HIPAA gives right to medical results directly from labs

HHS Rules Labs Must Give Patients Results

HIPAA gives right to medical results directly from labs

Image courtesy of [Praisaeng] / FreeDigitalPhotos.net

New ruling means patients can obtain results directly from labs

The Department of Health and Human Services has issued a final rule that gives patients the right to obtain their medical test results directly from labs. This final rule was issued jointly by the CMS, CDC, and OCR. As a consequence of this change, laboratories will also be forced to update their notices of privacy practices under HIPAA.

The new rule amends the Clinical Laboratory Improvement Amendments of 1988, allowing laboratories to release to a patient, or a person designated by the patient, copies of test reports upon request. Previously, most labs previously were exempt from the HIPAA requirement to provide patients with a copy of their medical information, but under the new rule, HHS says patients now have the option to obtain their test reports directly from the laboratory. As always, they may still obtain their results from their physicians as well.

The rule means that labs must also update their HIPAA notice of privacy practices to inform individuals of this new right and include a brief description of how to exercise the right.

According to an HHS press release, “The right to access personal health information is a cornerstone of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule,” said Secretary Kathleen Sibelius. “Information like lab results can empower patients to track their health progress, make decisions with their health care professionals, and adhere to important treatment plans.”

The final rule eliminates the exception under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to an individual’s right to access his or her protected health information when it is held by a CLIA-certified or CLIA-exempt laboratory.

Healthcare Info Security reported on the ruling and its impact. Alice Leiter, policy counsel for the consumer advocacy group the Center for Democracy and Technology, stated: “HIPAA requires covered entities to promptly revise NPPs whenever there is a material change to any of their privacy practices, including those pertaining to individuals’ right to access their information.”

She continued, “This constitutes a material change. As a result, by the compliance date of the new final rule – 240 days from publication in the Federal Register – HIPAA-covered labs must revise their notices to inform individuals of this right and provide a brief description of how to exercise it.”

“This rule is significant because it increases patients’ access to their health information, allowing them to be as involved as they choose in their health and care by increasing their ability to obtain and organize electronic copies of their own data,” Leiter says.

Read More