Focus On: Patient Access to Lab Test Results: Labs Have Flexibility in Developing Policies Under New Access Rule

Clinical and anatomic pathology laboratories have flexibility as to how to set up policies and procedures to respond to patient requests under a new rule requiring labs to provide patients with access to their completed test reports, say industry experts. In a March 25, 2014, webinar co-sponsored by G2 Intelligence and the American Clinical Laboratory Association (ACLA), a key staff person from the Centers for Medicare and Medicaid Services (CMS) and the legal counsel to ACLA addressed key issues raised by the new rule. The new rule becomes effective April 7, though laboratories will not be required to comply until Oct. 6, 2014. As of April 7, a lab subject to the Clinical Laboratory Improvement Amendments may provide patients with a copy of a completed test report. As of Oct. 6, a lab that is subject to the rule must do so. The rule applies to laboratories that are considered “covered entities” under the Health Insurance Portability and Accountability Act (HIPAA)—in other words, any labs that performed covered electronic transactions, such as transmitting health care claims to a health plan, according to Karen Dyer, MT(ASCP), deputy director of the Division of Laboratory Services at CMS. The rule is expected to apply to almost all laboratories. The new rule preempts contrary state law that prohibits providing individuals with access to their test results, although HIPAA-covered laboratories must continue to abide by state law that provides “more stringent” access to protected health information (PHI). More stringent means greater right of access. Test reports maintained by or for a covered laboratory are considered part of a “designated record set,” and the patient has the right to all PHI in that record set for as long as the information is maintained by the laboratory. There is no time limit on requests, so patients can request completed test reports from previous years and the lab must provide those reports if they still have them. Labs must provide individuals with a copy of their test reports in the form or format that the individual requests if a copy in that form is readily producible. If the test report is not readily producible in that specific format, the copy must be either a readable hard copy or other form or format agreed upon by the individual and lab. If the lab maintains requested information electronically, the lab must have the capability of providing some form of electronic copy of the test report, such as a PDF sent through e-mail or on a CD. The lab is not required to purchase new software or systems to accommodate a request for an electronic copy in a form that it cannot produce, explains Dyer. Concerns About Rule Dyer addressed a number of concerns that have been raised by laboratories about compliance with the rule:

1. Since patients have access to test results without the benefit of provider interpretation, there is a potential for them to panic and act upon results that appear to be abnormal. Dyer notes labs will not be required to interpret test results for patients and should continue to refer patients back to the referring physician for interpretation. Peter Kazon, Esq., senior counsel with Alston & Bird, suggests that labs have a policy that results not be released to the patient any sooner than 48 hours after they have been sent to the physician. This gives the physician a chance to address any potential concerns about abnormal results before the patient receives the results.
2. Reference laboratories do not have contact with the patient, and many feel this rule should not apply to them. According to Dyer, reference labs that are covered entities under HIPAA will be require to provide access to completed test reports.
3. Labs have 30 days to respond to a request, but in some cases, it may not be possible to meet that time frame (i.e., testing takes longer or labs have to retrieve archived records). Dyer notes that labs may request, in writing, a one-time 30-day extension and the request must provide the patient with a reason for the delay. In rare cases when tests will not be completed and available within the time frame and the individual still wants the report, the lab must provide access to the existing information in its designated record set at the time, minus the test report requested. Test reports are not considered part of the designated record set until they are complete.
4. Under HIPAA, individuals have a broad right of access to any or all of their information contained in a designated record set with a very limited exception. There is an exception if a licensed health care professional has determined, based on professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person.

Authentication Laboratories are required under the HIPAA privacy rule to verify both the identity and authority of the person to have access to the individual’s PHI. Laboratories are required to abide by an individual’s request to have the lab transmit the copy of the person’s PHI to another person or entity designated by the individual (i.e., a different doctor for a second opinion). Labs are required to take reasonable steps to verify the identity of the individual making a request for access, but labs can’t impose unreasonable verification measures as a means to avoid having to provide access. No particular form of verification is mandated by the rule; Kazon suggests the labs require the individual to supply some mix of specific data elements that only that person would know, which could include name, date of birth, the last four digits of their Social Security number, date of service, test name, address, insurance ID, ordering physician name and address, and billing statement number. Essentially, there are two parts to the authentication: Does the person have the right to the information and, if so, is this the right information for this person? The lab will need to set up internal verification processes. While a request does not have to be made in writing, both Dyer and Kazon recommend that labs develop a request form that individuals complete and sign. This ensures that the lab has documentation and will help protect the lab from potential liability. Takeaway: Laboratories have a fair amount of flexibility in how they handle patient requests for test information under the new rule. As of Oct. 6, 2014, labs must be prepared to provide access to all completed test reports, even those from previous years. Editor’s note: See the next issue of National Intelligence Report for more on complying with the patient access rule.