With less than two month to go before laboratories will be required to provide patients with access to completed test reports upon request, most labs are putting the finishing touches on new or revised policies and procedures.Effective Oct. 6, 2014, labs will have 30 days from receiving a request to provide the patient with completed results. In cases where a test may take more than 30 days to analyze and complete, the lab may have a 30-day extension. Labs that fail to provide test results upon request face monetary penalties. While the large national labs already have patient portals in place to deal with provision of test results, most midsize and smaller laboratories will have to provide results either through mail, in-person pickup, or through encrypted e-mail. Prior to April 7, 2014, a handful of states and territories allowed patients to access test results directly from labs. Other states either allowed test results to be released only to providers, allowed test results to patients with provider approval, or had no state law addressing the issue. PAML, a large reference lab based in Spokane, operates in a state—Washington—where patients have been allowed to access their medical information, including laboratory test results. In the past, PAML would require a patient to make a request in person at a patient service center and to show an identification card with a photo, according to Marguerite Busch, vice president and chief compliance officer for PAML and PAML Ventures. The patient then would be required to come back to pick up a hard copy, or a hard copy would be mailed to the patient. Under the new mandate, however, labs are required to provide results “in the form and format requested if a copy in that form or format is readily producible,” which means that PAML must be prepared to e-mail results upon request. Labs must also be prepared to authenticate the identity of the requestor even in cases where the person is not able to appear in person. Busch and Bill Tilton, senior vice president, operations, for American Pathology Partners (AP2) in Nashville, Tenn., discussed practical strategies for compliance with the new mandate during a July 31 webinar sponsored by G2 Intelligence (recording at available at www.G2Intelligence.com). Authentication options being tested at PAML include having a patient request form notarized, FaceTime communication with the patient holding a photo ID, and verbal authentication with certain identifiers provided by the patient matching lab information. Challenges and suggestions for compliance with the Oct. 6 mandate are discussed below. Secure Delivery of Results One challenge that PAML, AP2, and other labs face is how to ensure that results are delivered securely. Labs that e-mail results must do so in an encrypted format. The patient may need to verify that his or her e-mail system can accept and open an encrypted e-mail sent from the lab. If the patient cannot verify the ability to open an encrypted e-mail, the lab should consider declining to send results in an unsecured manner, advises Busch. Sensitive Tests Under the new rule, with a very limited exception, labs may not deny an individual access to health information based on the information’s sensitive nature or potential for causing distress. The limited exception is for cases where a licensed health care professional has determined that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person, and the individual is provided a right to have the denial of access reviewed by an unaffiliated health care professional. Busch advises labs to consider a delay in release of sensitive test results for at least 21 days to allow the ordering provider ample time to communicate results to the patient. At AP2, when a patient requests a test report, the lab will first direct the patient to the clinician. If the patient still wants the report from the lab, then he or she must fill out a request form with appropriate data elements to be used for authentication purposes. The request must include the patient full name, date of birth, address, phone number, clinician name, group name, group address, and date of service. If the request comes from the patient, a photo ID will be required. If the request comes from an authorized representative, notarization will be required. Physician Education Both Busch and Tilton advise labs to educate referring physicians about the new rule. This is especially important in states that have not allowed labs to release test results in the past. Information to consider letting physicians and other health care providers know:

• »Labs may delay all releases of test results to patients for 48 hours (or other time frame) after the ordering provider would have received results;
• »Labs may delay release of test results for certain “sensitive tests” for 21 days to give the provider time to communicate with the patient; and
• »These decisions can be made by each lab.

Fees Although the Centers for Medicare and Medicaid Services (CMS) will allow labs to charge individuals a reasonable, cost-based fee to cover the cost of providing the lab test results, both Busch and Tilton say their labs do not plan to charge a fee. CMS estimates that it will take a lab 10 to 30 minutes to handle a request at a cost of about $10 to $30 per request. Both Busch and Tilton say that if they find the cost of providing results is greater than they expect, they would reconsider revisiting the issue of charging a nominal fee. Takeaway: Labs must be prepared to comply with the patient access rule come Oct. 6, 2014. While policies and procedures may vary from lab to lab, certain requirements must be met by all labs.