating nationally should understand varying state requirements that may permit or require different release protocols.
With the availability of electronic delivery, patients can often access laboratory results earlier than they could before. Results that once moved from the laboratory to the ordering physician and then to the patient may now appear in a patient portal even before the physician has reviewed them. Federal information blocking rules favor accessibility, but they do not require laboratories to release every piece of laboratory data immediately.
State laws may impose separate requirements regarding who may receive laboratory results, when they may be released and how they must be communicated. The federal information blocking rules do not override those requirements.
Following is a guide to when laboratory information must be made promptly available and when it can wait.
1. What is information blocking, and why does it apply to laboratories? The 21st Century Cures Act includes provisions that prohibit certain health care actors from engaging in practices — known as “blocking” — that interfere with the access, exchange or use of electronic health information (EHI). In implementing these information blocking prohibitions, the Office of the National Coordinator for Health Information Technology (ONC) established rules to support patient access to EHI and the exchange and use of health information. Clinical laboratories are among the healthcare providers subject to these rules, so the rules reach practices affecting results shared via patient portals, laboratory order interfaces and other systems through which laboratory information is exchanged.
2. What laboratory information does the rule cover? The information blocking rules apply to EHI, which generally means electronic protected health information that would be included in a HIPAA-designated record set. That includes a provider’s medical and billing records and other records used, in whole or in part, to make decisions about individuals. For laboratories, the category extends beyond the final result and may include orders, billing records and other patient-specific information maintained or used to make decisions about individuals.
3. When does a laboratory need to make results available to patients? For HIPAA access purposes, the Department of Health and Human Services treats a laboratory test report as part of the laboratory’s designated record set when the report is complete, meaning that all results associated with the ordered test are finalized and ready for release. Because electronic information in the designated record set constitutes EHI, completion marks an important line for the report itself for information blocking purposes. Confirmation and quality review needed to finalize an accurate result do not require the laboratory to release an unfinished report.
Once a result is complete, the analysis changes. The information blocking rules do not require a laboratory to establish a patient portal or proactively send results to patients. When a patient requests electronic access, however, delaying access to EHI that is available to the laboratory can constitute interference. According to ONC, this includes a patient logging into a portal to access available results or authorizing an application to receive them. ONC also said that an organizational policy withholding completed laboratory results to allow the ordering clinician to review or discuss them with the patient first would likely be interference, even if the delay is short.
Importantly, information blocking rules do not prohibit laboratories from advising patients that results may not yet have been reviewed by their provider and directing questions about interpretation to the ordering clinician.
4. What about raw or preliminary data? Preliminary information may become EHI before the laboratory issues its final report if it is used to make health care decisions about an individual. ONC nevertheless recognizes that laboratory results pending confirmation may not be appropriate to disclose until they are finalized.
The same concept applies to underlying laboratory data. HHS stated, for example, that a patient requesting genomic information may be entitled to the full gene variant information generated by next-generation sequencing, not merely the final report.
5. What about research data? Research records maintained solely for research and not included in a designated record set may fall outside the information blocking rules. That answer changes when research results are placed in the patient’s medical record or are used to make decisions about the participant’s care.
Information blocking does not create a separate right of access to research records; it regulates interference with access, exchange or use that is otherwise permitted by law. HIPAA, for example, permits access to certain records created during a treatment study to be suspended if the participant agreed to the suspension when enrolling. Access must be restored when the study ends.
6. When can a laboratory hold a result? The federal information blocking rules recognize several circumstances in which withholding or delaying information is permissible. Those circumstances include compliance with privacy laws and steps needed to prevent harm.
For a patient seeking access to their own result, concern that the information may be upsetting is not enough. A decision to delay access based on risk of harm generally must be tied to that patient’s circumstances and relate to a risk to life or physical safety. The fact that a result may require careful discussion with the patient does not by itself justify delaying access. A blanket policy holding results concerning cancer, genetic conditions, pregnancy, sexually transmitted infections or other sensitive results for physician review would not satisfy the federal standard.
Other laws may require a different result. Federal and state privacy laws can impose conditions on disclosure, and some states require certain results to be delayed or communicated in a particular way. Compliance with those requirements does not constitute information blocking, although a laboratory should not extend a restriction beyond what the applicable law requires. New York, for example, permits a clinical laboratory to communicate results directly to a patient only if the results already were or are simultaneously communicated to the referring provider. The laboratory also must advise the patient that the provider received or is receiving the results and include a statement that the communication is not medical advice or a substitute for direct communication with the provider.
The Readout
Information blocking analysis turns on what information the laboratory maintains, when a result is complete and whether there is a lawful basis for the delay. Laboratories should understand how their systems handle EHI, when results become available for clinical use, and which federal or state rules permit a delay. For laboratories operating nationally, that may require more than one release protocol.
The Lab Protocol is for informational and educational purposes only and does not constitute legal, regulatory or compliance advice. Readers should consult qualified counsel regarding their specific circumstances.