Comments on CLIA/HIPAA Harmonization (Patient Access to Labs) NPRM

Monday a week ago, HHS announced the publication of a new proposed rule titled: CLIA Program and HIPAA Privacy Rule; Patients’ Access to Test Reports.  John Halamka wrote about it this Monday, and you can find a copy of the Federal Register publication.  Because of the HL7 Working group meeting, I'm a bit behind on writing my review of this rule, so here it is:

Quoting from the summary:

This proposed rule would amend the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations to specify that, upon a patient’s request, the laboratory may provide access to completed test reports that, using the laboratory’s authentication process, can be identified as belonging to that patient.

The summary goes on for a couple more sentences, but when I read this I nearly cheered out loud at the HL7 Plenary session.  The CLIA regulations and state laws have prevented many HIEs from providing patients with access to their lab results because of either real or perceived regulatory requirements under CLIA and HIPAA laws and regulations. In many cases, HIEs that have been the desire to share results so have implemented complex workflows to "work through" the requirements of these and local regulations.

Again quoting the NPRM:

Under the current regulations at § 493.1291(f), CLIA limits a laboratory’s disclosure of laboratory test results to three categories of individuals: the ‘‘authorized person,’’ the person responsible for using the test results in the treatment context, and, in the case of reference laboratories, the referring lab. Authorized person is defined in § 493.2 as the individual authorized under State law to order or receive test results, or both. In States that do not provide for individual access to the individual’s test results, the individual must receive his or her results through the ordering provider.  

Table 3 in the NPRM shows how this would impact labs (and patients) in the various regions of the country, and table 6 shows which state laws would be overridden (see *'d columns below) by this new regulation.

TABLE 3—IMPACT OF PROPOSED RULE CHANGE ON LABORATORIES
Impacts laboratories		Does not impact laboratories
No State law	Allows test reports  only to provider*	Allows test reports  to patient	Allows test reports to patient with provider approval*
Alabama	Arkansas	Delaware	California
Alaska	Georgia	District of Columbia	Connecticut
Arizona	Hawaii	Maryland	Florida
Colorado	Illinois	New Hampshire	Massachusetts
Guam	Kansas	New Jersey	Michigan
Idaho	Maine	Nevada	New York
Indiana	Missouri	Oregon	Virginia
Iowa	Pennsylvania	Puerto Rico
Kentucky	Rhode Island	West Virginia
Louisiana	Tennessee
Minnesota	Washington
Mississippi	Wisconsin
Montana	Wyoming
Nebraska
New Mexico
North Carolina
North Dakota
N. Mariana Islands
Ohio
Oklahoma
South Carolina
South Dakota
Texas
Utah
Vermont
Virgin Islands

While I can get mine (with provider approval), my mother cannot get hers at all direct from her lab.  The new regulation would change that for both of us.  I would no longer need my provider to approve, and she can get them where she couldn't previously.

What follows is the text of the rule with markup (underlines = insertions, strikethrough = deletions):

---

Title 42—Public Health 
PART 493—LABORATORY REQUIREMENTS
1. The authority citation for part 493 continues to read as follows:
Authority: Section 353 of the Public Health Service Act, secs. 1102, 1861(e), the sentence following sections 1861(s)(11) through 1861(16) of the Social Security Act (42 U.S.C. 263a, 1302, 1395x(e), the sentence following 1395x(s)(11) through 1395x(s)(16)).
Subpart K—Quality System for Nonwaived Testing
2. Section 493.1291 is amended by—
A. Revising paragraph (f).
B. Adding a new paragraph (l).
The revision and addition read as follows:
§ 493.1291 Standard: Test report.
* * * * *
(f) Except as provided in paragraph (l) of this section, test results must be released only to authorized persons and, if applicable, the individuals (or their personal representative) responsible for using the test results and the laboratory that initially requested the test.
* * * * *
(l) Upon a patient’s request, the laboratory may provide access to completed test reports that, using the
laboratory’s authentication process, can be identified as belonging to that patient.

Title 45—Public Welfare
PART 164—SECURITY AND PRIVACY
3. The authority citation for part 164 continues to read as follows: Authority: 42 U.S.C. 1320d–1320d–8; sec. 264, Pub. Law 104–191, 110 Stat. 2033–2034 (42 U.S.C. 1320d–2 (note)); secs. 13400–
13402, Pub. Law 111–5, 123 Stat. 258–263.
4. Section 164.524 is amended by revising paragraphs (a)(1)(i) and (ii) and removing paragraph (a)(1)(iii) to read as follows:
§ 164.524 Access of individuals to protected health information.
(a) (1) * * *
(i) Psychotherapy notes; and
(ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative
action or proceeding. and;
(iii) Protected health information maintained by a covered entity that is:
(A) Subject to the Clinical Laboratory Improvements Amendments of 1988, 42 U.S.C. 263a, to the extent the provision of access to the individual would be prohibited by law; or
(B) Exempt from the Clinical Laboratory Improvements Amendments of 1988, pursuant to 42 CFR 493.3(a)(2).
* * * * *

---

For all the preamble and commentary, it's really a very small, but hugely impactful set of changes.  There's been some notable reaction to this rule in the industry, and it was even discussed on today's HITsm chat.  There seems to be two reactions:

1. Patients should not have access to the information before their doctor does.
2. Patients should have access to their data in the same form that the doctor does.

These are sometimes presented as being conflicting statements, but I can see where both can be met under the new rule.  The provisions of the HIPAA access rules allow for up to 30 days for a provider to respond with the information.  A lab can easily insert a small administrative delay to ensure that providers have had time to review results and contact patients without any problems under HIPAA.  Some have suggested a 3-day delay.  I believe that physicians also have a responsibility to provide patients with not just their interpretations of the results, but also the data that they have.

Like John, I see this as being a terrific change that will open up more access to patient data.