HHS Proposal Expands Patient Rights

Empowers Patient Access to Test Results Jeffrey Roman (gen_sec) • September 13, 2011

HHS Secretary Kathleen Sebelius has proposed new rules that would expand the rights of patients to access their health information through the use of health information technology.

The new rules specifically would "empower patients and allow them to gain access to test results reports directly from labs," the HHS says in a statement issued Monday.

The rules would make sure that when patients request information, labs covered by the Health Insurance Portability and Accountability Act of 1996 [HIPAA] provide the information directly to the patients or their personal representatives.

The Centers for Medicare & Medicaid Services, the HHS Office for Civil Rights, and the Centers for Disease Control and Prevention jointly issued a notice of proposed rulemaking seeking comment on the proposed rules. Comments will be accepted for 60 days, and a final rule, responding to comments, will be pushed later this year.

The proposed rule would amend the Clinical Laboratory Improvement Amendments of 1988 [CLIA] regulations, specifying that, upon a patient's request, the laboratory may provide access to completed test reports that, using the laboratory's authentication process, can be identified as belonging to that patient. It will also update HIPAA privacy regulations to strengthen patients' rights to access their own laboratory test result reports, a current exception.

"We are at a critical moment in time when we can either choose to innovate, or lag behind in care," said Dr. Farzad Mostashari, National Coordinator for Health Information Technology. "A commitment by health care stakeholders to support health IT and provide greater consumer access to their health information is the first step toward a healthier future."

Under the current CLIA regulations, a laboratory may release patient test results directly to the patient only if:

The ordering provider expressly authorizes the laboratory to do so at the time the test is ordered, or
State law expressly allows for it.

The current privacy rule generally requires certain healthcare providers to give individuals access to health information upon request. But with the privacy rule's access requirements, deferring to the CLIA rules, there's an exception for direct access by patients to their laboratory test results. "Thus in 26 states without laws authorizing direct disclosure of test results to patients and 13 states that expressly prohibit it, patients do not have access to their complete medical information," stated a fact sheet issued by the CMS.