On February 6, 2014, the Department of Health and Human Services (HHS) published a Final Rule expanding the rights of individuals to access test reports from clinical laboratories. The Final Rule resulted from a joint effort of several agencies within HHS, including the Centers for Medicare and Medicaid Services (CMS), the Centers for Disease Control (CDC), and the Office for Civil Rights (OCR). These agencies collaborated on amendments to (1) the Privacy Rule adopted under the Health Insurance Portability and Accountability Act (HIPAA) and (2) regulations implemented as part of the Clinical Laboratory Improvement Amendments of 1988 (CLIA).
The amendments adopted under the Final Rule were first proposed in 2011 as a result of efforts by the Health Information Technology (HIT) Policy Committee. The HIT Committee represents the views of stakeholders in the health care industry and advises the HHS Office of the National Coordinator for Health Information Technology (ONC). According to the HIT Committee, certain provisions in the HIPAA Privacy Rule and the CLIA regulations (1) denied individuals the right to access their health information, (2) prevented individuals from taking an active role in their health care, and (3) impeded the adoption of electronic health records. HHS agreed with the HIT Committee’s analysis of the HIPAA Privacy Rule and CLIA regulations. Therefore, the ONC worked with CMS, the CDC, and OCR to adopt amendments to these regulations.
CLIA regulations operate to require accuracy, reliability, and timeliness in the test results prepared by laboratories. These regulations govern all aspects of a clinical laboratory’s testing process, including the reporting of test results. Prior to the adoption of the Final Rule, laboratories subject to CLIA could disclose test reports to only three categories of individuals: “authorized persons”; persons using the test results for treatment purposes; and the laboratory that initially requested the test. “Authorized persons” are defined in the regulations as individuals who can order or receive test results under state law. Some states prohibit the release of laboratory test results to patients. In such states, patients could obtain test reports only from the patient’s health care provider prior to the Final Rule. Moreover, this restriction was not preempted by the access rights guaranteed under HIPAA.
Generally, the HIPAA Privacy Rule enables individuals to inspect and obtain a copy of their protected health information. HIPAA applies to “covered entities,” including health care clearinghouses, health plans, and health care providers that conduct certain transactions electronically (e.g., electronic submission of health care claims to insurers). Under the HIPAA Privacy Rule, a covered entity must permit individuals to obtain a copy of their health information maintained for or by the entity in a designated record set (e.g., information contained in medical and/ or billing records). Furthermore, HIPAA extends this access right to the patient’s personal representative, which is the person authorized to make health care decisions on behalf of the patient under state law. Prior to the Final Rule, the rights of patients and personal representatives to access health information did not extend to information maintained by laboratories subject to CLIA. Specifically, the HIPAA Privacy Rule exempted such laboratories from the access requirements because HHS did not want to create a conflict between the CLIA regulations and the HIPAA Privacy Rule.
Due to the amendments adopted in the Final Rule, the exceptions for CLIA laboratories will be stricken from the HIPAA Privacy Rule. As a result, a CLIA laboratory that qualifies as a covered entity must provide individuals the right to access their completed test reports and other information maintained in a designated record set. Furthermore, the requirements under HIPAA will preempt any conflicting state laws.
The Final Rule also amends the CLIA regulations. These amendments added a fourth category of individuals who may receive test reports: the patient and the patient’s personal representative. Specifically, upon request of a patient or a personal representative, a CLIA laboratory “may” provide access to “completed test reports” as long as the laboratory can confirm that the results belong to the identified patient.
In the preamble to the Final Rule, HHS addressed several concerns posed in over 160 comments. These concerns included issues about (1) the permissive language used in the CLIA regulations, (2) when a test result was part of a designated record set for purposes of HIPAA, (3) patient confusion and frustration with test reports prepared by laboratories, and (4) the release of information relating to anonymous tests. Other issues concerning the implementation of the amendments are also addressed by HHS in the preamble to the Final Rule. Therefore, the Final Rule serves as a good resource for clinical laboratories that must implement the new regulations.
Amendments to the CLIA regulations indicate that laboratories “may” release completed test reports to patients and personal representatives. As a result, only laboratories that qualify as covered entities under HIPAA are required to provide access to patients and personal representatives. If a CLIA laboratory is not subject to HIPAA, then the laboratory has the discretion to release test reports to patients and personal representatives. Furthermore, any state law prohibiting such disclosure will limit the ability of a CLIA laboratory to release the information if the laboratory is not subject to HIPAA.
Many commenters expressed concerns about when a test report becomes part of a designated record set and is subject to the disclosure requirements under HIPAA. In the Final Rule, HHS indicated that test reports are not part of a designated record set until the test results are complete. In other words, test reports must be finalized and ready for release in order to be part of a designated record set.
Commenters were concerned that patients will be confused and frustrated by test reports prepared by laboratories. HHS explained that the amendments adopted under the Final Rule do not obligate laboratories to explain or interpret test results for patients. Rather, the amendments simply provide patients direct access to the results. When patients have questions about the meaning of a test report, laboratories may refer the patient to his or her ordering or treating practitioner.
Clinical laboratories often prepare test reports concerning anonymous subjects. HHS explained that the Final Rule was not designed to inhibit such anonymous tests. Furthermore, HHS clarified that the access rights adopted under the Final Rule only apply when a laboratory can verify that the test results pertain to the patient requesting the test report.
CLIA laboratories subject to HIPAA must comply with the amendments to the HIPAA Privacy Rule by October 6, 2014. As a result, such laboratories must update their Notice of Privacy Practices (NPP) by this date. The NPP should accurately reflect the new access rights adopted under the Final Rule. Once a clinical laboratory updates its NPP, the laboratory must alert patients that the NPP has been revised and provide patients the opportunity to receive a copy of the NPP.
By amending the CLIA regulations and the HIPAA Privacy Rule, the Final Rule expands the rights of patients to directly access test reports prepared by clinical laboratories. In the preamble to the Final Rule, HHS addressed several issues concerning the implementation of the amendments. Therefore, the Final Rule may serve as a resource for CLIA laboratories as they begin providing access to test reports to patients and personal representatives. Finally, the Final Rule may guide covered entities that need to revise their NPPs to reflect the new access rights protected by HIPAA.