View Rule

View EO 12866 Meetings Printer-Friendly Version     Download RIN Data in XML

HHS/CMS RIN: 0938-AQ38 Publication ID: Fall 2013 
Title: CLIA Programs and HIPAA Privacy Rule; Patients' Access to Test Reports (CMS-2319-F) 
Abstract: This CMS-CDC-OCR rule amends the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations to specify that, upon a patient's request, the laboratory may provide access to completed test reports that, using the laboratory's authentication process, can be identified as belonging to that patient. Subject to conforming amendments, the rule retains the existing provisions that provide for release of test reports to authorized persons and, if applicable, the individuals (or their personal representative) responsible for using the test reports and, in the case of reference laboratories, the laboratory that initially requested the test. In addition, this rule also amends the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to provide individuals the right to receive their test reports directly from laboratories by removing the exceptions for CLIA-certified laboratories and CLIA-exempt laboratories from the provision that provides individuals with the right of access to their protected health information. 
Agency: Department of Health and Human Services(HHS)  Priority: Other Significant 
RIN Status: Previously published in the Unified Agenda Agenda Stage of Rulemaking: Final Rule Stage 
Major: No  Unfunded Mandates: No 
CFR Citation: 42 CFR 493    45 CFR 164   
Legal Authority: 42 USC 263a   
Legal Deadline:  None

Statement of Need: The current CLIA regulations and related laws of the states and territories pose potential barriers to the laboratory exchange of test reports directly with the patient. This rule implements changes that support of the Secretary's efforts of achieving patient-centered and health IT-enabled health care and allow patients direct access to their test reports from a laboratory

Summary of the Legal Basis: The final rule removes the exceptions to an individual's right of access related to CLIA and CLIA-exempt laboratories. HIPAA-covered laboratories will be required to provide an individual (or the individual's personal representative) with access, upon request, to the individual's completed test reports (and other information maintained in a designated record set) in accordance with the provisions of section 164.524 of the Privacy regulations.

Alternatives: Several alternatives were considered before selecting the approach in this final rule to provide access to laboratory test reports upon a patient's request. One alternative would have been to leave the regulations as written without making any changes. However, this option would leave in place the restrictions on patients' direct access to their laboratory test results and would therefore impede the goal of promoting patient-centered health care. Another alternative would have been to revise the definition of "authorized person" under CLIA to specifically include a patient as an authorized person. This alternative was not considered feasible because the definition of "authorized person" in the CLIA regulations also permits individuals to order tests, and it defers to state law for authorization. A last alternative considered would have been to require the laboratory to automatically provide each test report directly to each patient rather than the permissive approach to provide patients access to their reports upon request. However, this alternative would have had the potential of significantly increasing the cost for laboratories since 100 percent of the 350 million to 703 million test reports issued annually would need to be provided to the patients.

Anticipated Costs and Benefits: We estimate that this rule will not have an economically significant impact on laboratories. It will facilitate the ability of patients to compare test results over time and to share this information with future physicians or multiple physicians. This improved information sharing is likely to improve health care, especially for patients and providers who do not have access to electronic health records in the near term.

Risks: None. This rule will allow laboratories to use existing processes for patient access or develop new procedures that are appropriate for their facility. It expands an individual's right of access to include receiving test reports directly from laboratories. This rule does not alter the role of the ordering or treating provider in reporting and explaining test results to patients.

Action Date FR Cite
NPRM  09/14/2011  76 FR 56712   
NPRM Comment Period End  11/14/2011 
Final Action  11/00/2013 
Additional Information: Includes Retrospective Review under E.O. 13563.
Regulatory Flexibility Analysis Required: No  Government Levels Affected: State 
Small Entities Affected: Businesses, Governmental Jurisdictions  Federalism: No 
Included in the Regulatory Plan: Yes 
RIN Data Printed in the FR: No 
Agency Contact:
Judith Yost
Director, Division of Laboratory Services
Department of Health and Human Services
Centers for Medicare & Medicaid Services
S-2-09-27, Center for Clinical Standards and Quality, Mail Stop C2-21-16, 7500 Security Boulevard,
Baltimore, MD 21244-1850
Phone:410 786-3531