Friday, September 23, 2011

Comments on CLIA/HIPAA Harmonization (Patient Access to Labs) NPRM

Monday a week ago, HHS announced the publication of a new proposed rule titled: CLIA Program and HIPAA Privacy Rule; Patients’ Access to Test Reports.  John Halamka wrote about it this Monday, and you can find a copy of the Federal Register publication.  Because of the HL7 Working group meeting, I'm a bit behind on writing my review of this rule, so here it is:

Quoting from the summary:
This proposed rule would amend the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations to specify that, upon a patient’s request, the laboratory may provide access to completed test reports that, using the laboratory’s authentication process, can be identified as belonging to that patient.
The summary goes on for a couple more sentences, but when I read this I nearly cheered out loud at the HL7 Plenary session.  The CLIA regulations and state laws have prevented many HIEs from providing patients with access to their lab results because of either real or perceived regulatory requirements under CLIA and HIPAA laws and regulations. In many cases, HIEs that have been the desire to share results so have implemented complex workflows to "work through" the requirements of these and local regulations.

Again quoting the NPRM:
Under the current regulations at § 493.1291(f), CLIA limits a laboratory’s disclosure of laboratory test results to three categories of individuals: the ‘‘authorized person,’’ the person responsible for using the test results in the treatment context, and, in the case of reference laboratories, the referring lab. Authorized person is defined in § 493.2 as the individual authorized under State law to order or receive test results, or both. In States that do not provide for individual access to the individual’s test results, the individual must receive his or her results through the ordering provider.  
Table 3 in the NPRM shows how this would impact labs (and patients) in the various regions of the country, and table 6 shows which state laws would be overridden (see *'d columns below) by this new regulation.

Impacts laboratories 
Does not impact laboratories 
No State law   Allows test reports
 only to provider* 
 Allows test reports
 to patient 
Allows test reports to patient
with provider approval* 
Alabama  Arkansas  Delaware  California 
Alaska  Georgia  District of Columbia  Connecticut 
Arizona  Hawaii  Maryland  Florida 
Colorado  Illinois  New Hampshire  Massachusetts 
Guam  Kansas  New Jersey  Michigan 
Idaho  Maine  Nevada  New York 
Indiana  Missouri  Oregon  Virginia 
Iowa  Pennsylvania  Puerto Rico 
Kentucky  Rhode Island  West Virginia 
Louisiana  Tennessee 
Minnesota  Washington 
Mississippi  Wisconsin 
Montana  Wyoming 
New Mexico 
North Carolina 
North Dakota 
N. Mariana Islands 
South Carolina 
South Dakota 
Virgin Islands 

While I can get mine (with provider approval), my mother cannot get hers at all direct from her lab.  The new regulation would change that for both of us.  I would no longer need my provider to approve, and she can get them where she couldn't previously.

What follows is the text of the rule with markup (underlines = insertions, strikethrough = deletions):

Title 42—Public Health 
1. The authority citation for part 493 continues to read as follows:
Authority: Section 353 of the Public Health Service Act, secs. 1102, 1861(e), the sentence following sections 1861(s)(11) through 1861(16) of the Social Security Act (42 U.S.C. 263a, 1302, 1395x(e), the sentence following 1395x(s)(11) through 1395x(s)(16)).
Subpart K—Quality System for Nonwaived Testing
2. Section 493.1291 is amended by—
A. Revising paragraph (f).
B. Adding a new paragraph (l).
The revision and addition read as follows:
§ 493.1291 Standard: Test report.
* * * * *
(f) Except as provided in paragraph (l) of this section, test results must be released only to authorized persons and, if applicable, the individuals (or their personal representative) responsible for using the test results and the laboratory that initially requested the test.
* * * * *
(l) Upon a patient’s request, the laboratory may provide access to completed test reports that, using the
laboratory’s authentication process, can be identified as belonging to that patient.

Title 45—Public Welfare
3. The authority citation for part 164 continues to read as follows: Authority: 42 U.S.C. 1320d–1320d–8; sec. 264, Pub. Law 104–191, 110 Stat. 2033–2034 (42 U.S.C. 1320d–2 (note)); secs. 13400–
13402, Pub. Law 111–5, 123 Stat. 258–263.
4. Section 164.524 is amended by revising paragraphs (a)(1)(i) and (ii) and removing paragraph (a)(1)(iii) to read as follows:
§ 164.524 Access of individuals to protected health information.
(a) (1) * * *
(i) Psychotherapy notes; and
(ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative
action or proceeding. and;
(iii) Protected health information maintained by a covered entity that is:
(A) Subject to the Clinical Laboratory Improvements Amendments of 1988, 42 U.S.C. 263a, to the extent the provision of access to the individual would be prohibited by law; or
(B) Exempt from the Clinical Laboratory Improvements Amendments of 1988, pursuant to 42 CFR 493.3(a)(2).
* * * * *

For all the preamble and commentary, it's really a very small, but hugely impactful set of changes.  There's been some notable reaction to this rule in the industry, and it was even discussed on today's HITsm chat.  There seems to be two reactions:
  1. Patients should not have access to the information before their doctor does.
  2. Patients should have access to their data in the same form that the doctor does.
These are sometimes presented as being conflicting statements, but I can see where both can be met under the new rule.  The provisions of the HIPAA access rules allow for up to 30 days for a provider to respond with the information.  A lab can easily insert a small administrative delay to ensure that providers have had time to review results and contact patients without any problems under HIPAA.  Some have suggested a 3-day delay.  I believe that physicians also have a responsibility to provide patients with not just their interpretations of the results, but also the data that they have.

Like John, I see this as being a terrific change that will open up more access to patient data.


  1. At group health which has had an EHR for over 5 years (in Washington state where oddly your review seems to imply that a patient can't get their results) we allowed all 600,000 members (if their primary care doc is at a group health clinic) to see their normal lab results as soon as they are available.

    We quickly discovered that they could figure out that some were abnormal if they weren't disclosed so other then path we released them when their provider had reviewed them or in worse case within 24 hours. (other then path)

    As of this summer GHC is also now releasing radiology results (clinical impression) as well and there is a new mobile app to you can get the lab results on your phone. Checking labs online is also one of the most popular functions for patients at Kaiser as well.

    It saves staff time, paper (green), empowers patients and is good overall..

    @cascadia - sherry reynolds

  2. Exceptionally thorough and well done. Much appreciated! @pfanderson