Privacy rule changes target CLIA medical laboratories
Medical laboratories will be required to provide patients access to their health information including results from lab-testing under final rules scheduled to be published in the Federal Register on February 6, 2014, according to an announcement by the Department of Health and Human Services (HHS). The publication of the new rules is expected to end Office for Civil Rights’ (OCR) discretionary delay of enforcement of some provisions of the Omnibus Rule.
The final rule, jointly issued by OCR, the Centers for Medicare and Medicaid Services, and the Centers for Disease Control and Prevention will implement a proposal to modify the regulations issued under the Health Insurance Portability and Accountability Act, and the Clinical Laboratory Improvement Amendments (CLIA). CLIA regulates most of the clinical testing labs and the HIPAA Privacy Rule sets standards for the use and disclosure of health information by covered healthcare providers and facilities, including most clinical laboratories
The new final rule will apply to clinical laboratories covered under CLIA and HIPAA (most labs must comply with both laws). Specifically, the rule (1) expressly allows CLIA labs to provide patients direct access to their lab test results and (2) requires labs covered under HIPAA to provide test results directly to patients in the form or format requested, (i.e., paper or electronic) if it is readily producible in that manner.
Today, patients’ access to clinical lab information is determined by the states. Only seven states and the District of Columbia allow such direct reporting and thirteen states prohibit it. Twenty-three states have no laws addressing the issue. The new rules will preempt state laws and regulations that prohibit medical laboratories from providing patients access to their test reports.
The new regulations were prompted by the recommendations of the HHS Health Information Technology Policy Committee, which concluded that current CLIA and HIPAA regulations prevent patients from taking a more active role in their personal health care decisions. Opponents of the proposed rule express concerns about providing sensitive and complicated medical information directly to patients without the benefit of a healthcare provider's interpretation and guidance.
The new rules will take effect 60 days after their publication in the Federal Register. Clinical laboratories will have an additional 180 days after the effective date to comply with the requirement of the HIPAA Privacy Rule requirements. After this 240 day period, clinical laboratories required to comply with the provisions with the HIPAA Privacy Rule will face enforcement actions by OCR if they are found to not have policies and procedures in place to provide patients with access to their health information.
Another impact of the issuance of the final rule providing individuals with the right of access to health records from CLIA labs is the end of the OCR’s enforcement delay which excused some CLIA laboratories from having to revise their notices of privacy practices (NPP). In September 2013, OCR announced it was delaying its enforcement of the requirement that CLIA laboratories that revise their NPPs to comply with the modifications made to the HIPAA Rules “until further notice”. OCR said its enforcement delay was to relieve the burden and expense to the HIPAA-covered CLIA laboratories of having to revise their NPPs twice within a short period of time, once by September 23, 2013, to comply with the Omnibus Rule, and again by the impending issuance of any CLIA-related amendment to the individual access requirements of the Privacy Rule.
The enforcement delay applies to HIPAA-covered laboratories that are subject to CLIA or exempt from CLIA and that are not required to provide an individual with access to their laboratory test reports. The enforcement delay does not apply to laboratories that operate as part of a larger legal entity, such as a hospital, and by virtue of that relationship, do not have their own, laboratory-specific, NPPs.
With the publication of the final rules to provide individuals the right of access to their health information held by CLIA laboratories, it is expected that OCR will announce that that all HIPAA-covered laboratories must have revised their NPPs to comply with the Omnibus Rule as well as the new provisions in the CLIA amendments. OCR said it would issue a notice at least 30 days in advance of the end of this enforcement delay.
See also:
