CMS, CAP Publish FAQs on Patient Access Rule

Both the Centers for Medicare and Medicaid Services (CMS) and the College of American Pathologists (CAP) have published frequently asked questions (FAQs) addressing the Feb. 6 final rule requiring clinical laboratories to provide test results directly to patients upon request. The FAQs address the compliance date for the rule (Oct. 6, 2014), changes to the Clinical Laboratory Improvement Amendments and the Health Insurance Portability and Accountability Act (HIPAA) and their effect on state laws, and who is authorized to have access to an individual’s sensitive laboratory test reports. CMS notes that the only persons other than the individual who have a right to access test reports directly from a HIPAA-covered laboratory are those persons who are designated by the individual as a “personal representative.” This typically means someone who has authority under law to make health care decisions for the individual. Such authority is generally determined under state law. Addressing concerns about labs giving individuals test results without the individual having the benefit of health care provider interpretation, CMS says it expects that individuals will continue to obtain their test reports and the interpretation of those reports from their health care provider. “The rule does not require laboratories to interpret test results,” says CMS. “Laboratories can refer an individual back to their health care provider for this information.” Some labs have asked whether they would have to have an electronic health record (EHR) system, patient portal, or be a part of a health information exchange (HIE) to meet this new requirement for patient access to test results. CMS clarifies that a lab does not need to have an EHR system, patient portal, or be part of an HIE. “However, we would anticipate that as EHRs, portals, and HIEs become more commonplace, laboratories will develop processes to handle patient requests via these systems,” says CMS. Additional questions addressed in the CAP FAQs include: What format do the results need to be in?

The Privacy Rule requires a covered entity such as a clinical laboratory to provide the individual with a copy of the requested information in the form and format requested by the individual, if a copy in that form or format is “readily producible.” If not, the copy must be either a readable hard copy or in another form or format as agreed by the covered entity and the individual. If an individual declines to accept any of the electronic formats that are readily producible by the HIPAA-covered laboratory, the laboratory must provide a hard copy.

How do laboratories authenticate patients and their personal representatives’ identity?

The commentary to the final rule states: “ . . . a HIPAA-covered laboratory could verify a person’s authority by asking for documentation of a health care power of attorney, or general power or durable power of attorney, that includes the power to make health care decisions, proof of legal guardianship, or, in the case of a parent, information that establishes the relationship of the person to the minor individual. A HIPAA-covered laboratory may also contact the treating provider to inquire whether the treating provider can provide documentation of the person’s status as a personal representative of the individual.”

Takeaway: There are many details in the final patient access rule that labs need to become familiar with. G2 Intelligence and the American Clinical Laboratory Association are sponsoring a webinar March 25 to address many of the most pressing issues.