HIPAA Rights Expanded: Opening the Door to Patient Access to Lab Results

We’re inching closer to promulgation of final regulations that will likely make all lab test results more easily accessible to patients, by making them subject to the HIPAA rules ensuring patient access. (Currently, lab test results and psychiatric notes are the two lone categories of patient data not subject to HIPAA; however “in-house” labs drawn at a health care facility or medical practice are already accessible to patients under HIPAA.) This change is significant in no small part because there was no change in the law that prompted the change in regulation — the only thing that changed was the rising voice of patients insisting on access … and a more receptive set of ears in Washington. The proposed change in the regulation was first published two years ago. As I wrote then in a post on lab test results and proposed changes to the HIPAA rules:

This carveout of lab results from patient-accessible records has long been a thorn in the side of the e-patient. This month, the federales announced that they would step forward as Androcles to the e-patient lion (to jumble a reference or two), and pull out the thorn, by proposing to amend both the CLIA regs and the HIPAA regs. The HIPAA regs include the exception described above: all records must be made accessible upon request except labs and a couple others. The lab results exception will be deleted from the HIPAA regs if the change is finalized. The CLIA regs prohibit lab delivery of results directly to patients. The proposed amendment says that the labs “may” release the results directly to patients. The net effect is that patients will have the right to request the results, and since labs will be permitted to release them, they will have to do so.

Why did it take two years to finalize these rule changes? There is significant opposition to the notion that patients should have direct access to lab test results. You can get a sense of the opposition by reading some of the physician comments on a recent post on the subject by Alice Leiter and Deven McGraw on The Health Care Blog. That post and other communications (e.g. an on line petition) have tried over the past two years to hurry this thing up. I don’t think that any of these efforts has been effective in moving the regulation forward; the agency took a giant leap at the outset of this process, trying to do the right thing, and has been moving forward slowly, presumably in the face of opposition. (All comments filed on the proposed rule may be found here. The SPM comments are posted here.)

How do we know the rule is closer to being finalized? Honestly, it’s like reading entrails. First, the Office of Civil Rights at HHS (the outfit that enforces HIPAA) issued a notice saying that it would not be enforcing the requirement that clinical labs provide a new form of Notice of Privacy Practices to patients as of today (September 23 is the compliance date for the HIPAA Omnibus Rule; see HIPAA Omnibus Final Rule: What’s in it for Patients?) because changes are afoot that would require a new notice to be issued soon, and it would make sense to wait and just do this once. Second, the White House Office of Management and Budget (OMB), which gets to review all federal regulations before they are finalized, published a notice that it received the rule for review on September 19. OMB gets 60-90 days to review final rules, and usually completes its review in less time than that.

Now, we don’t know for sure what the final regulation will look like; all we know is that it’s on the move. However, given the nature of the revisions being made (surgical edits), the fact that the rule is advancing towards final promulgation seems to be a good sign. It would be fascinating to learn why the rule was delayed for so long, and what shook it loose just now. The rulemaking notice, when it is published in a couple of months, will answer some questions, but not all. It is possible that the final rule may make the lab results accessible to patients after a brief period during which they are accessible to health care providers only, as some commenters have suggested. Any wagers on whether the rule will be finalized as proposed or whether some delay to patient access will be added in?

In assessing the likely impact of this rule change on lab operations, the federales assumed that most patients would prefer to continue to receive their lab test results from their health care providers, and that only 1 patient in 200 to 1 patient in 2000 would seek to access results directly. What do you think of this estimate? Can you point to any data to back up your opinion?

Waiting with bated breath for the final regs …

This post first appeared on e-patients.net, the blog of the Society for Participatory Medicine. David Harlow chairs the Society’s Public Policy Committee.

More Read