Quoting from the summary:
This proposed rule would amend the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations to specify that, upon a patient’s request, the laboratory may provide access to completed test reports that, using the laboratory’s authentication process, can be identified as belonging to that patient.The summary goes on for a couple more sentences, but when I read this I nearly cheered out loud at the HL7 Plenary session. The CLIA regulations and state laws have prevented many HIEs from providing patients with access to their lab results because of either real or perceived regulatory requirements under CLIA and HIPAA laws and regulations. In many cases, HIEs that have been the desire to share results so have implemented complex workflows to "work through" the requirements of these and local regulations.
Again quoting the NPRM:
Under the current regulations at § 493.1291(f), CLIA limits a laboratory’s disclosure of laboratory test results to three categories of individuals: the ‘‘authorized person,’’ the person responsible for using the test results in the treatment context, and, in the case of reference laboratories, the referring lab. Authorized person is defined in § 493.2 as the individual authorized under State law to order or receive test results, or both. In States that do not provide for individual access to the individual’s test results, the individual must receive his or her results through the ordering provider.Table 3 in the NPRM shows how this would impact labs (and patients) in the various regions of the country, and table 6 shows which state laws would be overridden (see *'d columns below) by this new regulation.
TABLE
3—IMPACT OF PROPOSED RULE CHANGE ON LABORATORIES
|
|||
Impacts
laboratories
|
Does not impact
laboratories
|
||
| No State law | Allows test reports only to provider* |
Allows test reports to patient |
Allows test reports
to patient with provider approval* |
| Alabama | Arkansas | Delaware | California |
| Alaska | Georgia | District of Columbia | Connecticut |
| Arizona | Hawaii | Maryland | Florida |
| Colorado | Illinois | New Hampshire | Massachusetts |
| Guam | Kansas | New Jersey | Michigan |
| Idaho | Maine | Nevada | New York |
| Indiana | Missouri | Oregon | Virginia |
| Iowa | Pennsylvania | Puerto Rico | |
| Kentucky | Rhode Island | West Virginia | |
| Louisiana | Tennessee | ||
| Minnesota | Washington | ||
| Mississippi | Wisconsin | ||
| Montana | Wyoming | ||
| Nebraska | |||
| New Mexico | |||
| North Carolina | |||
| North Dakota | |||
| N. Mariana Islands | |||
| Ohio | |||
| Oklahoma | |||
| South Carolina | |||
| South Dakota | |||
| Texas | |||
| Utah | |||
| Vermont | |||
| Virgin Islands | |||
While I can get mine (with provider approval), my mother cannot get hers at all direct from her lab. The new regulation would change that for both of us. I would no longer need my provider to approve, and she can get them where she couldn't previously.
What follows is the text of the rule with markup (underlines = insertions,
Title 42—Public Health
PART 493—LABORATORY REQUIREMENTS
1. The authority citation for part 493 continues to read as follows:
Authority: Section 353 of the Public Health Service Act, secs. 1102, 1861(e), the sentence following sections 1861(s)(11) through 1861(16) of the Social Security Act (42 U.S.C. 263a, 1302, 1395x(e), the sentence following 1395x(s)(11) through 1395x(s)(16)).
Subpart K—Quality System for Nonwaived Testing
2. Section 493.1291 is amended by—
A. Revising paragraph (f).
B. Adding a new paragraph (l).
The revision and addition read as follows:
§ 493.1291 Standard: Test report.
* * * * *
(f) Except as provided in paragraph (l) of this section, test results must be released only to authorized persons and, if applicable, the individuals (or their personal representative) responsible for using the test results and the laboratory that initially requested the test.
* * * * *
(l) Upon a patient’s request, the laboratory may provide access to completed test reports that, using the
laboratory’s authentication process, can be identified as belonging to that patient.
Title 45—Public Welfare
PART 164—SECURITY AND PRIVACY
3. The authority citation for part 164 continues to read as follows: Authority: 42 U.S.C. 1320d–1320d–8; sec. 264, Pub. Law 104–191, 110 Stat. 2033–2034 (42 U.S.C. 1320d–2 (note)); secs. 13400–
13402, Pub. Law 111–5, 123 Stat. 258–263.
4. Section 164.524 is amended by revising paragraphs (a)(1)(i) and (ii) and removing paragraph (a)(1)(iii) to read as follows:
§ 164.524 Access of individuals to protected health information.
(a) (1) * * *
(i) Psychotherapy notes; and
(ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative
action or proceeding.
* * * * *
For all the preamble and commentary, it's really a very small, but hugely impactful set of changes. There's been some notable reaction to this rule in the industry, and it was even discussed on today's HITsm chat. There seems to be two reactions:
- Patients should not have access to the information before their doctor does.
- Patients should have access to their data in the same form that the doctor does.
These are sometimes presented as being conflicting statements, but I can see where both can be met under the new rule. The provisions of the HIPAA access rules allow for up to 30 days for a provider to respond with the information. A lab can easily insert a small administrative delay to ensure that providers have had time to review results and contact patients without any problems under HIPAA. Some have suggested a 3-day delay. I believe that physicians also have a responsibility to provide patients with not just their interpretations of the results, but also the data that they have.
Like John, I see this as being a terrific change that will open up more access to patient data.
