56712

Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

the States, or on the distribution of
power and responsibilities among thevarious levels of government).
6. Executive Order 13175: Consultation
and Coordination With Indian Tribal
Governments
Executive Order 13175 (65 FR 67249,
November 9, 2000) does not apply tothis rule because it will not have tribal
implications (i.e., substantial direct
effects on one or more Indian tribes, oron the relationship between the Federal
Government and Indian tribes, or on the
distribution of power andresponsibilities between the Federal
Government and Indian tribes).
7. Executive Order 13045: Protection ofChildren From Environmental Healthand Safety Risks
This rule is not subject to Executive
Order 13045 (62 FR 19885, April 23,1997), because it is not economicallysignificant as defined in Executive
Order 12866 and because the EPA does
not have reason to believe theenvironmental health or safety risks
addressed by this action present a
disproportionate risk to children.
8. Executive Order 13211: Actions That
Significantly Affect Energy Supply,
Distribution, or Use
This rule is not subject to Executive
Order 13211 (66 FR 28355, May 22,2001), because it is not a significant
regulatory action as defined in
Executive Order 12866.

DEPARTMENT OF HEALTH AND
HUMAN SERVICES

12. Executive Order 12898: Federal
Actions To Address Environmental
Justice in Minority Populations and Low
Income Populations

Office of the Secretary

Because this rule proposes
authorization of pre-existing State rules
and imposes no additional requirements
beyond those imposed by State law andthere are no anticipated significant
adverse human health or environmental
effects, the rule is not subject to
Executive Order 12898 (59 FR 7629,
February 16, 1994).

RIN 0938–AQ38

13. Congressional Review Act
EPA will submit a report containing
this rule and other information requiredby the Congressional Review Act (5U.S.C. 801 et seq.) to the U.S. Senate,
the U.S. House of Representatives, andthe Comptroller General of the UnitedStates prior to publication in theFederal Register. A major rule cannot
take effect until 60 days after it ispublished in the Federal Register. Thisaction is not a ‘‘major rule’’ as definedby 5 U.S.C. 804(2).
List of Subjects in 40 CFR Part 271

9. National Technology Transfer
Advancement Act
EPA approves State programs as longas they meet criteria required by RCRA,
so it would be inconsistent withapplicable law for EPA, in its review ofa State program, to require the use ofany particular voluntary consensus
standard in place of another standard
that meets requirements of RCRA. Thus,
the requirements of section 12(d) of the
National Technology Transfer andAdvancement Act of 1995 (15 U.S.C.
272 note) do not apply to this rule.
10. Executive Order 12988

mstockstill on DSK4VPTVN1PROD with PROPOSALS1988) by examining the takings
implications of the rule in accordancewith the Attorney General’s
Supplemental Guidelines for the
Evaluation of Risk and Avoidance ofUnanticipated Takings issued under the
executive order.

As required by section 3 of Executive
Order 12988 (61 FR 4729, February 7,1996), in issuing this rule, EPA has
taken the necessary steps to eliminate
drafting errors and ambiguity, minimize
potential litigation, and provide a clear
legal standard for affected conduct.

Environmental protection,
Administrative practice and procedure,
Confidential business information,
Hazardous materials transportation,
Hazardous waste, Indians—lands,
Intergovernmental relations, Penalties,
Reporting and recordkeeping
requirements.
Authority: This action is issued under theauthority of sections 2002(a), 3006 and7004(b) of the Solid Waste Disposal Act asamended, 42 U.S.C. 6912(a), 6926, 6974(b).
Dated: August 28, 2011.
Susan Hedman,
Regional Administrator, Region 5.
[FR Doc. 2011–23553 Filed 9–13–11; 8:45 am]
BILLING CODE 6560–50–P

11. Executive Order 12630: Evaluationof Risk and Avoidance of Unanticipated
Takings
EPA has complied with Executive
Order 12630 (53 FR 8859, March 18,

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

PO 00000

Frm 00052

Fmt 4702

Sfmt 4702

Centers for Medicare & Medicaid
Services
42 CFR Part 493

45 CFR Part 164[CMS–2319–P]

CLIA Program and HIPAA Privacy
Rule; Patients’ Access to Test Reports
AGENCY: Centers for Medicare &Medicaid Services (CMS), HHS; Centers
for Disease Control and Prevention(CDC), HHS; Office for Civil Rights(OCR), HHS.
ACTION: Proposed rule.
SUMMARY: This proposed rule would

amend the Clinical Laboratory
Improvement Amendments of 1988
(CLIA) regulations to specify that, upona patient’s request, the laboratory may
provide access to completed test reports
that, using the laboratory’s
authentication process, can be identified
as belonging to that patient. Subject toconforming amendments, the proposed
rule would retain the existing
provisions that provide for release of
test reports to authorized persons and,if applicable, the individuals (or theirpersonal representative) responsible forusing the test reports and, in the case ofreference laboratories, the laboratorythat initially requested the test. In
addition, this proposed rule would also
amend the Health Insurance Portability
and Accountability Act of 1996 (HIPAA)
Privacy Rule to provide individuals theright to receive their test reports directlyfrom laboratories by removing theexceptions for CLIA-certified
laboratories and CLIA-exempt
laboratories from the provision thatprovides individuals with the right ofaccess to their protected healthinformation.
DATES: To be assured consideration,comments must be received at one of
the addresses provided below, no later
than 5 p.m. on November 14, 2011.
ADDRESSES: In commenting, please referto file code CMS–2319–P. Because ofstaff and resource limitations, we cannot
accept comments by facsimile (FAX)transmission.
You may submit comments in one offour ways (please choose only one of theways listed):
1. Electronically. You may submit
electronic comments on this regulation

E:\FR\FM\14SEP1.SGM

14SEP1

mstockstill on DSK4VPTVN1PROD with PROPOSALS

Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules
to http://www.regulations.gov. Follow
the ‘‘Submit a comment’’ instructions.
2. By regular mail. You may mailwritten comments to the following
address ONLY: Centers for Medicare &Medicaid Services, Department of
Health and Human Services, Attention:
CMS–2319–P, P.O. Box 8010, Baltimore,
MD 21244–8010.
Please allow sufficient time for mailed
comments to be received before theclose of the comment period.
3. By express or overnight mail. You
may send written comments to thefollowing address ONLY: Centers for
Medicare & Medicaid Services,
Department of Health and Human
Services, Attention: CMS–2319–P, Mail
Stop C4–26–05, 7500 Security
Boulevard, Baltimore, MD 21244–1850.
4. By hand or courier. Alternatively,
you may deliver (by hand or courier)your written comments ONLY to thefollowing addresses prior to the close of
the comment period:a. For delivery in Washington, DC—
Centers for Medicare & Medicaid
Services, Department of Health andHuman Services, Room 445–G, Hubert
H. Humphrey Building, 200
Independence Avenue, SW.,
Washington, DC 20201.
(Because access to the interior of the
Hubert H. Humphrey Building is notreadily available to persons without
Federal government identification,commenters are encouraged to leave
their comments in the CMS drop slots
located in the main lobby of thebuilding. A stamp-in clock is available
for persons wishing to retain a proof of
filing by stamping in and retaining an
extra copy of the comments being filed.)b. For delivery in Baltimore, MD—
Centers for Medicare & Medicaid
Services, Department of Health andHuman Services, 7500 Security
Boulevard, Baltimore, MD 21244–1850.
If you intend to deliver yourcomments to the Baltimore address,
please call telephone number (410) 786–
9994 in advance to schedule yourarrival with one of our staff members.
Comments erroneously mailed to theaddresses indicated as appropriate forhand or courier delivery may be delayed
and received after the comment period.
Submission of comments on
paperwork requirements. You may
submit comments on this document’s
paperwork requirements by following
the instructions at the end of the‘‘Collection of Information
Requirements’’ section in thisdocument.
For information on viewing publiccomments, see the beginning of the
SUPPLEMENTARY INFORMATION section.

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

FOR FURTHER INFORMATION CONTACT: For

CLIA regulations:Nancy Anderson, CDC, (404) 498–2280.
Judith Yost, CMS, (410) 786–3531.
For HIPAA Privacy Rule:
Andra Wicks, OCR, (202) 205–2292.
SUPPLEMENTARY INFORMATION:
Inspection of Public Comments: Allcomments received before the close of
the comment period are available forviewing by the public, including any
personally identifiable or confidential
business information that is included in
a comment. We post all comments
received before the close of thecomment period on the following Website as soon as possible after they havebeen received: http://
www.regulations.gov. Follow the search
instructions on that Web site to view
public comments.
Comments received timely will also
be available for public inspection as
they are received, generally beginningapproximately 3 weeks after publicationof a document, at the headquarters of
the Centers for Medicare & Medicaid
Services, 7500 Security Boulevard,
Baltimore, Maryland 21244, Monday
through Friday of each week from 8:30
a.m. to 4 p.m. To schedule anappointment to view public comments,
phone 1–800–743–3951.
I. BackgroundA. CLIA Statute and Regulations
The Clinical Laboratory Improvement
Amendments of 1988 (CLIA) wereenacted to establish quality standards
for certain laboratory testing. Thesestandards ensure the accuracy,
reliability and timeliness of patient test
results, regardless of where the test is
performed. The standards are based on
the complexity of the laboratory test
method; the more complicated the test,
the more stringent the requirements forthe laboratory.
CLIA established three categories oftesting based on complexity level. In
increasing order of complexity, thesecategories are waived complexity,
moderate complexity which includes
the subcategory of provider-performed
microscopy (PPM), and highcomplexity. Laboratories must hold a
CLIA certificate for the most complex
form of CLIA-regulated testing that they
perform.
CLIA covers all phases of laboratory
testing, including the reporting out of
test results. The CLIA-based limitations
that govern to whom a laboratory may
issue a test report have become a pointof concern. The requirements for alaboratory test report are set forth in 42
CFR 493.1291.

PO 00000

Frm 00053

Fmt 4702

Sfmt 4702

56713

Under the current regulations at§ 493.1291(f), CLIA limits a laboratory’s
disclosure of laboratory test results tothree categories of individuals: the‘‘authorized person,’’ the person
responsible for using the test results inthe treatment context, and, in the caseof reference laboratories, the referringlab. Authorized person is defined in§ 493.2 as the individual authorizedunder State law to order or receive test
results, or both. In States that do notprovide for individual access to theindividual’s test results, the individual
must receive his or her results throughthe ordering provider.
While individuals can obtain test
results through the ordering provider,
we believe that the advent of certain
health reform concepts (for example,
individualized medicine and an
individual’s active involvement in his
or her own health care) would be best
served by revisiting the CLIA limitations
on the disclosure of laboratory test
results.
Title XIII of Division A and Title IV
of Division B of the American Recovery
and Reinvestment Act of 2009 (The
Recovery Act), which was enacted on
February 17, 2009, incorporated the
Health Information Technology for
Economic and Clinical Health (HITECH)Act.
HITECH created a Federal advisorycommittee known as the Health
Information Technology (HIT) Policy
Committee. The HIT Policy Committee
has broad representation from major
health care constituencies and provides
recommendations to the Office of the
National Coordinator for Health
Information Technology (ONC) on
issues relating to the implementation of
an interoperable, nationwide healthinformation infrastructure. Among otherefforts, the HIT Policy Committee hassought to identify barriers to theadoption and use of health information
technology. According to the HIT Policy
Committee, CLIA regulations areperceived by some stakeholders as
imposing barriers to the exchange ofhealth information. These stakeholders
include large- and medium-sizedlaboratories, some public healthlaboratories, electronic health record(EHR) system vendors, health policy
experts, health information exchangeorganizations (HIOs) and healthcare
providers who believe that theindividual’s access to his or her own
records is impeded, preventing patientsfrom a more active role in their personal
health care decisions.
CLIA staff worked with the Office of
the National Coordinator for Health IT(ONC), and the CMS Office of E–HealthStandards and Services (OESS) to

E:\FR\FM\14SEP1.SGM

14SEP1

56714Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

mstockstill on DSK4VPTVN1PROD with PROPOSALS

ensure an individual’s direct access to
his or her own medical records throughlaboratories.
The collaborating offices believe theprovision of direct patient access tolaboratory test reports would support
the commitments and goals of theSecretary of HHS and the CMS
Administrator regarding the widespread
adoption of EHRs by 2014.
Therefore, in an effort to increase
direct patient access rights, we areproposing that, upon a patient’s request,
CLIA regulations would allow
laboratories to provide direct patient
access to completed test reports that,using the laboratory’s authentication
processes, the laboratory can identify as
belonging to that patient. We propose toretain the other categories of individuals
who are eligible to receive test reports
from laboratories, namely theindividuals responsible for using thetest reports, and, in the case of areference laboratory, the laboratory that
initially requested the test. We also
propose certain conforming
amendments to the existing regulations.
CMS solicits comments fromstakeholders regarding the potential
impact of this change on improving
patients’ access to their laboratory
results.
B. HIPAA Statute and Privacy Rule
The Health Insurance Portability andAccountability Act of 1996 (HIPAA),
Title II, subtitle F—Administrative
Simplification, Public Law 104–191,
110 Stat., 2021, provided for theestablishment of national standards toprotect the privacy and security of
personal health information. The
Administrative Simplification
provisions of HIPAA apply to three
types of entities, which are known as‘‘covered entities’’: health care providers
who conduct covered health caretransactions electronically, health plans,
and health care clearinghouses.
A laboratory, as a health careprovider, is only a covered entity if it
conducts electronic transactions (forexample, electronic submission ofhealth care claims). The list of HIPAA
transactions applicable to providers are:
• Health care claims or equivalentencounter information.
• Coordination of benefits.
• Health care claim status.
• Eligibility for a health plan.
• Referral certification andauthorization.
If a laboratory does not conduct anyof the above transactions electronically(either because it does not conduct thetransactions at all or because it does so
via paper), then it is not subject to the
HIPAA Privacy Rule. If a laboratory

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

conducts a single transaction
electronically, then it becomes acovered entity and is subject to thePrivacy Rule with respect to all
protected health information that it
creates or maintains (that is, theapplication of the Privacy Rule is not
limited to the individuals or records
associated with an electronictransaction).
Pursuant to HIPAA, on December 28,
2000, the Department published a final
rule in the Federal Register (65 FR
82462) entitled ‘‘Standards for Privacyof Individually Identifiable Health
Information, known as the ‘‘Privacy
Rule,’’ which was amended on August
14, 2002 (67 FR 53182). The Privacy
Rule at 45 CFR 164.524 provides
individuals with a general right ofaccess to inspect and obtain a copy ofprotected health information about theindividual in a designated record set
maintained by or for a covered entity. A‘‘designated record set’’ is defined at§ 164.501 as a group of records
maintained by or for a covered entitythat is comprised of the medical records
and billing records about individuals
maintained by or for a covered healthcare provider; the enrollment, payment,
claims adjudication, and case or
medical management record systems
maintained by or for a health plan; orused, in whole or in part, by or for thecovered entity to make decisions about
individuals.
The definition of ‘‘designated record
set’’ also clarifies that the term ‘‘record’’means ‘‘any item, collection, orgrouping of information that includes
protected health information and ismaintained, collected, used ordisseminated by or for a covered
entity.’’ Laboratory test reports
maintained by or for a laboratory that isa covered entity fall within thedefinition of designated record set since
they are medical records about
individuals.
The right of access under § 164.524
extends not only to individuals, but also
to individuals’ personal representatives.
The rules governing who may act as apersonal representative under thePrivacy Rule are set forth at§ 164.502(g).
While individuals (and personal
representatives) generally have the rightto inspect and obtain a copy of theirprotected health information in adesignated record set, the Privacy Rule
includes a set of exceptions related to
CLIA. The right of access under§ 164.524 of the Privacy Rule does not
apply to: protected health information
maintained by a covered entity that is—(1) Subject to CLIA to the extent theprovision of access to the individual

PO 00000

Frm 00054

Fmt 4702

Sfmt 4702

would be prohibited by law; or (2)exempt from CLIA.
These exceptions at§ 164.524(a)(1)(iii) were included in the
Privacy Rule because the Department
wanted to avoid a conflict with the
CLIA requirements that limited patient
access to test reports (65 FR 82485).
These exceptions only cover test reports
at CLIA and CLIA-exempt laboratories;
the individual has a right to access thetest reports when held by any other typeof covered entity (for example, ahospital or treating physician).
Because CMS is proposing to amend
the CLIA regulations to allow CLIAcertified laboratories to provide patientswith direct access to their test reports,
there is no longer a need for the
exceptions at § 164.524 for CLIA and
CLIA-exempt laboratories. Unless these
exceptions are removed from thePrivacy Rule, they would serve as abarrier to individuals’ right of access totest reports. Failure to eliminate thesebarriers would be inconsistent with the
CMS proposal and the goals of HHS to
improve individuals’ electronic accessto their health information and havewidespread adoption of EHRs by 2014.
Accordingly, HHS is proposing to
remove the exceptions for CLIA and
CLIA-exempt laboratories from the rightof access at § 164.524.
II. Provisions of the Proposed
Regulations
A. Proposed Changes to the CLIA
Regulations (42 CFR 493.1291)
This rule proposes revisions to§ 493.1291 to provide patients, uponrequest, with direct access to theirlaboratory test reports. To do so we areproposing to add § 493.1291(l) to specify
that, upon a patient’s request, thelaboratory may provide an individualwith access to his or her completed test
reports that, using the laboratory’s
authentication processes, can be
identified as belonging to that patient.
In using ‘‘may,’’ however, we would
highlight the importance of reading the
proposed CLIA provisions in concert
with the applicable HIPAA provisions.
As described in section IIB below,
HIPAA generally requires covered
entities to give patients access to theirrecords. One exception to this generalmandate is a provision that exempts
entities subject to CLIA where a lawbars disclosure. If finalized, theproposed HIPAA amendments willremove this exception, and covered
entity laboratories will be required toprovide patients with access to test
reports. While a more detailed HIPAA
preemption analysis is found in section
IIB below, we note that the CLIA ‘‘may’’

E:\FR\FM\14SEP1.SGM

14SEP1Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

mstockstill on DSK4VPTVN1PROD with PROPOSALS

plus the HIPAA ‘‘must’’ would result ina ‘‘must disclose’’ for laboratories thatare HIPAA covered entities.
We also note that, as proposed, the
CLIA regulations would not spell out
the mechanism by which patient
requests for access would be submitted,
processed, or responded to by thelaboratories. In providing this latitude,
we intend to allow patients and theirpersonal representatives’ access topatient test reports in accordance withthe requirements of the HIPAA Privacy
Rule.
Subject to conforming amendments,
we propose to retain the existing
requirements at § 493.1291(f) that
otherwise limit the release of test
reports to authorized persons and, if
applicable, the individuals (or theirpersonal representatives) responsible forusing the test reports and, in the case ofa reference laboratory, the laboratorythat initially requested the test.
B. Proposed Changes to the Privacy Rule
(45 CFR 164.524)
The Department also proposes toamend the Privacy Rule at § 164.524 toremove the exceptions that relate to
CLIA and affect an individual’s right ofaccess. This proposal would align the
Privacy Rule with CMS’ proposedchanges and the Department’s goal of
improving individuals’ access to theirhealth information.
As a result of this proposal, HIPAA
covered entities that are laboratories
subject to CLIA would have the sameobligations as other types of covered
health care providers with respect toproviding individuals with access totheir protected health information inaccordance with § 164.524. Similarly,
HIPAA covered entities that are CLIAexempt laboratories (as the term isdefined at 42 CFR 493.2) would nolonger be excepted from HIPAA’s rightof access under § 164.524(a)(1)(iii)(B).
As with other covered entities, HIPAA
covered laboratories would be required
to provide access to the individual or
the individual’s personal representative.
The current HIPAA Privacy Rulerequires covered entities to provide an
individual with access to protected
health information in the form or format
requested by the individual, if it isreadily producible in such form orformat. The Privacy Rule permits
covered entities to charge a reasonable,
cost-based fee to provide individuals
with copies of their protected healthinformation. The fee may include only
the cost of copying (including supplies
and labor) and postage, if the patient
requests that the copy be mailed. If thepatient has agreed to receive a summaryor explanation of his or her protected

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

health information, the covered entity
may also charge a fee for preparation of
the summary or explanation. The fee
may not include costs associated withsearching for and retrieving therequested information.
On July 14, 2010, the Department
issued a proposed rule to implement
most of the privacy and security
provisions of the HITECH Act, which
included provisions to strengthen an
individual’s right to receive anelectronic copy of his or her protected
health information, where suchinformation is maintained electronicallyin one or more designated record sets.
Specifically, the proposed rule would
require in such cases that the covered
entity provide the individual withaccess to the electronic information in
the electronic form and format
requested by the individual, if it isreadily producible in such form andformat, or, if not, in a readable
electronic form and format as agreed toby the covered entity and theindividual. Additionally, theDepartment proposed changes toaddress and clarify the fees associatedwith the provision of electronic access.
The Department proposed to allow
reasonable cost-based fees reflecting thecosts of labor for creating the electronic
copy of the information and of supplies,
such as CDs, if the individual requests
that the electronic copy be provided on
portable media. HIPAA covered
laboratories would be required tocomply with the Privacy Rule’s
provisions regarding form of accessprovided and fees, as they exist
currently and then are ultimately
modified by a final rule implementing
the HITECH Act. With respect to theprovision of electronic access, covered
entities that have electronic reporting
capabilities are expected to provide theindividual with a machine readable orother electronic copy of the individual’s
protected health information. (Theindividual always retains the right torequest and receive a paper copy, if
desired.) The Department considers
machine readable data to mean digital
information stored in a standard format
enabling the information to beprocessed and analyzed by computer.
For example, this would include
providing the individual with anelectronic copy of the protected healthinformation in the format of MS Word
or Excel, text, HTML, or text-based PDF,
among other formats. We request
comment on the ability of laboratories toprovide electronic copies of protected
health information in machine readable
or other electronic formats.
Under our proposal, § 164.524 would
preempt any contrary provisions of

PO 00000

Frm 00055

Fmt 4702

Sfmt 4702

56715

State law. HIPAA, at section 1178 of theSocial Security Act (the Act), provides
that the administrative simplification
regulations (‘‘the HIPAA Rules’’)preempt any contrary provisions ofState law. A provision of State law is‘‘contrary’’ to a provision of the HIPAA
Rules if a covered entity would find it
impossible to comply with both theState and Federal requirements; or theprovision of State law stands as an
obstacle to the accomplishment andexecution of the full purposes andobjectives of part C of title XI of the Act
or section 254 of Public Law 104–191,
as applicable.
Pursuant to section 264(c)(2) of
HIPAA, the HIPAA Privacy Rule
includes an exception from this general
preemption if ‘‘the provision of Statelaw relates to the privacy of
individually identifiable healthinformation and is more stringent thana standard, requirement, or
implementation specification adopted
under subpart E of part 164 of thissubchapter.’’ With respect to a State law
pertaining to an individual’s right toaccess his or her protected healthinformation, a State law is more
stringent than the Privacy Rule if theState law ‘‘permits greater rights ofaccess or amendment, as applicable’’(§ 160.202).
A number of States have laws thatprohibit a laboratory from releasing atest report directly to the patient or thatprohibit the release without the ordering
provider’s consent. If adopted, theproposed changes to § 164.524 would
preempt any contrary State laws thatprohibit the HIPAA-covered laboratoryfrom directly providing access to theindividual.
We note that covered entities,
including CLIA and CLIA-exempt
laboratories under our proposal, mustsatisfy the verification requirement of§ 164.514(h) before providing an
individual with access. Thisrequirement is consistent with theproposed change to the CLIA
requirements, which would allow alaboratory to provide patients withaccess to test reports when thelaboratory can authenticate that the test
report pertains to the patient. We
recognize that a laboratory may receivea test order with only an anonymous
identifier and thus may be unable toidentify the individual who is the
subject of the test report. It is not ourintent to discourage such anonymous
testing. In this case, the laboratory thatreceives a request for access from anindividual but cannot verify that therequesting individual is the subject of atest report is under no obligation toprovide access.

E:\FR\FM\14SEP1.SGM

14SEP1

56716

Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

We propose that, if finalized, HIPAAcovered laboratories would be required
to comply with the revised § 164.524 by
no later than 180 days after the effective
date of the final rule. The effective dateof the final rule would be 60 days after
publication in the Federal Register, solaboratories would have a total of 240
days after publication of the final rule
to come into compliance. This
compliance period is consistent withsection 1175(b)(2) of the Act, which
provides that the Department must
provide covered entities with at least
180 days to come into compliance withmodifications to standards under the
HIPAA Rules. This compliance periodalso is consistent with our proposedchanges to § 160.105 found in the July
14, 2010 proposed rule (75 FR 40868).
That proposal would establish at§ 160.105 a 180-day compliance period
for future modifications to the HIPAA
Rules, unless otherwise specificallyprovided.
III. Collection of Information
Requirements
Under the Paperwork Reduction Act
of 1995, we are required to provide 60day notice in the Federal Register andsolicit public comment before acollection of information requirement is
submitted to the Office of Management
and Budget (OMB) for review andapproval. In order to fairly evaluate
whether an information collection
should be approved by OMB, section
3506(c)(2)(A) of the Paperwork
Reduction Act of 1995 requires that wesolicit comment on the following issues:• The need for the informationcollection and its usefulness in carryingout the proper functions of our agency.
• The accuracy of our estimate of theinformation collection burden.
• The quality, utility, and clarity of
the information to be collected.
• Recommendations to minimize theinformation collection burden on theaffected public, including automatedcollection techniques.
We are soliciting public comment oneach of these issues for the informationcollection requirements (ICRs) in the
proposals for 42 CFR 493.1291.
Except as provided in § 493.1291(l),test reports must be released only toauthorized persons and, if applicable,
the individuals (or their personal
representative) responsible for using thetest reports and, in the case of areference laboratory, the laboratory that
initially requested the test. Under§ 493.1291(l), the laboratory may, uponrequest by the patient, provide access tothe patient’s test reports that thelaboratory can identify as belonging tothat patient. The CLIA regulations
would not require that CLIA-certified
laboratories provide this access—rather,
the entities would be allowed to provide
for access. We note, however, that CLIAcertified laboratories generally arecovered entities under the HIPAA
Privacy Rule. That rule also provides forpatients’ access to their records. CLIAcertified laboratories will need to ensurethat their practices conform to CLIA andHIPAA requirements.
We have prepared the Paperwork
Reduction Act and the Regulatory
Impact Analysis that represents thecosts and benefits of the proposed rule
based on analysis of identified variables
and data sources needed for this
proposed change. We identified known
data elements (Table 1) and madeassumptions on elements where asource could not be identified (Table 2).
Our assumptions are based on internal
discussions and consultation with two
reference laboratories. We request
comments on the assumptions used andanalyses provided.

TABLE 1—SUMMARY OF KNOWN DATA ELEMENTS
Variable

Data element

States/territories where
HIPAA will pre-empt State
Law.1

20

States/territories where laboratories are impacted.

39

Laboratories impacted ...........

mstockstill on DSK4VPTVN1PROD with PROPOSALS

Source22,671

Test results in impacted laboratories.
Hourly salary of clerical level
employee to process test
request.

6,108,678,992

Hourly salary of managementlevel employee to determine policy.

$50.06$30.09Determination of this finding is based on two reports as listed here:
1. Privacy and Security Solutions for Interoperable Health Information Exchange, Releasing Clinical Laboratory Test Results; Report on Survey of State Laws preparedby Joy Pritts, JD, for the Agency for Healthcare Research and Quality and Office of
the National Coordinator August 2009; RIT Project Number 0209825.000.015.100(accessed July 15, 2010).
2. Electronic Release of Clinical Laboratory Results: A Review of State and Federal
Policy prepared by Kitty Purington, JD, for the California Healthcare Foundations
January 2010 (Accessed July 15, 2010).1)
Determination of this finding is based on two reports as listed here:
1. Privacy and Security Solutions for Interoperable Health Information Exchange, Releasing Clinical Laboratory Test Results; Report on Survey of State Laws preparedby Joy Pritts, JD, for the Agency for Healthcare Research and Quality and Office of
the National Coordinator August 2009; RIT Project Number 0209825.000.015.100(Accessed July 15, 2010).
2. Electronic Release of Clinical Laboratory Results: A Review of State and Federal
Policy prepared by Kitty Purington, JD, for the California Healthcare Foundations
January 2010 Accessed July 15, 2010).
Data from CLIA Online Survey Certification and Reporting database (OSCAR) databaseaccessed July 8, 2010.
Data from OSCAR database accessed July 8, 2010.
2011 salary/wages and benefits—use 2010 salary/wages and benefits of $29.25 obtained
from the U.S. Bureau of Labor Statistics, Economic News Release, March 2010 U.S.—
Total employer costs per hour worked for employee compensation: Civilian workers;
Occupational
Group:
Service-providing
at(http://www.bls.gov/news.release/ecec.t01.htm) and adjusts annually by 2.78 percent to reflect an average increase intotal compensation costs from 2005–2009.
2011 salary/wages and benefits—use 2010 salary/wages and benefits of $48.66 obtained
from the U.S. Bureau of Labor Statistics, Economic News Release, March 2010 U.S.—
Total employer costs per hour worked for employee compensation: Civilian workers;
Occupational
Group:
Service-providing
at(http://www.bls.gov/news.release/ecec.t01.htm) and adjusts annually by 2.78 percent to reflect an l average increase intotal compensation costs from 2005–2009.

1 Note that there may be circumstances where a laboratory is able to comply with both HIPAA and the State law.

VerDate Mar<15>201018:40 Sep 13, 2011

Jkt 223001

PO 00000

Frm 00056

Fmt 4702

Sfmt 4702

E:\FR\FM\14SEP1.SGM

14SEP1Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

56717

TABLE 2—SUMMARY OF ASSUMPTIONS
Variable

Low

Number of test results per test report .....................................................
Percentage of patients requesting test report .........................................
Time required to process request for test report ....................................

10 test results ................................
0.05% .............................................
10 minutes .....................................

We determined that the impacted
CLIA-certified laboratories can be
broken down into four categories:
laboratories in States and territories
where there is no law regarding who canreceive test reports (N = 26), laboratories
in States and territories where test
reports can only be given to the provider(N = 13), laboratories in States andterritories that allow test reports to go
directly to the patient through someHighmeans or mechanism (N = 9), andlaboratories in States and territories thatallow the test reports to go to the patientwith provider approval (N = 7) (seeTable 3 for a list of states and territories
by category). Of these four categories,
we believe that laboratories in the 39
States and territories where there iseither no law regarding receipt of test
reports or where reports can only go to
the provider would be affected by the

20 test results.
0.50%.
30 minutes.

proposals contained in this rulemaking.
Laboratories in the remaining categories
would most likely have existingprocedures in place to respond topatient requests for test reports, whereas
the laboratories in the first two
categories would most likely not haveprocedures in place and would have todevelop mechanisms for handling theserequests and providing access.

TABLE 3—IMPACT OF PROPOSED RULE CHANGE ON LABORATORIES
Impacts laboratories
No State law

mstockstill on DSK4VPTVN1PROD with PROPOSALS

Alabama
AlaskaArizona
Colorado
Guam
Idaho
Indiana
Iowa
KentuckyLouisiana
Minnesota
Mississippi
Montana
Nebraska
New Mexico
North Carolina
North Dakota
N. Mariana Islands
Ohio
OklahomaSouth Carolina
South Dakota
Texas
Utah
Vermont
Virgin Islands

Allows test reports only toproviderArkansas
Georgia
Hawaii
Illinois
KansasMaine
MissouriPennsylvania
Rhode Island
Tennessee
Washington
Wisconsin
Wyoming

The CMS Online Survey,
Certification, and Reporting (OSCAR)
database indicates that there are a totalof 22,671 laboratories which provide
approximately 6.1 billion tests annually(see Table 4) in the 39 States andterritories impacted by this rule. We
assume Certificate of Waiverlaboratories and Certificate of PPM
laboratories would not be impacted
because the tests are usually performedin these sites during a patient’s visit. We
assume that the physician or health

VerDate Mar<15>2010

17:16 Sep 13, 2011

Does not impact laboratories

Jkt 223001

Allows test reports to patient
DelawareDistrict of Columbia
MarylandNew Hampshire
New Jersey
NevadaOregonPuerto Rico
West Virginiapractitioner would inform the patient of
those results during the visit, and weanticipate that the patient would ask
that person with whom they interacted
as opposed to the laboratory, if they
have reason to seek copies of the test
report in the future. We request publiccomments on the potential impact of
this rule on Certificate of Waiver andCertificate of PPM laboratories.
If the proposals contained in this rule
are finalized, most of these 22,671
laboratories will need to develop
processes and procedures to provide

PO 00000

Frm 00057

Fmt 4702

Sfmt 4702

Allows test reports to patient with
provider approval
California
Connecticut
FloridaMassachusetts
Michigan
New York
Virginia

direct patient access to test reports.
However, we recognize that some ofthese 22,671 laboratories may not becovered entities under HIPAA (because
they do not conduct covered health caretransactions electronically, for example,
filing electronic claims for payment)
and therefore would not be required toprovide direct patient access. We do nothave information on the number oflaboratories that are not covered entities
under HIPAA and invite comment on
this issue.

E:\FR\FM\14SEP1.SGM

14SEP1

56718Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

TABLE 4—NUMBER OF IMPACTED LABORATORIES AND TESTS PER YEAR IN THE 39 AFFECTED STATES AND TERRITORIES
Number oflaboratories

State

Number of tests

Alabama ...................................................................................................................................................
Alaska ......................................................................................................................................................
Arizona .....................................................................................................................................................
Arkansas ..................................................................................................................................................
Colorado ..................................................................................................................................................
Georgia ....................................................................................................................................................
Guam .......................................................................................................................................................
Hawaii ......................................................................................................................................................
Idaho ........................................................................................................................................................
Iowa .........................................................................................................................................................
Illinois .......................................................................................................................................................
Indiana .....................................................................................................................................................
Kansas .....................................................................................................................................................
Kentucky ..................................................................................................................................................
Louisiana ..................................................................................................................................................
Maine .......................................................................................................................................................
Minnesota ................................................................................................................................................
Missouri ....................................................................................................................................................
N. Mariana Isl. .........................................................................................................................................
Mississippi ................................................................................................................................................
Montana ...................................................................................................................................................
N. Carolina ...............................................................................................................................................
N. Dakota .................................................................................................................................................
Nebraska ..................................................................................................................................................
New Mexico .............................................................................................................................................
Ohio .........................................................................................................................................................
Oklahoma .................................................................................................................................................
Pennsylvania ............................................................................................................................................
Rhode Island ............................................................................................................................................
S. Carolina ...............................................................................................................................................
S. Dakota .................................................................................................................................................
Tennessee ...............................................................................................................................................
Texas .......................................................................................................................................................
Utah .........................................................................................................................................................
Vermont ...................................................................................................................................................
Virgin Islands ...........................................................................................................................................
Washington ..............................................................................................................................................
Wisconsin .................................................................................................................................................
Wyoming ..................................................................................................................................................

851
95
563
513
498
1,172
12
124
231
536
1,077
640
442
697
666
138
831
665
3
617
157
1,424
139
372
190
1,112
531
1,095
110
709
211
1,070
3,211
315
81
12
727
748
86

243,512,093
8,456,680
194,894,073
66,845,370
125,645,501
194,786,593
2,055,709
32,566,029
25,623,535
75,797,879
497,900,106
172,798,521
239,488,953
110,373,950
119,794,280
32,909,637
145,496,862
163,380,564
88,177
74,187,598
24,428,257
288,449,078
19,783,502
64,790,081
42,105,436
345,544,798
108,564,207
487,529,546
35,429,909
92,320,737
664,345,948
219,535,503
783,048,259
61,663,359
9,894,769
1,902,023
176,535,389
146,846,804
9,359,277

Totals ................................................................................................................................................

22,671

6,108,678,992

mstockstill on DSK4VPTVN1PROD with PROPOSALS

Data from the CLIA OSCAR database accessed on 7/8/2010.
The ‘‘Number of tests’’ is self reported by the laboratory without validation.
Includes only moderate and high complexity laboratories issued a CLIA Certificate of Registration, Certificate of Compliance, or Certificate of
Accreditation.

We assume that the development of
the mechanisms to provide patient
access to laboratory test reports would
be a one-time burden and that eachlaboratory would develop its own
unique policies and procedures toaddress patient access or adopt
mechanisms/procedures developed byconsultants or associations representing
laboratories. We assume a one-timeburden of 2–9 hours to identify theapplicable legal obligations and todevelop the processes and proceduresfor handling patient requests for accessto test reports. While we provide a rangeof burden estimates in this proposed
rule, for purposes of OMB review andapproval we will submit burden
estimates based on 9 hours. We also
assume an hourly rate for a management

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

level employee to be $50.06 (see Table
1).
The range of costs for laboratories todevelop the necessary processes andprocedures for handling patient requests
would be:2 hours × $50.06 per hour = $100.12 perlaboratory × 22, 671 laboratories =$2,269,821
9 hours × $50.06 per hour = $450.54 perlaboratory × 22, 671 laboratories =$10,214,192
The burden associated withresponding to test report requests isdependent upon the total number of test
reports that exist in affectedlaboratories, the percent of the resultsthat would be requested and the cost of
producing these reports for thoseindividuals who ask for direct access.

PO 00000

Frm 00058

Fmt 4702

Sfmt 4702

Laboratory test reports are commonly
understood to contain multiple test
results with many laboratory tests beingordered as panels of tests. Eachlaboratory may have their own uniquetest report panels which may containanywhere from 1 to 20 individual test
results.
Using a range of 10 to 20 test results
in a test report, we estimated the annual
number of test reports that may berequested to be:
6,108,678,992 tests per year/20 tests perreport = 305,433,950 test reports/
year
6,108,678,992 tests per year/10 tests perreport = 610,867,899 test reports/
year
We are unaware of any data thatwould provide a reasonable estimate forthe number of patients who would

E:\FR\FM\14SEP1.SGM

14SEP1

56719Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules
request test reports from laboratories ifthey are available. We are soliciting
public comments in order to better
estimate the number of patient requests
a laboratory might receive. We assume
a range of 1 in 2,000 patients (0.05%) to
1 in 200 patients (0.50%) would request
direct access to his or her test report.
Using these figures the range of thenumber of patient requests per year
would be:305,433,950 test reports per year × .0005= 152,717 patient requests per year
610,867,899 test reports per year × .005
= 3,054,339 patient requests per
year
The processing of a patient request fora test report generally covers steps from
actual receipt of the patient’s request to
the delivery of the report anddocumentation of the delivery. Requests
for laboratory results are usuallyhandled by staff that is not managementlevel. Due to the lack of data thatindicates the amount of time it takes forstaff to process a test report request, we
assume a range of 10 to 30 minutes tohandle a request from start to finish. We
also assume an hourly rate for a clericallevel employee to be $30.09 (see Table
1)).
Using these figures, we calculated therange of costs to produce one test report:$30.09 per hour/60 minutes per hour =$0.50/minute$0.50 per minute × 10 minutes = $5.00$.50 per minute × 30 minutes = $15.00
We then multiplied this range by therange of the anticipated number ofpatient requests to obtain a range ofcosts to provide the patient requests per
year:
152,717 patient requests per year ×$5.00 = $763,585
3,054,339 patient request per year ×$15.00 = $45,815,092
We then added the cost to develop theprocesses and procedures for handling
patient requests to the cost to provide
the test reports to obtain the range of thetotal costs to laboratories to provide
patients with his or her test report uponrequest in 2011:$2,269,821 cost to develop process +$763,585 cost to provide test reports= $3,033,405$10,214,192 cost to develop process +$45,815,092 cost to provide test
reports = $56,029,285 annual cost(undiscounted 2010 dollars)

mstockstill on DSK4VPTVN1PROD with PROPOSALSTABLE 5—ESTIMATED ANNUAL RECORDKEEPING AND REPORTING BURDEN
Regulation section(s)OMBControl No.

Respondents

Responses

Burden per
response(hours)Total annual
burden(hours)Hourly labor
cost ofreporting($)

42 CFR 493.1291 .......
45 CFR 493.1291 .......

0938–New
0938–New

22,671
3,054,339

22,671
3,054,339

9.5

204,039
1,527,170

50.06
30.09

10,214,192
45,815,092

0
0

10,214,192
45,815,092

Total .....................

..................

3,077,010

3,077,010......................

1,731,209......................

......................

......................

56,029,285

We have provided an analysis ofburden based on available informationand certain assumptions. We request
comments from laboratories thatcurrently provide direct access to test
reports for patients as to how theyhandle these requests (for example,
through a Web portal, fax, hard-copy,
with or without fees, etc) and the extent
to which patient requests impact
business operations. The Department
solicits comments additionally on bestpractices in the direct provision ofpatients’ laboratory results. We also
request comment on the burdens
associated with providing electronic
formats as requested by individuals,
machine readable or otherwise.
To obtain copies of the supportingstatement and any related forms for the
proposed paperwork collections
referenced above, access CMS’ Web site
address at http://www.cms.hhs.gov/
PaperworkReductionActof1995, or Email your request, including youraddress, phone number, OMB number,and CMS document identifier, toPaperwork@cms.hhs.gov, or call theReports Clearance Office on (410) 786–
1326.
If you comment on these informationcollection and recordkeeping estimates,
please do either of the following:
1. Submit your comments
electronically as specified in the

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

ADDRESSES section of this proposed rule;or
2. Submit your comments to the
Office of Information and Regulatory
Affairs, Office of Management andBudget, Attention: CMS Desk Officer,
CMS–2319–P, Fax: (202) 395–6974; orE-mail: OIRA_submission@omb.eop.gov.
IV. Response to Comments
Because of the large number of publiccomments we normally receive onFederal Register documents, we are notable to acknowledge or respond to them
individually. We will consider allcomments we receive by the date andtime specified in the DATES section ofthis preamble, and, when we proceedwith a subsequent document, we will
respond to the comments in thepreamble to that document.
V. Regulatory Impact Analysis
A. Overall Impact
We have examined the impacts of thisrule as required by Executive Order
12866 on Regulatory Planning andReview (September 30, 1993), Executive
Order 13563 on Improving Regulation
and Regulatory Review (February 2,2011), the Regulatory Flexibility Act(RFA) (September 19, 1980, Pub. L. 96–354), section 1102(b) of the Social
Security Act, section 202 of the
Unfunded Mandates Reform Act of 1995
(March 22, 1995; Pub. L. 104–4),

PO 00000

Frm 00059

Fmt 4702

Sfmt 4702

Total labor
cost ofreporting($)

Total capital/
maintenance
costs
($)

Total cost($)

Executive Order 13132 on Federalism(August 4, 1999), and the Congressional
Review Act (5 U.S.C. 804(2)).
Executive Orders 13563 and 12866
direct agencies to assess all costs andbenefits of available regulatory
alternatives and, if regulation isnecessary, to select regulatory
approaches that maximize net benefits(including potential economic,
environmental, public health and safety
effects, distributive impacts, andequity). Executive Order 13563
emphasizes the importance ofquantifying both costs and benefits, ofreducing costs, of harmonizing rules,
and of promoting flexibility. This rulehas been designated a ‘‘significant
regulatory action’’ although noteconomically significant, under section
3(f) of Executive Order 12866.
Accordingly, the rule has been reviewed
by the Office of Management andBudget.
Laboratories regulated under CLIA
that do not currently provide patientswith an opportunity to receive, uponrequest, a copy of their laboratory test
report (defined in CLIA regulations at§ 493.1291) would be affected by this
proposed rule. According to CMSOSCAR database accessed on July 8,
2010, there are 214,875 laboratories in
the United States that are subject to
CLIA. OSCAR is a data network
maintained by CMS in cooperation with

E:\FR\FM\14SEP1.SGM

14SEP1

mstockstill on DSK4VPTVN1PROD with PROPOSALS

56720

Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

the State surveying agencies andaccrediting organizations that provides acompilation of all the data elements
collected during inspection surveys
conducted at laboratories for the
purpose of certification for participationin the Medicare and Medicaid programs.
Of the total CLIA-certified laboratories
identified in the OSCAR database, we
believe approximately 192,204, or 90
percent, of these would not be impacted
by this change because they performtesting either under a Certificate of
Waiver or Certificate of Provider
Performed Microscopy (PPM) or they
are located in States that already allow
the laboratory to provide patient accessto test reports, either directly or with
provider approval. Removing the step inwhich the provider grants permission to
the laboratory should not pose anadditional impact on the laboratory, as
we believe these laboratories alreadyhave processes in place to provide
patients access to test reports once that
permission is received.
We expect that 22,671 laboratories
located in the 39 states and territories
identified in Table 3 as having no Statelaw or a State law that provides test
reports only to the provider would be
impacted by the changes outlines in this
proposed rule.
We believe that, if finalized, this
proposed rule would not constitute an
economically significant rule because
we estimate the range of overall annual
costs that would be expended by theaffected laboratories would be less than$100 million for 2011.
The RFA requires agencies to analyze
options for regulatory relief of small
entities, if a rule has a significant impact
on a substantial number of small
entities. For purposes of the RFA, we
assume that the great majority of
medical laboratories are small entities,
either by virtue of being nonprofit
organizations or by meeting the SBA
definition of a small business by having
revenues of less than $13.5 million inany 1 year. We believe at least 83
percent of medical laboratories qualify
as small entities based on theirnonprofit status as reported in theAmerican Hospital Association Fast
Fact Sheet updated June 24, 2010(http://www.aha.org/aha/resourcecenter/Statistics-and-Studies/Fast_
Facts_Nov_11_2009.pdf.)
Other options for regulatory relief ofsmall businesses as discussed in section
E of this proposed rule, were
determined not to be feasible andtherefore these options were notanalyzed for this proposed rule. We
believe any alternative to allowing thelaboratory to provide patient access totest reports would be counterproductive

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

to HHS efforts to provide patientcentered healthcare. We are unaware of
any instances in which the changes
included in this proposed rule would
affect health care entities operated bysmall government jurisdictions. We arerequesting public comments in this area,
particularly from laboratories in state
health departments (including Newborn
screening), prisons, school clinics orstate universities that would be
impacted, to assist us in making thisdetermination in the final rule.
Section 1102(b) of the Social Security
Act also requires us to prepare aregulatory impact analysis if a rule may
have a significant impact on theoperations of a substantial number ofsmall rural hospitals. This analysis must
conform to the provisions of section 603
of the RFA. For purposes of section
1102(b) of the Act, we define a small
rural hospital as a hospital that is
located outside of a metropolitan
statistical area and has fewer than 100
beds. We do not expect this proposed
rule would have a significant impact on
small rural hospitals. The proposed rulewould only apply to laboratories. If asmall rural hospital were to operate its
laboratory such that it would have to
adopt means of complying with these
proposed provisions, we anticipate that
it would require minimal effort to put
policies and procedures in place torespond to patient requests to thelaboratory as we expect that the
cahospital would already haveprocedures in place for responding topatient access requests for hospitalrecords under the HIPAA Privacy Rule.
We believe that these existing policies
and procedures should be easy totranslate for use in direct accessrequests to hospital-operated
laboratories. Therefore, the Secretary
has determined that this proposed rule,
if finalized, would not have a significant
impact on the operations of a substantial
number of small rural hospitals.
Section 202 of the Unfunded
Mandates Reform Act of 1995 (UMRA)
also requires that agencies assess
anticipated costs and benefits before
issuing any rule whose mandates
require spending in any 1 year of $100
million in 1995 dollars, updated
annually for inflation. In 2011, thatthreshold is approximately $136
million. We do not anticipate this
proposed rule would impose an
unfunded mandate on states, tribal
governments, or the private sector of
more than $136 million annually. We
request comments from States, tribal
governments, and the private sector on
this assumption.

PO 00000

Frm 00060

Fmt 4702

Sfmt 4702

Executive Order 13132 establishes
certain requirements that an agency
must meet when it promulgates a
proposed rule (and subsequent finalrule) that imposes substantial direct
requirements and costs on state andlocal governments, preempts State law,or otherwise has Federalism
implications.
The proposed changes to the CLIA
regulations at § 493.1291 would nothave a substantial direct effect on Stateand local governments, preempt State
law, or otherwise have a Federalism
implication and there is no change inthe distribution of power andresponsibilities among the various
levels of government. We believe that
this change is compatible with existing
State law for 35 States and territories asshown in Table 6. Of the 35, we believethat nine already allow the laboratory torelease test reports directly to thepatient. In 26 States and territories, we
believe that the licensing statutes andregulations are silent with respect to
who is authorized to receive laboratory
test reports. If finalized, the CLIA
regulations will allow laboratories inthese States and territories to provide,
upon a patient’s request, direct access tothe patient’s identifiable test reports.
The Federalism implications of thePrivacy Rule were assessed as required
by Executive Order 13132 andpublished as part of the preamble to thefinal rule on December 28, 2000 (65 FR
82462, 82797). Regarding preemption,
though the proposed changes to thePrivacy Rule will preempt a number ofState laws (see Table 6, below), thispreemption of State law is consistent
with the preemption provision of the
HIPAA statute. The preamble to thefinal Privacy Rule explains that the
HIPAA statute dictates the relationshipbetween State law and Privacy Rulerequirements, and the rule’s preemption
provisions do not raise Federalism
issues.
We do not believe that this rule would
impose substantial direct compliancecosts on State and local governmentsthat are not required by statute. We do
not believe that a significant number oflaboratories affected by these proposals
are operated by State or local
governments. Therefore, the proposed
modifications in these areas would notcause additional costs to State and local
governments.
In considering the principles in andrequirements of Executive Order 13132,
the Department has determined that this
proposed modification to the Privacy
Rule will not significantly affect therights, roles and responsibilities of theStates.

E:\FR\FM\14SEP1.SGM

14SEP1Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

56721

TABLE 6—EXISTING LAWS IN STATES/TERRITORIES PERTAINING TO TEST REPORTS
HIPAA will preempt State law
Allows test reports only to provider

Allows test reports to patient with
provider approval

Arkansas
Georgia
Hawaii
Illinois
KansasMaine
MissouriPennsylvania
Rhode Island
Tennessee
Washington
Wisconsin
Wyoming

California
Connecticut
FloridaMassachusetts
Michigan
New York
Virginia

B. Anticipated Effects

mstockstill on DSK4VPTVN1PROD with PROPOSALS

Compatible with State law

The current CLIA regulations andrelated laws of the States and territories
pose potential barriers to the laboratoryexchange of health care information(test reports) directly with the patient.
These proposed regulatory changes
would amend § 493.1291(f) and add§ 493.1291(l) to the CLIA regulations
and also amend § 164.524 of the Privacy
Rule. These changes are being made insupport of HHS’ efforts towardachieving patient-centered and healthIT-enabled healthcare and would allow
patients direct access to their laboratory
test reports from a laboratory without
having to go to their healthcare provider
to obtain this information.
This proposed rule includes changes
that, if finalized, would impact
laboratories in 39 States and territories(Table 3) where State law does not
permit the laboratory to provide test
reports directly to the patient. For thelaboratories in the remaining 16 States
and territories where the laboratory isallowed to provide the test report to thepatient either directly or after provider
approval, there is no impact based on
this proposed rule.
C. Costs
Although data are not available tocalculate the estimated costs andbenefits that would result from these
proposed regulatory changes, we are

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

Allows test reports to patient
DelawareDistrict of Columbia
MarylandNew Hampshire
New Jersey
NevadaOregonPuerto Rico
West Virginia

providing an analysis of the potential
impact based upon available
information and certain assumptions.
We assume that the costs and benefitsof the change to the HIPAA Privacy Rulewould not be separate from the costs
and benefits associated with the changes
to the CLIA regulations. We request
comments on how laboratories would
handle patient requests for laboratory
test reports and the associated costs.
These proposed regulatory changes, if
finalized, are anticipated to have thefollowing associated costs and benefits:• The impacted laboratories may
require additional resources to process
the patient requests for test reports andto provide the test reports to thepatients.
• Patients will benefit from having
direct access to their laboratory test
results. (See section D below).
1. Quantifiable Impacts
We assume that, if this proposed rule
is finalized, laboratories that are issued
a CLIA Certificate of Registration,
Certificate of Compliance, or Certificateof Accreditation in the 39 States andterritories identified in Table 3 will beallowed to provide patients with a copyof their test report upon request. The
OSCAR database includes 22,671
laboratories in the 39 States andterritories that would be impacted bythis proposed change and the

PO 00000

Frm 00061

Fmt 4702

Sfmt 4702

No State law
Alabama
AlaskaArizona
Colorado
Guam
Idaho
Indiana
Iowa
KentuckyLouisiana
Minnesota
Mississippi
Montana
Nebraska
New Mexico
North Carolina
North Dakota
N. Mariana Islands
Ohio
OklahomaSouth Carolina
South Dakota
Texas
Utah
Vermont
Virgin Islands

corresponding number of annual tests inthese laboratories is approximately 6.1
billion as shown in Table 4. Data are notavailable for estimating the number oftest results reported per test report.
However, it is common knowledge thatthe majority of test reports containmultiple test results. Tests are
frequently ordered as panels of
individual tests. For example, according
to 2008 CMS reimbursement data, threeof the four most frequently ordered tests
in the Medicare outpatient setting arepanels of multiple individual tests,
some of which may contain up to 20
tests. As part of a medical encounter,
frequently more than one panel isordered per patient, and a test report
could contain a large number ofindividual test results. Therefore, for the
purposes of this analysis, an assumed
range of 10 to 20 is used to represent the
average number of test results per test
report. Applying this range to the total
number of annual tests (6,108,678,992)
from Table 4, the estimated number of
total annual test reports ranges from alow of 305,433,950 to a high of
610,867,899.
There are no data available to estimate
the proportion of test reports that would
be requested by patients from thelaboratories impacted by these proposed
provisions once this rule is finalized.
We welcome data pertaining to thenumber of test reports requested from

E:\FR\FM\14SEP1.SGM

14SEP1

56722Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

laboratories that are already providing
test reports upon request so that wewould be better able to provide a moreaccurate estimate in the final rule. For
the purposes of this analysis, we assume
that many patients would still prefer toobtain their laboratory result
information from their healthcare
provider, who would also be able toprovide interpretation of the test results,
and thus an assumed range of from 1 in
2,000 (0.05 percent) to 1 in 200 (0.50
percent) is used to represent the
proportion of test reports requested.
Applying this range to the number of
estimated annual test reports(305,433,950 to 610,867,899) yields anestimated annual number patient
requests ranging from 152,717 to
3,054,339.
Processing a request for a test report,
either manually or electronically, would
require completion of the following
steps: (1) Receipt of the request from thepatient; (2) authentication of theidentification of the patient; (3) retrievalof test reports; (4) verification of how
and where the patient wants the test
report to be delivered and provision of
the report by mail, fax, e-mail or otherelectronic means; and (5)documentation of test report issuance.
We estimated the total time to processeach test report request to be in therange of 10 minutes to 30 minutes. Thisestimate for a range of total time

includes estimates for a range of time foreach of the five steps listed above. The
time needed to complete each step isdependent on the capabilities of thelaboratory, such as whether manual or
automated processes are available, andthe desired method of communicationof test reports to the individual patientas listed in step 5. We welcomecomments based on data fromlaboratories that already provide test
reports to patients upon request. We
also request comment on the burdens
associated with providing electronic
formats as requested by individuals,
machine readable or otherwise.
To determine the cost of processing
test reports we used an hourly rate fora clerical level employee of $30.09 (seeTable 1) and determined the costs toprocess one test report to be $5.00 if it
took 10 minutes and $15.00 if it took 30
minutes. We multiplied the range forthe number of patient requests, 152,717
to 3,054,339 by $5.00 and $15.00. The
estimated annual cost to process all test
report requests in 2011 ranges from$763,585 to $45,815,092.
The analysis also assumed each of theestimated 22,671 laboratories to be
impacted by this rule (Table 3) would
need to develop and implement a policy
and process to receive and respond topatient requests as discussed above. To
estimate the initial, one-timedevelopment cost, it is assumed torequire laboratory management staff
time ranging from a low of 2 hours toa high of 9 hours per laboratory. To
convert the number of hours to an
estimated cost per laboratory, weapplied the rate of $50.06 (see Table 1)
to the assumed 2 to 9 hour time range
yields an estimated cost per laboratory
ranging from $100.12 to $450.54, which
when applied to the estimated 22,671
laboratories impacted results in a total
estimated one-time development cost
ranging from $2,269,821 to $10,214,192.
Table 7 shows the total estimatedrange of annual costs for the proposedchange in undiscounted 2010 dollars
and discounted at 3 percent and 7
percent to translate expected benefits or
costs in any given future year into
present value terms. To calculate thetotal estimated costs in 2011, we added
the cost to develop the necessary
policies and processes (which would
only be applicable in the first year) andthe cost of responding to test report
requests. These costs total between $3
million and $56 million for 2011. As
subsequent years would only entail thecosts associated with processing
requests, we simply took the 2011
values for the cost of responding to test
reports and applied the same inflation
factor used in Table 1 for the hourly rate
calculations. The resulting values can befound in Table 7.

TABLE 7—TOTAL ESTIMATED ANNUAL COSTS OF PATIENT TEST REPORT REQUESTS (POLICY DEVELOPMENT AND
PROCESSING)
Undiscounted(Base year: 2010 $)mstockstill on DSK4VPTVN1PROD with PROPOSALS

2011 .................................
2012 .................................
2013 .................................
2014 .................................
2015 .................................

High

Low

High

Low

High

$3,033,405
787,919
810,572
833,876
857,850$56,029,285
47,275,146
48,634,307
50,032,543
51,470,978$2,945,054
742,689
741,788740,888739,989$54,397,364
44,561,359
44,507,280
44,453,266
44,399,318$2,834,958
688,199
661,668
636,160
611,635$52,363,818
41,291,943
39,700,081
38,169,587
36,698,096

2. Non-Quantifiable Impacts
The burden in this proposed rulewould be primarily on laboratories toprovide the laboratory test reports whenrequested by the patient; however, there
may be some impacts on the healthcare
provider’s office. If the patient does notknow where the provider sent the test,

17:16 Sep 13, 2011

Discounted at
7 percent

Low

Laboratories would be able to offset
some of these costs pursuant to§ 164.524(c)(4) of the HIPAA Privacy
Rule, which permits covered entities toimpose on the patient a reasonable, costbased fee for providing access to theirhealth information, including the cost of
supplies for and labor of copying therequested information.

VerDate Mar<15>2010

Discounted at
3 percentJkt 223001

the provider may need to provide
laboratory contact information to thepatient so they may request the test
report. We assume that notification of
the laboratory name and contact
information could be provided in as
little as 30 seconds; however there are
no data to confirm this and we thus
request comment on the issue. We also
note that since the provider may needto provide an interpretation of the test
results, the provider may give thepatient a copy of the test report rather
than referring the patient to thelaboratory for the information.

PO 00000

Frm 00062

Fmt 4702

Sfmt 4702

D. Benefits
Although we cannot quantify the
impact on patients, we believe that it
would be positive in light of findings
from studies that focused on patient
receipt of test results from the provider.
We found several studies where greaterthan 90 percent of patients stated they
preferred being notified of all test
results, both normal and abnormal (1.
Baldwin et al. Patient preferences for
notification of normal laboratory test
results: a report from the ASIPS
Collaborative. BMC Fam Practice2005;6:11; 2. Booker et al. Patient
notification and follow-up of abnormal
test results. Arch Intern Med 1996; 327–

E:\FR\FM\14SEP1.SGM

14SEP1Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules
331; 3. Grimes et al. Patient preferences
and physician practices for laboratory
test result notification. JABFM
2009:22:6:670–676; and 4. Meza JP and
Webster DS. Patient preferences forlaboratory test result notification. Am J
Manag Care 2000; 6:1297–300). Thesesame studies reported, for both thehealthcare provider and patient, thepreferred method for receiving normal
test results was the U.S. mail and direct
phone contact from the provider was thepreferred method for abnormal test
results. These preferences may havechanged in the last 5 years given theincrease in the use of electronic
communications. Advantages reported
in these studies for the patient having
direct access to the test report include
reduced workload for the healthcare
provider’s office, reduced chance of apatient not being informed of alaboratory test result, and reduced
numbers of patients who fail to seek
appropriate medical care.

Category

E. Alternatives Considered
The proposed changes to the CLIA
regulations and the HIPAA Privacy Ruleare being proposed in support of the
Department’s efforts toward achieving
patient-centered health care. Several
alternatives were considered before
selecting the approach in this proposed
rule to provide access to laboratory test
reports upon a patient’s request. One
alternative would have been to leave theregulations as written without making
any changes. However, this option
would leave in place the restrictions onpatients’ direct access to their laboratory
test results and would therefore impede
the goal of promoting patient-centeredhealth care. Another alternative would
have been to revise the definition of‘‘authorized person’’ under CLIA to
specifically include a patient as an
authorized person. This alternative was
not considered feasible because thedefinition of ‘‘authorized person’’ in the
CLIA regulations also permits
individuals to order tests, and it defers
to State law for authorization. A lastPrimary estimate

Minimum
estimate

56723

alternative considered would have been
to require the laboratory toautomatically provide each test report
directly to each patient rather than thepermissive approach to provide patients
access to their reports upon request.
However, this alternative would have
had the potential of significantly
increasing the cost for laboratories since
100 percent of the 300 million to 500
million test reports issued annuallywould need to be provided to thepatients. As discussed earlier in thisregulatory impact analysis, we welcomecomments and the submission of dataand information on the costs andbenefits of implementation of this
proposed change so that we can conduct
a more robust assessment of thealternatives comparing incremental
costs and benefits for the final rule.
F. Accounting Statement and Table
We have prepared the following
accounting statement showing theclassification of the expendituresassociated with the provisions of this
proposed rule.

Maximum
estimate

Source citation(RIA, preamble, etc.)

BENEFITS
Monetized benefits ....................................
Annualized qualified, but unmonetized,
benefits.
(Unqualified benefits) ................................

n/a
n/a

n/a
n/a

n/a
n/a

RIA Section C2.
RIA Section C2.

n/a

n/a

n/a

RIA Section C2.

n/a
n/a
n/a
n/a
n/a
n/a

$3,033,405
787,919
810,572
833,876
857,850n/a$56,029,285
47,275,146
48,634,307
50,032,543
51,470,978
n/a

n/a

n/a

n/a

COSTS
Annualized monetized costs (2010 $):2011 ...................................................
2012 ...................................................
2013 ...................................................
2014 ...................................................
2015 ...................................................
Annualized qualified, but unmonetized,
benefits.
Qualitative (unquantified) costs ................

RIA Sec C1 (Table 9).
RIA Sec C1 (Table 9).
RIA Sec C1 (Table 9).
RIA Sec C1 (Table 9).
RIA Sec C1 (Table 9).
RIA Section C2.

TRANSFERSAnnualized monetized transfers: ‘‘onbudget’’.
From whom to whom?
Annualized monetized transfers: ‘‘offbudget’’.
From whom to whom?

n/a

n/a

n/a

n/a
n/a

n/a
n/a

n/a
n/a

n/a

n/a

n/a

mstockstill on DSK4VPTVN1PROD with PROPOSALS

Category

Effects

Effects on State, local, and/or tribal governments.
Effects on small businesses .....................
Effects on wages ......................................
Effects on growth ......................................

G. Conclusion
We estimated the cost to laboratories
to provide patients with a copy of their

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

Source Citation (RIA, preamble, etc.)

n/a

n/a

n/a

RIA Sec A (Table 4).

n/a
n/a
n/a

n/a
n/a
n/a

n/a
n/a
n/a

RIA Section A.

test reports upon request anddetermined it would cost between $3
million and $56 million in 2011. These

PO 00000

Frm 00063

Fmt 4702

Sfmt 4702

costs would diminish in subsequent
years. In addition laboratory provisionof test reports to patients may provide

E:\FR\FM\14SEP1.SGM

14SEP1

56724Federal Register / Vol. 76, No. 178 / Wednesday, September 14, 2011 / Proposed Rules

information that could benefit thepatient by reducing the chance of thepatient not being informed of alaboratory test result, reducing thenumber of patients lost to follow-up,
and benefiting health care providers by
reducing their workload in providing
laboratory test reports.
In accordance with the provisions of
Executive Order 12866, this regulation
was reviewed by the Office ofManagement and Budget.

using the test results and the laboratorythat initially requested the test.
*
*
*
*
*
(l) Upon a patient’s request, thelaboratory may provide access tocompleted test reports that, using thelaboratory’s authentication process, canbe identified as belonging to thatpatient.

List of Subjects

3. The authority citation for part 164
continues to read as follows:

42 CFR Part 493
Administrative practice andprocedure, Grant programs—health,
Health facilities, Laboratories, Medicaid,
Medicare, Penalties, Reporting andrecordkeeping requirements.
45 CFR Part 164
Administrative practice andprocedure, Computer technology,
Electronic information system,
Electronic transactions, Employer
benefit plan, Health, Health care, Healthfacilities, Health insurance, Healthrecords, Hospitals, Medicaid, Medical
research, Medicare, Privacy, Reporting
and recordkeeping requirements,
Security.
For the reasons set forth in thepreamble, the Centers for Medicare &Medicaid Services proposes to amend
42 CFR part 493, and the Department
proposes to amend 45 CFR Subtitle A,
Subchapter C, part 164, as set forth
below:
Title 42—Public HealthPART 493—LABORATORYREQUIREMENTS
1. The authority citation for part 493
continues to read as follows:
Authority: Section 353 of the Public
Health Service Act, secs. 1102, 1861(e), thesentence following sections 1861(s)(11)through 1861(16) of the Social Security Act(42 U.S.C. 263a, 1302, 1395x(e), the sentence
following 1395x(s)(11) through 1395x(s)(16)).

mstockstill on DSK4VPTVN1PROD with PROPOSALS

Subpart K—Quality System for
Nonwaived Testing
2. Section 493.1291 is amended by—
A. Revising paragraph (f).
B. Adding a new paragraph (l).
The revision and addition read as
follows:§ 493.1291

Standard: Test report.

*

*
*
*
*
(f) Except as provided in paragraph (l)of this section, test results must be
released only to authorized persons and,if applicable, the individuals (or theirpersonal representative) responsible for

VerDate Mar<15>2010

17:16 Sep 13, 2011

Jkt 223001

Title 45—Public Welfare
PART 164—SECURITY AND PRIVACY

Authority: 42 U.S.C. 1320d–1320d–8; sec.
264, Pub. Law 104–191, 110 Stat. 2033–2034(42 U.S.C. 1320d–2 (note)); secs. 13400–
13402, Pub. Law 111–5, 123 Stat. 258–263.

4. Section 164.524 is amended byrevising paragraphs (a)(1)(i) and (ii) andremoving paragraph (a)(1)(iii) to read as
follows:§ 164.524 Access of individuals toprotected health information.

(a) (1) * * *(i) Psychotherapy notes; and(ii) Information compiled inreasonable anticipation of, or for use in,a civil, criminal, or administrative
action or proceeding.
*
*
*
*
*
Dated: April 1, 2011.
Thomas R. Frieden,
Director, Centers for Disease Control andPrevention, Administrator, Agency for Toxic
Substances and Disease Registry.
Dated: August 12, 2011.
Donald M. Berwick,
Administrator, Centers for Medicare &Medicaid Services.
Dated: September 7, 2011.
Leon Rodriguez,
Director, Office for Civil Rights.
Dated: September 7, 2011.
Kathleen Sebelius,
Secretary, Department of Health and Human
Services.
[FR Doc. 2011–23525 Filed 9–12–11; 11:15 am]
BILLING CODE 4120–01–P

DEPARTMENT OF HOMELAND
SECURITY
Federal Emergency Management
Agency44 CFR Part 67
Docket ID FEMA–2011–0002; Internal
Agency Docket No. FEMA–B–1214]

Proposed Flood Elevation
Determinations
AGENCY: Federal Emergency

Management Agency, DHS.

PO 00000

Frm 00064

Fmt 4702

Sfmt 4702

ACTION: Proposed rule.
SUMMARY: Comments are requested on

the proposed Base (1% annual-chance)
Flood Elevations (BFEs) and proposed
BFE modifications for the communities
listed in the table below. The purposeof this proposed rule is to seek general
information and comment regarding the
proposed regulatory flood elevations forthe reach described by the downstream
and upstream locations in the tablebelow. The BFEs and modified BFEs area part of the floodplain management
measures that the community isrequired either to adopt or to show
evidence of having in effect in order toqualify or remain qualified forparticipation in the National Flood
Insurance Program (NFIP). In addition,these elevations, once finalized, will be
used by insurance agents and others to
calculate appropriate flood insurance
premium rates for new buildings andthe contents in those buildings.
DATES: Comments are to be submitted
on or before December 13, 2011.
ADDRESSES: The corresponding
preliminary Flood Insurance Rate Map(FIRM) for the proposed BFEs for each
community is available for inspection at
the community’s map repository. The
respective addresses are listed in thetable below.
You may submit comments, identified
by Docket No. FEMA–B–1214, to Luis
Rodriguez, Chief, Engineering
Management Branch, Federal Insurance
and Mitigation Administration, Federal
Emergency Management Agency, 500 C
Street, SW., Washington, DC 20472,(202) 646–4064, or (e-mail)luis.rodriguez1@dhs.gov.
FOR FURTHER INFORMATION CONTACT: Luis
Rodriguez, Chief, Engineering
Management Branch, Federal Insurance
and Mitigation Administration, Federal
Emergency Management Agency, 500 C
Street, SW., Washington, DC 20472,(202) 646–4064, or (e-mail)luis.rodriguez1@dhs.gov.
SUPPLEMENTARY INFORMATION: The
Federal Emergency Management Agency(FEMA) proposes to makedeterminations of BFEs and modified
BFEs for each community listed below,
in accordance with section 110 of the
Flood Disaster Protection Act of 1973,
42 U.S.C. 4104, and 44 CFR 67.4(a).
These proposed BFEs and modified
BFEs, together with the floodplain
management criteria required by 44 CFR
60.3, are the minimum that are required.
They should not be construed to meanthat the community must change any
existing ordinances that are more
stringent in their floodplain
management requirements. The

E:\FR\FM\14SEP1.SGM

14SEP1