How do HIPAA and CLIA rule changes allow patients to directly access their lab reports?


(The following information was developed by the Healthcare Law Group and the Academy's Practice Management team, and reviewed and approved by Drs. Murad Alam and Jane Grant-Kels, co-chairs of the AAD Dermatopathology Rapid Response Committee.)

Q: Are patients calling the dermatologist’s office for lab results a thing of the past?

A: The Clinical Laboratory Improvement Amendments of 1988 (CLIA) and the Health Insurance Portability and Accountability Act (HIPAA) have been modified by regulations that allow laboratories to give patients access to copies of their completed test reports directly from the laboratory. Thus, patients and their personal representatives will be able to continue to receive their lab tests from their dermatologists but may also request the results from the lab itself. This rule change effectively removes legal barriers that stop labs from providing lab test results directly to patients and their representatives. This new rule preempts or “overrules” more than a dozen state laws that previously allowed lab test reports to be provided only to the ordering dermatologist. (These states include: Arkansas, Georgia, Hawaii, Illinois, Kansas, Maine, Missouri, Pennsylvania, Rhode Island, Tennessee, Washington, Wisconsin, and Wyoming.)

According to observers, this new requirement reflects ongoing changes in health care, especially as patients assume more involvement in their own care, take on more financial responsibility, and expect more access and transparency. 

Q: Will in-office labs be affected?

A: No. Because of Stark rules, an in-office dermatology lab must operate as part of the sponsoring dermatology practice that owns it.  Thus, such labs are not regarded as separate “covered entity” laboratories under HIPAA and will not be subject to the new rule. 

Q: Does the new rule require labs to offer patients an interpretation of the results?

A: No. Patients merely have the right to request, inspect, and receive a copy of their completed test reports. The labs will continue to refer patients with questions to their treating or ordering provider for an interpretation of the lab results. 

Q: Will the new regulations change the way dermatologists provide lab results to the patient?

A: No. The new rule does not alter the role of the ordering or treating provider in reporting and explaining test results to patients. Dermatologists may want to proactively counsel patients on the potential outcomes and consequences when the test is ordered or performed. However, this is not strictly required. Also, the dermatologist is not required to tell the patient that he or she can get the lab results directly from the lab. 

Note that the new rule is designed to allow the ordering dermatologist to receive the results before the patient. Generally, the lab has thirty (30) days to deliver the results to the patient. This generous time allowance is intended to provide sufficient time for the treating provider to receive the test report before the patient does. In most cases, the dermatologist will still receive the results first and deliver the results to the patient. 

Q: Are there protections for sensitive tests, such as cancer, HIV, or genetics tests?

A:  Yes. Existing anonymous testing protocols, such as for cancer, HIV, or genetics, will not change, and labs will not be required to provide the results of anonymous tests to requesting individuals. If the lab receives a test order with an anonymous identifier, and cannot identify the individual, there is no obligation for the lab to provide access to the individual or their personal representative. 

Q: Can dermatologists limit the patient’s access to his or her lab reports?

A: No. Generally, dermatologists cannot limit the patient’s access to his or her lab reports. There is a very limited exception under the existing HIPAA Privacy Rule that allows a licensed health care professional to withhold access if he or she believes that it is reasonably likely to endanger the life or physical safety of the patient or another person. 

Q: What if state law currently does not permit labs to provide patients with direct access to their test reports?

A:  The new final rules are intended to preempt state laws that prohibit patients from accessing their test results directly. This new federal rule will override any conflicting state law.

Q:  How does the patient make the request, and how does the lab authenticate the identity of the person making the request?

A:  The new rule provides a flexible approach for labs to receive, process, and respond to access requests, so long as the processes comply with the HIPAA Privacy Rule. The new rule does not specify how labs should authenticate the identity of the person making the request. Rather, the new rule quotes the HIPAA Privacy Rule and requires the lab to take “reasonable steps” to verify the identity of the individual.

Q: When will labs begin providing patients with their lab results directly?

A: The new rule takes effect sixty (60) days after publication on Feb. 6, 2014.  Labs will then have an additional 180 days to comply. Labs must begin providing patients with their results by Oct. 6, 2014.