HIPAA Regulatory Alert

Will your patients have more access to laboratory results? It's proposed

New rule will enable patients to bypass physicians

As hospital compliance officers prepare for a proposed increase in patient access to medical records' information, another proposed rule increases access to laboratory results. Comments on the laboratory proposed rule must be received by Nov. 14. (For more information, see "Proposed rule allows patients to see record access details," HIPAA Regulatory Alert, August 2011, p. 1)

The latest proposed rule related to medical records allows patients to access test result reports directly from labs as opposed to receiving the information from their physicians. Under existing Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations, a laboratory may release patient test results directly to the patient only if the ordering provider authorizes the laboratory to do so at the time the test is ordered, or state law allows for it. Although the HIPAA Privacy Rule allows patients access to their medical records, the privacy rule defers to CLIA regulations in the case of laboratory results, explains Jane Pine Wood, Esq., an attorney at McDonald Hopkins, in Dennis, MA. This difference means that in the 26 states without laws authorizing direct disclosure of test results to patients or the 13 states that expressly prohibit it, patients do not have direct access to their laboratory results.

Bill Wilson, administrative director of the laboratory at Stamford (CT) Hospital, says, "Patients should be able to get their test results directly from the lab. The Internet makes it easy for people to understand what their cholesterol results or blood sugar levels mean." Laboratories in Connecticut can release reports directly to the patient with the ordering provider's approval. "We ask for the patient's identification, verify that it is their information, and give them a printed copy of the results when they request one," he adds.

Although access to lab results can help patients ask more specific questions of their physicians and make informed choices about lifestyle changes, the challenge that needs to be addressed is related to the more complex tests that may be ordered, says Wilson. "Without a physician's interpretation and explanation of the results, the patient won't know what to do with them," he explains.

Rodney W. Forsman, president of the Clinical Laboratory Management Association in Chicago and assistant professor emeritus of laboratory medicine and pathology at Mayo Clinic in Rochester, MN, says, "A significant issue that must be addressed is the fact that the role of the physician's interpretation and consultation with the patient will be subverted when patients get the results directly from the lab."

It will be important for labs to develop a cover letter for all results given directly to patients that instructs them to call their physician to discuss the meaning of the test results, Forsman suggests. "Lab personnel will need to make it clear that they cannot explain the meaning of results," he adds. "Other issues that must be addressed include the method of delivering results to patients, how to verify the patient's identity when making a request, and how to cover costs associated with providing results directly to patients. Some hospitals already give patients access to lab results through a secure web site, so it will not be an issue for them."

Other hospitals will need to develop a protocol that addresses whether to provide print copies of reports that are mailed to the home address or electronic copies of reports that are transmitted through e-mail, he points out.

Wood says, "Some reports may be as many as 30 pages, and even if the report is short, staff time is needed to find the report, print it, and mail it. Hospital billing departments will not want to handle charges of $5 or $10 for producing and mailing the report, and insurance will not cover the cost, so hospitals will have to decide if they are going to provide the service free."

At Stamford Hospital, reports to the physicians are automatically sent to a secure fax line identified by the physician, so no staff time is involved to produce and send the report, Wilson says. "We can set up the system to generate a report for the patient, but at this time, the only way to send it electronically is to a fax," he says. "We don't use e-mail for reports because we don't have a way to be sure the transmission is secure."

Concerns about e-mailing reports should not be an issue, says Wood. "If the patient instructs a lab to send the report by e-mail and provides the e-mail address, it does not violate any privacy regulations," she says. Some states may require that the lab encrypt the message that is sent, but there is no requirement that the receiver take any security measures, Wood adds.

While hospital lab managers and compliance officers should be thinking about protocols that might need to be developed, be aware that comments on the proposed rule are being accepted until Nov. 14, she points out. There may be changes to the proposed rule that might affect actual procedures the lab must take, Wood adds.

Forsman says, "Hospitals have always been required to provide the patient's medical record when requested, and although CLIA regulations prohibited the release of lab results to patients, many hospitals either do not take time to delete lab reports in the record or are unaware that they are supposed to do so. So patients have been receiving lab reports in their medical records." The change that the proposed rule represents is that it supersedes state regulations and existing CLIA regulations that prevent release of reports directly to patients, he explains.

Overall, the proposed rule is a good step, says Forsman. "Information can help patients make positive changes in their lifestyle to improve their cholesterol or blood sugar levels, and a lab test can reinforce the benefits of their efforts," he says. "It can also help patients prepare to ask questions of their physicians."

The most important task of all labs will be to find a way to keep the physician in the loop, admits Forsman. "The best place to get information on what test results mean is the physician," he points out. "We may need to develop procedures to notify physicians when their patients ask for results to be given directly to them, so they can follow up, because unfortunately, not all patients will go back to the physician if they think they have their answers."


• Rodney Forsman, President, Clinical Laboratory Management Association, 401 N. Michigan Ave., Suite 2200, Chicago, IL 60611. Telephone: (312) 321-5111. Fax: (312) 673-6927. E-mail: forsman rodney@mayo.edu.

• Bill Wilson, Administrative Director of Laboratory, Stamford Hospital, 30 Shelburne Road, Stamford, CT 06904. Telephone: (203) 276-1000. E-mail: wwilson@stamhealth.org.

• Jane Pine Wood, Esq., McDonald Hopkins, 956 Main St., Dennis, MA 02638. Telephone: (508) 385-5227. Fax: (508) 385-4355. E-mail: jwood@mcdonaldhopkins.com.

• To see a copy of the proposed rule and to see information on how to submit comments, go to www.gpo.gov/fdsys. On the right-side navigational bar under "Featured Collections," select "Federal Register." Then select "2011" and choose "September" and September 14." Scroll down to "Health and Human Services." Under "Proposed Rules" select "CLIA Program and HIPAA Privacy Rule; Patients' Access to Test Reports Pages 56712 - 56724 [FR DOC # 2011-23525]" Comments about the proposed rule must be submitted by Nov. 14, 2011.

• To access a free copy of "Electronic release of clinical laboratory results: A review of state and federal policies" go to www.chcf.org. Under "Browse" and under "Topics," select "Health IT." On the left side of the page, under "Health IT," select "PHRs and Privacy." Scroll down to ""Electronic Release of Clinical Laboratory Results: A Review of State and Federal Policy."