To empower patients to be informed partners with their healthcare providers, the US Department of Health and Human Services (HHS) has issued new rules, “CLIA Program and HIPAA Privacy Rule; Patients’ Access to Test Reports,” enabling patients and their designates to have direct access to the patient’s laboratory test reports.

The new rules amend the implementing regulations of the Clinical Laboratory Improvement Amendments of 1988 (CLIA) to allow laboratories to give a patient, or a person designated by the patient—his or her ‘personal representative’—access to the patient’s completed test reports at the request of the patient or representative. Correspondingly, the rule eliminates the exception under the privacy rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which previously limited an individual’s right to access his or her protected health information when it was held by a CLIA-certified or CLIA-exempt laboratory.

Taken together, the revised rules will require laboratories to provide patients access to their test reports upon request. While patients can continue to get access to their laboratory test reports through their doctors, the new rules give patients the option to obtain their test reports directly from the laboratory, while also maintaining protections for patients’ privacy. The new rules do not require laboratories to interpret the test results, and they may refer individuals back to their healthcare provider for such information.


HHS Secretary Kathleen Sebelius

“The right to access personal health information is a cornerstone of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule,” said HHS Secretary Kathleen Sebelius. “Information like lab results can empower patients to track their health progress, make decisions with their healthcare professionals, and adhere to important treatment plans.”

“Patient engagement is essential to creating a healthcare system that delivers better health outcomes at lower costs,” commented Jon Cohen, MD, senior vice president and chief medical officer for Quest Diagnostics. “HHS’s final rule means millions of Americans who previously could not access their laboratory and other healthcare data from clinical laboratory companies like Quest can now do so without first requiring the approval of their healthcare provider. That’s a huge win for patients who want to take responsibility for their healthcare and engage in a richer dialogue with their healthcare providers in the interest of making informed clinical decisions.”

Prior to publication of the revised rules, many states had laws that prohibited laboratories from releasing test results directly to patients. The new HHS rules preempt such state laws, and will now require laboratories to provide patients and their designates with access to the completed pathology and laboratory test reports belonging to the patient.

The final rules were issued jointly by three HHS agencies: the Centers for Medicare and Medicaid Services (CMS), which is generally responsible for laboratory regulation under CLIA; the Centers for Disease Control and Prevention (CDC), which provides scientific and technical advice related to CLIA; and the Office for Civil Rights (OCR), which is responsible for enforcing the HIPAA privacy rule.

Under the revised HIPAA privacy rule, patients and their designates can see or be given a copy of the patient’s protected health information, including an electronic copy, with limited exceptions. The patient or personal representative may have to put the request in writing and pay the cost of copying, mailing, or electronic media on which the information is provided, such as a CD or flash drive. In most cases, copies must be given to the patient within 30 days of the request.

For the nearly 23,000 clinical laboratories in the 39 states newly affected, complying with the revised rules may require a significant commitment of resources. According to HHS estimates, fulfillment of each test report will require between 10 and 30 minutes:

Processing a request for a test report, either manually or electronically, will require completion of the following steps: (1) receipt of the request from the individual; (2) authentication of the identification of the individual; (3) retrieval of test reports; (4) verification of how and where the individual wants the test report to be delivered and provision of the report by mail, fax, email, or other electronic means; and (5) documentation of test report issuance.

In the first year, HHS estimates, one-time development costs incurred by the labs could total as much as $10.2 million. First-year undiscounted costs for responding to an estimated high of 3.5 million patient requests could total as much as $52.8 million. HHS estimates that the total 2013 cost of $63.1 million would be reduced in subsequent years because of the elimination of one-time setup costs, but would gradually climb to $60.8 million in 2017.

Labs would be permitted to recoup some of their costs by charging the patient “a reasonable, cost-based fee for providing access to their health information, including the cost of supplies for and labor of copying the requested information.”

Clinical laboratory organizations responded favorably to the long-awaited publication of the revised rules, which were first proposed in September 2011.

“We are pleased that the HHS has expanded patient rights and access to laboratory records, while recognizing the vital role pathologists and laboratories have in patient healthcare,” said Gene N. Herbek, MD, president of the College of American Pathologists (CAP). “Multiple states had not allowed such access, but the rule preempts state law that prevents patients from receiving test results from laboratories directly. As this rule is implemented, the CAP will work with laboratories on compliance with regulations and with HHS on its guidance to providers and patients.”


Janet Kreizman, AACC

In a statement issued by the American Association for Clinical Chemistry (AACC), CEO Janet B. Kreizman voiced the organization’s support for the revised rules, but also emphasized the need for healthcare providers to consult with patients about their test results. “AACC strongly supports patient empowerment and health literacy and believes that patients should have greater access to their test results so that they can take a more active role in managing their health,” said Kreizman. “However, providing laboratory test results without context may have limited value for some consumers, while unnecessarily alarming others. Most laboratory test reports only provide a numeric value along with a reference range for each result. AACC recommends that patients consult with their physician before making any health-related decisions based on their test results.”

According to information cited by Quest, previous studies have suggested that direct patient access to healthcare information may improve patient participation in healthcare—and possibly the quality of care. A 2009 study in the Annals of Internal Medicine found that patients were not informed of more than 7% of abnormal test results. Another study, published in Lab Medicine in 2007, found that “patients want information on their lab results” and suggests patients would be more satisfied with the healthcare system if given greater data access.

“Studies show that patients who have access to their health records tend to be more engaged in decision making than those who don’t, and may even be more likely to follow treatment protocols and other behaviors that promote favorable outcomes,” said Cohen. “We’re hopeful that the ruling will empower people to openly communicate with their physicians regarding tests, procedures, and therapies, and actively participate in their healthcare.”

The final rules were published in the February 6, 2014, edition of the Federal Register.