HHS Rules Labs Must Give Patients Results
By Christine Kern, contributing writer
New ruling means patients can obtain results directly from labs
The Department of Health and Human Services has issued a final rule that gives patients the right to obtain their medical test results directly from labs. This final rule was issued jointly by the CMS, CDC, and OCR. As a consequence of this change, laboratories will also be forced to update their notices of privacy practices under HIPAA.
The new rule amends the Clinical Laboratory Improvement Amendments of 1988, allowing laboratories to release to a patient, or a person designated by the patient, copies of test reports upon request. Previously, most labs previously were exempt from the HIPAA requirement to provide patients with a copy of their medical information, but under the new rule, HHS says patients now have the option to obtain their test reports directly from the laboratory. As always, they may still obtain their results from their physicians as well.
The rule means that labs must also update their HIPAA notice of privacy practices to inform individuals of this new right and include a brief description of how to exercise the right.
According to an HHS press release, “The right to access personal health information is a cornerstone of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule,” said Secretary Kathleen Sibelius. “Information like lab results can empower patients to track their health progress, make decisions with their health care professionals, and adhere to important treatment plans.”
The final rule eliminates the exception under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to an individual’s right to access his or her protected health information when it is held by a CLIA-certified or CLIA-exempt laboratory.
Healthcare Info Security reported on the ruling and its impact. Alice Leiter, policy counsel for the consumer advocacy group the Center for Democracy and Technology, stated: "HIPAA requires covered entities to promptly revise NPPs whenever there is a material change to any of their privacy practices, including those pertaining to individuals' right to access their information."
She continued, "This constitutes a material change. As a result, by the compliance date of the new final rule - 240 days from publication in the Federal Register - HIPAA-covered labs must revise their notices to inform individuals of this right and provide a brief description of how to exercise it.”
"This rule is significant because it increases patients' access to their health information, allowing them to be as involved as they choose in their health and care by increasing their ability to obtain and organize electronic copies of their own data," Leiter says.
"Direct access to lab results can cut down on duplicate tests, may reduce the burden on providers to promptly route data to patients themselves, and has the potential to decrease dangerous medical errors caused by lost test results," she tells Information Security Media Group.
According to an HHS statement about the new rule, when obtaining test results directly from labs, "the patient or the personal representative may have to put their request in writing and pay for the cost of copying, mailing or electronic media on which the information is provided, such as a CD or flash drive."
However, Leiter added, "It's important to note that this rule does not alter any existing data flows between laboratories and providers. It merely adds another available flow of information - one directly from the lab to the patient, upon patient request."