On February 6, 2014, three agencies within the Department of Health & Human Services (HHS) — the Centers for Medicare & Medicaid Services, the Centers for Disease Control & Prevention, and the Office for Civil Rights — finalized rules to allow patients to directly access test results from laboratories. See 79 Fed. Reg. 7290 (Feb. 6, 2014).
Under current regulations implementing the Clinical Laboratory Improvement Amendments of 1988 (CLIA), a laboratory can only disclose test results to three types of individuals or entities: the laboratory that requested the test; a person responsible for using the test results in a treatment context; and an “authorized person,” i.e., a person who is authorized to receive or order tests under state law. 42 C.F.R. § 493.1291(f). This means that patients cannot access their own test results directly through the laboratory in states that do not have laws authorizing them to do so (though they can generally access those results through their health care provider). 79 Fed. Reg. at 7290. And in fact a number of states do not allow patients to access test results independent of the health care provider who ordered the tests. See id. at 7294.
The final rule amends CLIA regulations to allow laboratories to provide patients, or individuals designated by patients, with completed test reports upon request. § 493.1291(f), (l). In addition, HHS amends Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations to eliminate the laboratory exception to the requirement that HIPAA-covered entities provide patients with the ability to inspect and obtain their protected health information. 45 C.F.R. § 164.524.
Together, these regulatory changes require HIPAA-covered laboratories to provide patients, or individuals designated by patients, with requested test results, regardless of state laws. Laboratories are not, however, required to provide patients with an interpretation of the test results; they are only required to provide “completed test reports and other individually identifiable health information.” 79 Fed. Reg. at 7293. Under the HIPAA privacy rule, laboratories generally must provide these results within 30 days of the request. § 164.524(b)(2); 79 Fed. Reg. at 7293.
The final rule preempts state laws that prohibit patients from accessing lab results directly. See 79 Fed. Reg. at 7294. Accordingly, although these regulatory changes impose a new requirement on some laboratories, they will relieve laboratories operating in different States from the burden of complying with different rules regarding patient access.
The effective date of these new rules is April 7, 2014, but HHS will allow laboratories until October 4, 2014 to come into compliance with the changes to the HIPAA rules, i.e., to be able to provide patients with access to their lab test results within 30 days of a request. Id. at 7290, 7292.