On February 6, the U.S. Department of Health and Human Services (HHS) published a final rule amending the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations to permit CLIA-certified laboratories to provide copies of completed test reports to patients (or their representatives) upon request. This change was effectuated by including a provision in the CLIA regulations authorizing the release of test results directly to patients,1 and by removing the HIPAA exceptions to an individual’s right of access to information maintained by CLIA-exempt laboratories.2


The final rule represents a significant departure from past policy, as HHS has generally deferred to state law on whether laboratories can release test results directly to patients, rather than through their treating providers. The CLIA regulations provide that state law determines the parties who may receive test results directly from laboratories;3 and a majority of states generally prohibit the release of such results directly to patients.4 The aim of this prohibition is to ensure that patients receive appropriate clinical interpretation of their results.

In the preamble to the final rule, HHS said a number of stakeholders asserted that releasing test results to individuals “without the benefit of provider interpretation and without contextual knowledge that may be necessary to properly read and understand results” could cause concerns among test result recipients.5 On the other side of the spectrum, certain laboratories and consumer advocates said that increasing access to test results will result in a better-informed, engaged patient population.6

In part, the decision to expand direct access to test results is tied to the move toward greater adoption of health information technology in the healthcare marketplace. The Health Information Technology (HIT) policy committee, created under the Health Information Technology for Economic and Clinical Health (HITECH) Act, said that “some stakeholders perceive the CLIA regulations as imposing barriers to the exchange of health information,” and that the final rule is part of a larger move toward “revisiting barriers or challenges to individuals’ gaining access to their health information.”7

HHS also rejected commenters’ requests to restrict direct access to “sensitive” tests results (e.g., HIV/AIDS, genetic tests, and tests involving pregnancy or cancer), stating that patients generally have a “broad right of access” to health information under the HIPAA Privacy Rule.8 Further, the preamble to the final rule provided that categorizing testing into “sensitive” and “non-sensitive” categories would be subjective, and would not necessarily result in polices in patients’ best interests.9

Obligations of HIPAA-Covered Laboratories Under the Final Rule

As with other protected health information (PHI) maintained by HIPAA-covered entities, test results maintained by HIPAA-covered laboratories must be provided to patients within 30 days of a request to review such information (unless an exception applies).10 Further, as a result of the final rule, the notices of privacy practices (NPPs) for affected CLIA-certified laboratories who are also HIPAA-covered entities must be revised to reflect the “material change” relating to the release of test results.11

Therefore, by the compliance date of the final rule (October 6, 2014), affected laboratories must revise their NPPs to (i) inform individuals of their right to request test results directly; (ii) include a brief description of how to exercise this right; and (iii) remove any existing contradictory statements.12 Further, HIPAA-covered laboratories must make their revised NPPs available as required by the HIPAA Privacy Rule.13 HHS noted, however, that ordering providers are not required to revise their NPPs to inform individuals of their rights to request results directly from laboratories.14

Clarifications and Effective Date

HHS clarified that laboratories releasing test results pursuant to the new rules are not required to interpret such results.15 Patients merely have the right to “inspect and receive” copies of their test results from laboratories. The copies may refer patients with questions about how to interpret the results back to their physicians.16

The final rule will become effective on April 7, 2014, and affected entities must comply with the applicable requirements by October 6, 2014. HHS stated that the final rule will impact laboratories in 39 states and territories, where state law does not currently permit laboratories to provide test reports directly to individuals.17