The Department of Health and Human Services (HHS) has published a proposed rule that would modify both the HIPAA Privacy Rule and the Clinical Laboratory Improvement Amendments of 1988 (CLIA) to allow laboratories to send test results directly to patients. The current regulations permit a lab to disclose test results to only three categories of individuals:
- An “authorized person;”
- The person responsible for using the test results to formulate a treatment (i.e., a physician); and
- The lab that referred the case.
CLIA defines an “authorized person” to be “the individual authorized under state law to order or receive test results, or both.”
But state laws regarding whether a patient is an “authorized person” to receive test results vary widely, and many states, including Ohio, Kentucky, and Indiana, have no statutes on the subject. In states that are silent on the subject, labs have often received conflicting guidance as to whether they can send results to patients. Other states have laws that either expressly allow or prohibit labs to send test results directly to patients. In states that prohibit labs from sending test results to patients, patients can only get their results from the ordering provider. If enacted, the proposed regulations will preempt all state laws and will expressly permit labs to send results directly to patients.
If a lab is “covered entity” under HIPAA, the HIPAA Privacy Rule will require it to provide test results to patients within the general time restrictions for providing patients with a copy of their health records. Almost all laboratories are “covered entities” because a lab is covered if it conducts any electronic transactions such as electronic submission of healthcare claims. Under the HIPAA Privacy Rule, the lab may charge a reasonable, cost-based fee to patients who request a copy of their test results. Additionally, due to the HITECH Act’s amendments to HIPAA, patients will be able to request their lab results in paper or electronic format.
The proposed regulations are part of the ongoing efforts of HHS to increase direct patient access rights and to encourage the widespread adoption of electronic health records by 2014. HHS estimates that the proposed regulations will affect 22,671 labs nationwide if finalized, including 1,112 in Ohio, 697 in Kentucky, and 640 in Indiana. If HHS decides to finalize the proposed rule, labs will have to comply with the new regulations within 240 days after HHS publishes the final rule.
David Dirr is a Northern Kentucky attorney practicing at Dressman BenzingerLaVelle psc.