Fact Sheets

HHS finalizes patients’ right to access report of clinical laboratory test results

HHS finalizes patients’ right to access report of clinical laboratory test results

Overview
As part of an ongoing effort across the Department of Health and Human Services (HHS) to empower patients to be informed partners with their health care providers in making health care decisions, HHS today finalized a rule that gives patients (and their personal representatives and designees) direct access to the patient’s completed test reports from laboratories, including those covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The final rule is being issued jointly by three agencies within HHS: the Centers for Medicare & Medicaid Services (CMS), which is generally responsible for regulatory laboratory oversight under the Clinical Laboratory Improvement Amendments of 1988 (CLIA); the Centers for Disease Control and Prevention (CDC), which provides scientific and technical advice to CMS related to CLIA; and the Office for Civil Rights (OCR), which is responsible for administering the HIPAA Privacy Rule.

Background  
The final rule addresses the interplay between the CLIA rules, state laws governing direct patient access to their laboratory test reports, and the HIPAA Privacy Rule. Prior to this final rule, under CLIA regulations, a laboratory could only release completed test reports directly to a patient only if: (1) the ordering provider expressly authorized the laboratory to do so at the time the test was ordered; or (2) state law expressly allowed for it. In addition, to avoid a conflict with the CLIA regulations, the HIPAA Privacy Rule included an exception to a patient’s general right of access to their health information for CLIA-certified or CLIA-exempt laboratories that were prohibited by law from providing such access. Thus, in the 26 states that lacked laws authorizing direct disclosure of test reports to patients, and in the 13 states that expressly prohibited such access, patients did not have direct access to their completed test reports through CLIA laboratories.

Provisions of the Final Rule
The final rule removes unintended barriers for patients to their own health information. It amends the CLIA regulations and the HIPAA Privacy Rule to remove these barriers to a patient’s direct access to his or her own completed test reports from laboratories. The CLIA regulations now allow CLIA-certified laboratories to provide the patient, his or her personal representatives, and/or a person designated by the patient, as applicable, with copies of completed test reports upon the patient’s or personal representative’s request. In addition, the above-described exception to an individual’s right of access in the HIPAA Privacy Rule is now removed, and contrary state laws that limit individuals’ access to completed test reports are preempted by the rule. The CLIA regulations do not change the role of providers in ordering tests and explaining test reports to patients. Under the HIPAA Privacy Rule, laboratories will be required to provide patients with their completed test reports within 30 days of a request, but they will not be required to explain the results to patients. Providers will likely receive test reports in advance of the patient’s receipt of the report, allowing the provider time to communicate and counsel the patient on the test report. While patients can continue to get access to their laboratory test reports from their physicians, they will have a right to get access to the reports directly from HIPAA-covered laboratories. HIPAA-covered laboratories will have 180 days from the effective date of the final rule to come into compliance. This policy maintains strong protections for patients’ privacy.

The final rule is available for review at: https://www.federalregister.gov/public-inspection. 

###