Final Rule Allowing Patient Access to CLIA Test Reports

On February 6, 2014, the Centers for Medicare and Medicaid Services (“CMS”) published a Final Rule to amend the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule to allow patients to access test reports directly from laboratories. The Final Rule also made a corresponding amendment to the Clinical Laboratory Improvement Amendments of 1988 (“CLIA”) regulations authorizing laboratories to provide patients with such information.

A laboratory is considered a covered entity and therefore subject to HIPAA if the laboratory conducts one or more covered transactions electronically.  This may include transmitting health care claims or equivalent encounter information to a health plan, requesting prior authorization from a health plan, or sending an eligibility inquiry to a health plan.   The HIPAA Privacy Rule allows patients certain rights to access, inspect and copy their protected health information (“PHI”) maintained by a covered entity.  However, until this amendment, CLIA-certified laboratories and CLIA-exempt laboratories were excepted from the provision that required covered entities to provide patients with requested PHI.  Specifically, the patient’s right of access under 45 CFR §164.524 did not apply to: PHI maintained by a covered entity that was: (1) subject to CLIA to the extent the provision of access to the individual would be prohibit by law; or (2) exempt from CLIA.   These exemptions included test reports and other PHI only at CLIA and CLIA-exempt laboratories.  If another type of covered entity (such as a hospital or physician) held these test reports or other PHI, the individual could then request access from this other covered entity. 

Because the Final Rule amended the CLIA regulations to allow laboratories to provide patients with test reports, CMS also revised the HIPAA Privacy Rule in order to avoid a conflict with the CLIA requirements.  Therefore, the Final Rule removed the exceptions for CLIA and CLIA-exempt laboratories from the right of access regulation, allowing individuals to access test reports and other PHI directly from HIPAA-covered laboratories.   The Final Rule requires that laboratories subject to HIPAA must be compliant by October 6, 2014.

Because the regulation gives individuals a greater ability to access their health information and records, it seeks to empower individuals to take a more active role in managing their health and health care.  For more questions regarding HIPAA and patient’s access to health information please contact Meghan McNab at mmcnab@kdlegal.com or Susan Ziel at sziel@kdlegal.com.