Understanding the New Rule for Patient Access to Lab Results
Privacy and data protection attorneys Linn Freedman and Kathryn Sylvia of the Nixon Peabody firm have written a brief explanation of provisions under a new federal rule to give patients or designated representatives the right to receive copies of medical test results from most clinical laboratories:
Privacy and data protection attorneys Linn Freedman and Kathryn Sylvia of the Nixon Peabody firm have written a brief explanation of provisions under a new federal rule to give patients or designated representatives the right to receive copies of medical test results from most clinical laboratories:
Recently, the Final Rule to amend the Clinical Laboratory Improvement Amendments of 1988 and Health Insurance Portability and Accountability Act regulations, which will now allow patients and their personal representatives access to lab test reports and results from laboratories, was published in the Federal Register. This Amendment stems from collaboration between U.S. Department of Health and Human Services, the Centers for Medicare and Medicaid Services, the Centers for Disease Control and Prevention and the Office for Civil Rights. HHS Secretary Kathleen Sebelius said, The right to access personal health information is a cornerstone of the HIPAA Privacy Rule. Information like lab results can empower patients to track their health progress, make decisions with their health care professionals, and adhere to important treatment plans.
This amendment will permit upon the request of a patient (or the patients personal representative), laboratories subject to CLIA [to] provide the patient, the patients personal representative, or a person designated by the patient, as applicable, with copies of completed test reports that, using the laboratorys authentication process, can be identified as belonging to that patient. The amendment will require laboratories to implement policies and procedures related to patient requests.
HIPAA Amendment
Individuals may now access lab reports directly from laboratories under the HIPAA Privacy Rule (45 C.F.R. § 164.524(a)(1)(iii)(A) and (B)). Previously, subject to CLIA, labs were not permitted to provide patients direct access to their lab tests. Now, HIPAA covered entities that are laboratories subject to CLIA, as well as those that are exempt from CLIA, would have the same obligations as other types of covered health care providers with respect to providing individuals (or their personal representatives) with access to their protected health information in accordance with § 164.524.
However, CLIA and CLIA-exempt laboratories that are also HIPAA covered entities must still satisfy the patient identification verification requirement under § 164.514(h) before they provide access as requested by an individual. HHS points out in its responses to public comments that some laboratories may experience difficulty verifying the identity of the requesting individual as often laboratories receive test orders with only anonymous identifiers. HHS explains that, therefore, this Final Rule does not amend the verification requirement, and a laboratory that receives a request for individual access to a lab report where the laboratory cannot authenticate and verify that the requesting individual is the subject of a lab test report, would not be obligated to provide access to such information.
Notably, the Final Rule specifically preempts multiple state laws that prohibit a laboratory from releasing test results directly to a requesting individual or restrict release of such information without the ordering health care providers consent because these state laws conflict with the HIPAA Privacy Rule, which mandates that an individual patient may have direct access to the tests.
Operational implications for HIPAA-regulated entities
Laboratories that are HIPAA-covered entities and laboratories regulated by CLIA policies will need to revise policies, procedures and forms related to patient requests for laboratory test results. This will include revision to the Notice of Privacy Practices to first, inform patients of this new right, and second, remove any statements that contradict this new patient right of access, policies and process to allow patients the ability to request direct access to lab tests, authentication procedures, appropriate consent forms and documentation of such access. Further, health care providers and workforce members will need to be trained on how to handle such patient requests and authentication processes.
HHS stated in its press release on February 3, 2014, that the Final Rule does not supplant the role of the treating provider in discussing test results with a patient or an individuals right under the HIPAA Privacy Rule to access protected health information about the individual maintained by the provider, including laboratory test results. The rule merely provides an additional avenue for individuals to obtain copies of their test reports by allowing individuals to obtain them directly from the laboratories. With this amendment, HHS seeks to expand the scope of patient rights and in turn increase the quality and efficiency of health care.
The Final Rule is effective April 5, 2014, and covered entities must comply by October 2, 2014. To read the Final Rule as published in the Federal Register, click here.
Recently, the Final Rule to amend the Clinical Laboratory Improvement Amendments of 1988 and Health Insurance Portability and Accountability Act regulations, which will now allow patients and their personal representatives access to lab test reports and results from laboratories, was published in the Federal Register. This Amendment stems from collaboration between U.S. Department of Health and Human Services, the Centers for Medicare and Medicaid Services, the Centers for Disease Control and Prevention and the Office for Civil Rights. HHS Secretary Kathleen Sebelius said, The right to access personal health information is a cornerstone of the HIPAA Privacy Rule. Information like lab results can empower patients to track their health progress, make decisions with their health care professionals, and adhere to important treatment plans.
This amendment will permit upon the request of a patient (or the patients personal representative), laboratories subject to CLIA [to] provide the patient, the patients personal representative, or a person designated by the patient, as applicable, with copies of completed test reports that, using the laboratorys authentication process, can be identified as belonging to that patient. The amendment will require laboratories to implement policies and procedures related to patient requests.
HIPAA Amendment
Individuals may now access lab reports directly from laboratories under the HIPAA Privacy Rule (45 C.F.R. § 164.524(a)(1)(iii)(A) and (B)). Previously, subject to CLIA, labs were not permitted to provide patients direct access to their lab tests. Now, HIPAA covered entities that are laboratories subject to CLIA, as well as those that are exempt from CLIA, would have the same obligations as other types of covered health care providers with respect to providing individuals (or their personal representatives) with access to their protected health information in accordance with § 164.524.
However, CLIA and CLIA-exempt laboratories that are also HIPAA covered entities must still satisfy the patient identification verification requirement under § 164.514(h) before they provide access as requested by an individual. HHS points out in its responses to public comments that some laboratories may experience difficulty verifying the identity of the requesting individual as often laboratories receive test orders with only anonymous identifiers. HHS explains that, therefore, this Final Rule does not amend the verification requirement, and a laboratory that receives a request for individual access to a lab report where the laboratory cannot authenticate and verify that the requesting individual is the subject of a lab test report, would not be obligated to provide access to such information.
Notably, the Final Rule specifically preempts multiple state laws that prohibit a laboratory from releasing test results directly to a requesting individual or restrict release of such information without the ordering health care providers consent because these state laws conflict with the HIPAA Privacy Rule, which mandates that an individual patient may have direct access to the tests.
Operational implications for HIPAA-regulated entities
Laboratories that are HIPAA-covered entities and laboratories regulated by CLIA policies will need to revise policies, procedures and forms related to patient requests for laboratory test results. This will include revision to the Notice of Privacy Practices to first, inform patients of this new right, and second, remove any statements that contradict this new patient right of access, policies and process to allow patients the ability to request direct access to lab tests, authentication procedures, appropriate consent forms and documentation of such access. Further, health care providers and workforce members will need to be trained on how to handle such patient requests and authentication processes.
HHS stated in its press release on February 3, 2014, that the Final Rule does not supplant the role of the treating provider in discussing test results with a patient or an individuals right under the HIPAA Privacy Rule to access protected health information about the individual maintained by the provider, including laboratory test results. The rule merely provides an additional avenue for individuals to obtain copies of their test reports by allowing individuals to obtain them directly from the laboratories. With this amendment, HHS seeks to expand the scope of patient rights and in turn increase the quality and efficiency of health care.
The Final Rule is effective April 5, 2014, and covered entities must comply by October 2, 2014. To read the Final Rule as published in the Federal Register, click here.
More for you
Loading data for hdm_tax_topic #better-outcomes...