On September 12, 2011, the United States Department of Health & Human Services (HHS) announced proposed rules, available here,1 that will enable direct access to laboratory test results by patients. The proposed rules seek to amend both the Clinical Laboratory Improvement Amendments (CLIA) regulations and the Health Insurance Portability and Accountability Act (HIPAA) privacy regulations to strengthen patients’ rights to access their own laboratory test result reports. Regarding the proposed rules, HHS Secretary Kathleen Sebelius stated, “When patients have their lab results, they are more likely to ask the right questions, make better decisions and receive better care.”  

Currently, CLIA restricts a lab’s disclosure of lab test results to one of three categories of individuals:

  1. the “authorized person;”
  2. the person responsible for using the test results in the treatment context; and
  3. in the case of reference labs, the referring lab.

CLIA defines an “authorized person” as the individual authorized under state law to order or receive test results, or both. Therefore, in states that do not provide for individual access to the individual’s test results, the individual must receive his or her results through the ordering provider.  

The proposed changes to CLIA regulations would allow laboratories to provide direct patient access to completed test reports, albeit after verifying the patient’s identity through an authentication process. The other categories of individuals currently eligible to receive test reports from laboratories will remain eligible, including the individuals responsible for using the test reports and reference laboratories.  

The proposed rules also make necessary changes to HIPAA. Generally, HIPAA requires covered entities to give patients access to their records; however, there exists an exception for entities subject to CLIA where disclosure is barred. Because the proposed rules will amend the CLIA regulations to allow laboratories to provide patients with direct access to their test reports, there is no longer a need for this HIPAA exception. Accordingly, if finalized, the proposed HIPAA amendments will remove this exception and covered entity laboratories will be required to provide patients with access to test reports.  

Furthermore, due to the Health Information Technology for Economic and Clinical Health (HITECH) Act’s amendments to HIPAA, labs would be required to provide the patient with access to their lab results in an electronic format if requested by the patient.  

The deadline for public comment is October 14, 2011.