Source: https://www.federalregister.gov/articles/2011/09/14/2011-23525/clia-program-and-hipaa-privacy-rule-patients-access-to-test-reports
Timestamp: 2016-07-26 21:49:54
Document Index: 770085212

Matched Legal Cases: ['§ 164', '§ 164', '§ 164', '§ 493', '§ 493', '§ 493', '§ 164', '§ 164', '§ 164', '§ 160', '§ 160', '§ 493', '§ 493', '§ 493', '§ 164', '§ 164', 'art 493', 'art 164']

-56724 (13 pages)
Document Number: 2011-23525
Shorter URL: https://federalregister.gov/a/2011-23525 Related Topics
CLIA Programs and HIPAA Privacy Rule; Patients' Access to Test Reports (CMS-2319-F) 3 actions from September 14th, 2011 to November 2013
A. Proposed Changes to the CLIA Regulations (42 CFR 493.1291)
B. Proposed Changes to the Privacy Rule (45 CFR 164.524)
CLIA staff worked with the Office of the National Coordinator for Health IT (ONC), and the CMS Office of E-Health Standards and Services (OESS) to ensure an individual's direct access to his or her own medical records through laboratories.
Pursuant to HIPAA, on December 28, 2000, the Department published a final rule in the Federal Register (65 FR 82462) entitled “Standards for Privacy of Individually Identifiable Health Information, known as the “Privacy Rule,” which was amended on August 14, 2002 (67 FR 53182). The Privacy Rule at 45 CFR 164.524 provides individuals with a general right of access to inspect and obtain a copy of protected health information about the individual in a designated record set maintained by or for a covered entity. A “designated record set” is defined at § 164.501 as a group of records maintained by or for a covered entity that is comprised of the medical records and billing records about individuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or used, in whole or in part, by or for the covered entity to make decisions about individuals.
Because CMS is proposing to amend the CLIA regulations to allow CLIA-certified laboratories to provide patients with direct access to their test reports, there is no longer a need for the exceptions at § 164.524 for CLIA and CLIA-exempt laboratories. Unless these exceptions are removed from the Privacy Rule, they would serve as a barrier to individuals' right of access to test reports. Failure to eliminate these barriers would be inconsistent with the CMS proposal and the goals of HHS to improve individuals' electronic access to their health information and have widespread adoption of EHRs by 2014. Accordingly, HHS is proposing to remove the exceptions for CLIA and CLIA-exempt laboratories from the right of access at § 164.524.
This rule proposes revisions to § 493.1291 to provide patients, upon request, with direct access to their laboratory test reports. To do so we are proposing to add § 493.1291(l) to specify that, upon a patient's request, the laboratory may provide an individual with access to his or her completed test reports that, using the laboratory's authentication processes, can be identified as belonging to that patient. In using “may,” however, we would highlight the importance of reading the proposed CLIA provisions in concert with the applicable HIPAA provisions. As described in section IIB below, HIPAA generally requires covered entities to give patients access to their records. One exception to this general mandate is a provision that exempts entities subject to CLIA where a law bars disclosure. If finalized, the proposed HIPAA amendments will remove this exception, and covered entity laboratories will be required to provide patients with access to test reports. While a more detailed HIPAA preemption analysis is found in section IIB below, we note that the CLIA “may” plus the HIPAA “must” would result in a “must disclose” for laboratories that are HIPAA covered entities.
Subject to conforming amendments, we propose to retain the existing requirements at § 493.1291(f) that otherwise limit the release of test reports to authorized persons and, if applicable, the individuals (or their personal representatives) responsible for using the test reports and, in the case of a reference laboratory, the laboratory that initially requested the test.
The Department also proposes to amend the Privacy Rule at § 164.524 to remove the exceptions that relate to CLIA and affect an individual's right of access. This proposal would align the Privacy Rule with CMS' proposed changes and the Department's goal of improving individuals' access to their health information.
We note that covered entities, including CLIA and CLIA-exempt laboratories under our proposal, must satisfy the verification requirement of § 164.514(h) before providing an individual with access. This requirement is consistent with the proposed change to the CLIA requirements, which would allow a laboratory to provide patients with access to test reports when the laboratory can authenticate that the test report pertains to the patient. We recognize that a laboratory may receive a test order with only an anonymous identifier and thus may be unable to identify the individual who is the subject of the test report. It is not our intent to discourage such anonymous testing. In this case, the laboratory that receives a request for access from an individual but cannot verify that the requesting individual is the subject of a test report is under no obligation to provide access. We propose that, if finalized, HIPAA-covered laboratories would be required to comply with the revised § 164.524 by no later than 180 days after the effective date of the final rule. The effective date of the final rule would be 60 days after publication in the Federal Register, so laboratories would have a total of 240 days after publication of the final rule to come into compliance. This compliance period is consistent with section 1175(b)(2) of the Act, which provides that the Department must provide covered entities with at least 180 days to come into compliance with modifications to standards under the HIPAA Rules. This compliance period also is consistent with our proposed changes to § 160.105 found in the July 14, 2010 proposed rule (75 FR 40868). That proposal would establish at § 160.105 a 180-day compliance period for future modifications to the HIPAA Rules, unless otherwise specifically provided.
We are soliciting public comment on each of these issues for the information collection requirements (ICRs) in the proposals for 42 CFR 493.1291.
1Note that there may be circumstances where a laboratory is able to comply with both HIPAA and the State law.
States/territories where HIPAA will pre-empt State Law.1
Determination of this finding is based on two reports as listed here: 1. Privacy and Security Solutions for Interoperable Health Information Exchange, Releasing Clinical Laboratory Test Results; Report on Survey of State Laws prepared by Joy Pritts, JD, for the Agency for Healthcare Research and Quality and Office of the National Coordinator August 2009; RIT Project Number 0209825.000.015.100 (accessed July 15, 2010).
2. Electronic Release of Clinical Laboratory Results: A Review of State and Federal Policy prepared by Kitty Purington, JD, for the California Healthcare Foundations January 2010 (Accessed July 15, 2010).1)
States/territories where laboratories are impacted
Laboratories impacted
Data from CLIA Online Survey Certification and Reporting database (OSCAR) database accessed July 8, 2010.
Test results in impacted laboratories
6,108,678,992
Data from OSCAR database accessed July 8,2010.
Hourly salary of clerical level employee to process test request
2011 salary/wages and benefits—use 2010 salary/wages and benefits of $29.25 obtained from the U.S. Bureau of Labor Statistics, Economic News Release, March 2010 U.S.—Total employer costs per hour worked for employee compensation: Civilian workers; Occupational Group: Service-providing at (http://www.bls.gov/news.release/ecec.t01.htm)
and adjusts annually by 2.78 percent to reflect an average increase in total compensation costs from 2005-2009.
2011 salary/wages and benefits—use 2010 salary/wages and benefits of $48.66 obtained from the U.S. Bureau of Labor Statistics, Economic News Release, March 2010 U.S.—Total employer costs per hour worked for employee compensation: Civilian workers; Occupational Group: Service-providing at (http://www.bls.gov/news.release/ecec.t01.htm) and adjusts annually by 2.78 percent to reflect an l average increase in total compensation costs from 2005-2009.
Table 3—Impact of Proposed Rule Change on Laboratories Back to Top
If the proposals contained in this rule are finalized, most of these 22,671 laboratories will need to develop processes and procedures to provide direct patient access to test reports. However, we recognize that some of these 22,671 laboratories may not be covered entities under HIPAA (because they do not conduct covered health care transactions electronically, for example, filing electronic claims for payment) and therefore would not be required to provide direct patient access. We do not have information on the number of laboratories that are not covered entities under HIPAA and invite comment on this issue. Table 4—Number of Impacted Laboratories and Tests per Year in the 39 Affected States and Territories Back to Top
The “Number of tests” is self reported by the laboratory without validation.
Includes only moderate and high complexity laboratories issued a CLIA Certificate of Registration, Certificate of Compliance, or Certificate of Accreditation.
243,512,093
194,894,073
66,845,370
125,645,501
194,786,593
32,566,029
25,623,535
75,797,879
497,900,106
172,798,521
239,488,953
110,373,950
119,794,280
32,909,637
145,496,862
163,380,564
74,187,598
24,428,257
288,449,078
19,783,502
64,790,081
42,105,436
345,544,798
108,564,207
487,529,546
35,429,909
92,320,737
664,345,948
219,535,503
783,048,259
61,663,359
9,894,769
176,535,389
146,846,804
9,359,277
We are unaware of any data that would provide a reasonable estimate for the number of patients who would request test reports from laboratories if they are available. We are soliciting public comments in order to better estimate the number of patient requests a laboratory might receive. We assume a range of 1 in 2,000 patients (0.05%) to 1 in 200 patients (0.50%) would request direct access to his or her test report.
Table 5—Estimated Annual Recordkeeping and Reporting Burden Back to Top
42 CFR 493.1291
10,214,192
45 CFR 493.1291
45,815,092
56,029,285
Laboratories regulated under CLIA that do not currently provide patients with an opportunity to receive, upon request, a copy of their laboratory test report (defined in CLIA regulations at § 493.1291) would be affected by this proposed rule. According to CMS OSCAR database accessed on July 8, 2010, there are 214,875 laboratories in the United States that are subject to CLIA. OSCAR is a data network maintained by CMS in cooperation with the State surveying agencies and accrediting organizations that provides a compilation of all the data elements collected during inspection surveys conducted at laboratories for the purpose of certification for participation in the Medicare and Medicaid programs. Of the total CLIA-certified laboratories identified in the OSCAR database, we believe approximately 192,204, or 90 percent, of these would not be impacted by this change because they perform testing either under a Certificate of Waiver or Certificate of Provider Performed Microscopy (PPM) or they are located in States that already allow the laboratory to provide patient access to test reports, either directly or with provider approval. Removing the step in which the provider grants permission to the laboratory should not pose an additional impact on the laboratory, as we believe these laboratories already have processes in place to provide patients access to test reports once that permission is received.
In considering the principles in and requirements of Executive Order 13132, the Department has determined that this proposed modification to the Privacy Rule will not significantly affect the rights, roles and responsibilities of the States. Table 6—Existing Laws in States/Territories Pertaining to Test Reports Back to Top
HIPAA will preempt State law
Compatible with State law
The current CLIA regulations and related laws of the States and territories pose potential barriers to the laboratory exchange of health care information (test reports) directly with the patient. These proposed regulatory changes would amend § 493.1291(f) and add § 493.1291(l) to the CLIA regulations and also amend § 164.524 of the Privacy Rule. These changes are being made in support of HHS' efforts toward achieving patient-centered and health IT-enabled healthcare and would allow patients direct access to their laboratory test reports from a laboratory without having to go to their healthcare provider to obtain this information.
There are no data available to estimate the proportion of test reports that would be requested by patients from the laboratories impacted by these proposed provisions once this rule is finalized. We welcome data pertaining to the number of test reports requested from laboratories that are already providing test reports upon request so that we would be better able to provide a more accurate estimate in the final rule. For the purposes of this analysis, we assume that many patients would still prefer to obtain their laboratory result information from their healthcare provider, who would also be able to provide interpretation of the test results, and thus an assumed range of from 1 in 2,000 (0.05 percent) to 1 in 200 (0.50 percent) is used to represent the proportion of test reports requested. Applying this range to the number of estimated annual test reports (305,433,950 to 610,867,899) yields an estimated annual number patient requests ranging from 152,717 to 3,054,339.
Table 7—Total Estimated Annual Costs of Patient Test Report Requests (Policy Development and Processing) Back to Top
Undiscounted (Base year: 2010 $)
$3,033,405
$56,029,285
$2,945,054
$54,397,364
$52,363,818
47,275,146
44,561,359
41,291,943
48,634,307
44,507,280
39,700,081
50,032,543
44,453,266
38,169,587
51,470,978
44,399,318
36,698,096
Laboratories would be able to offset some of these costs pursuant to § 164.524(c)(4) of the HIPAA Privacy Rule, which permits covered entities to impose on the patient a reasonable, cost-based fee for providing access to their health information, including the cost of supplies for and labor of copying the requested information.
Although we cannot quantify the impact on patients, we believe that it would be positive in light of findings from studies that focused on patient receipt of test results from the provider. We found several studies where greater than 90 percent of patients stated they preferred being notified of all test results, both normal and abnormal (1. Baldwin et al. Patient preferences for notification of normal laboratory test results: a report from the ASIPS Collaborative. BMC Fam Practice 2005;6:11; 2. Booker et al. Patient notification and follow-up of abnormal test results. Arch Intern Med 1996; 327- 331; 3. Grimes et al. Patient preferences and physician practices for laboratory test result notification. JABFM 2009:22:6:670-676; and 4. Meza JP and Webster DS. Patient preferences for laboratory test result notification. Am J Manag Care 2000; 6:1297-300). These same studies reported, for both the healthcare provider and patient, the preferred method for receiving normal test results was the U.S. mail and direct phone contact from the provider was the preferred method for abnormal test results. These preferences may have changed in the last 5 years given the increase in the use of electronic communications. Advantages reported in these studies for the patient having direct access to the test report include reduced workload for the healthcare provider's office, reduced chance of a patient not being informed of a laboratory test result, and reduced numbers of patients who fail to seek appropriate medical care.
(RIA, preamble, etc.)
RIA Section C2.
Annualized qualified, but unmonetized, benefits
(Unqualified benefits)
RIA Sec C1 (Table 9).
RIA Sec A (Table 4).
RIA Section A.
We estimated the cost to laboratories to provide patients with a copy of their test reports upon request and determined it would cost between $3 million and $56 million in 2011. These costs would diminish in subsequent years. In addition laboratory provision of test reports to patients may provide information that could benefit the patient by reducing the chance of the patient not being informed of a laboratory test result, reducing the number of patients lost to follow-up, and benefiting health care providers by reducing their workload in providing laboratory test reports.
For the reasons set forth in the preamble, the Centers for Medicare Medicaid Services proposes to amend 42 CFR part 493, and the Department proposes to amend 45 CFR Subtitle A, Subchapter C, part 164, as set forth below:
Section 353 of the Public Health Service Act, secs. 1102, 1861(e), the sentence following sections 1861(s)(11) through 1861(16) of the Social Security Act (42 U.S.C. 263a, 1302, 1395x(e), the sentence following 1395x(s)(11) through 1395x(s)(16)).
Subpart K—Quality System for Nonwaived Testing Back to Top