CLIA Program and CLIA Program and HIPAA Privacy Rule; HIPAA Privacy Rule;

Patients’ Access to Test Patients’ Access to Test ReportsReports

The Ohio State University The Ohio State University Wexner Medical CenterWexner Medical Center

Our Legal DutyOur Legal Duty We are required by applicable federal and We are required by applicable federal and

state law to maintain the privacy of your state law to maintain the privacy of your health information. We are also required to health information. We are also required to give you a Notice of Privacy Practices, legal give you a Notice of Privacy Practices, legal duties, and your rights concerning your duties, and your rights concerning your health informationhealth information

““For personalized medicine to reach its For personalized medicine to reach its full potential, patients need to become full potential, patients need to become more active partners in the more active partners in the management of their health” (ASCP, management of their health” (ASCP, 2011).2011).

CMS Finalizes HIPAA and CLIA CMS Finalizes HIPAA and CLIA Amendments Amendments

Published February 3Published February 3rdrd, 2014, 2014 Final rule amends CLIA of 1988 and HIPAA Final rule amends CLIA of 1988 and HIPAA

of 1996 to permit CLIA-certified of 1996 to permit CLIA-certified laboratories to provide copies of laboratories to provide copies of completed test reports to patients upon completed test reports to patients upon requestrequest

Additionally, any laboratory that qualifies Additionally, any laboratory that qualifies as a covered entity under HIPAA will now as a covered entity under HIPAA will now be be required required to comply with such patient to comply with such patient requests requests

Other Key ComponentsOther Key Components Laboratories generally will have 30 days to release Laboratories generally will have 30 days to release

results following the request, unless a state law results following the request, unless a state law requires a more timely release. Laboratories may requires a more timely release. Laboratories may have a 30-day extension when retrieving archived have a 30-day extension when retrieving archived results that will take longer than 30 days from the results that will take longer than 30 days from the patient requestpatient request

Laboratories will have 240 days, or October 4, from Laboratories will have 240 days, or October 4, from official publication of the final rule on February 6 to official publication of the final rule on February 6 to comply with new requirements. This will include comply with new requirements. This will include revising HIPAA notices of privacy practicesrevising HIPAA notices of privacy practices

No established time lag for laboratories to observe No established time lag for laboratories to observe between delivery of test results to the ordering between delivery of test results to the ordering physician and release of the results by the physician and release of the results by the laboratorylaboratory

Other Key Components Other Key Components cont.cont.

The ordering physician is not required to disclose The ordering physician is not required to disclose the identity of the testing laboratory to patients. the identity of the testing laboratory to patients. However, HHS encouraged physicians to inform However, HHS encouraged physicians to inform patients where specimens are being sentpatients where specimens are being sent

The regulation preempts state laws that impede The regulation preempts state laws that impede patients directly receiving test results from the patients directly receiving test results from the laboratorylaboratory

Other Key Components Other Key Components cont.cont.

Laboratories are not required to interpret test results for Laboratories are not required to interpret test results for patients. Laboratories may continue to refer patients with patients. Laboratories may continue to refer patients with questions about the test results back to their ordering or questions about the test results back to their ordering or treating providerstreating providers

HIPAA requires regulated entities to provide access to PHI HIPAA requires regulated entities to provide access to PHI upon the request of the affected patient or his/her upon the request of the affected patient or his/her personal representative (i.e. access to PHI– billing personal representative (i.e. access to PHI– billing information, etc.)information, etc.)

– HIPAA Omnibus Rule expanded HIPAA’s right of access by HIPAA Omnibus Rule expanded HIPAA’s right of access by requiring regulated entities to forward electronic copies of requiring regulated entities to forward electronic copies of PHI to third parties upon the request of a patientPHI to third parties upon the request of a patient

Going Forward…Going Forward… These regulations will require nearly 23,000 These regulations will require nearly 23,000

laboratories in 39 states and territories to develop laboratories in 39 states and territories to develop new procedures for providing patients access to new procedures for providing patients access to their resultstheir results

Over 33,000 laboratories will need to revise their Over 33,000 laboratories will need to revise their Notices to reflect the right of individuals to obtain Notices to reflect the right of individuals to obtain test results directly from the laboratorytest results directly from the laboratory

Compliance with the new requirements estimates Compliance with the new requirements estimates that the cost of developing the necessary policies that the cost of developing the necessary policies and procedures for all affected laboratories could and procedures for all affected laboratories could range from $2.2 million to $10.2 millionrange from $2.2 million to $10.2 million– Responding to patient requests could exceed $52 million Responding to patient requests could exceed $52 million

annually annually

OverviewOverview

In its entirety, these changes to the In its entirety, these changes to the CLIA regulations and the HIPAA CLIA regulations and the HIPAA Privacy Rule provide individuals with Privacy Rule provide individuals with a greater ability to access their a greater ability to access their health information, empowering health information, empowering them to take a more active role in them to take a more active role in managing their health and health managing their health and health carecare

Current Procedures to Current Procedures to Patients’ Access to Test Patients’ Access to Test

Reports at OSUWMCReports at OSUWMC

Script for Laboratory…Script for Laboratory…

To use for both Patient and Physician To use for both Patient and Physician requests for resultsrequests for results

Patient RequestPatient Request If a patient calls for results of lab tests, first, ask If a patient calls for results of lab tests, first, ask

the patient if he/she is a current patient of OSUthe patient if he/she is a current patient of OSU– If yes, the patient may have access to OSUMyChart. If yes, the patient may have access to OSUMyChart.

Follow this script:Follow this script: Since you are a current patient at OSUWMC, do you have Since you are a current patient at OSUWMC, do you have

access to OSUMyChart? access to OSUMyChart? – OSUMyChart allows you to see your results on-line. You would OSUMyChart allows you to see your results on-line. You would

have signed up for this feature in your doctor’s office. have signed up for this feature in your doctor’s office. If you have access to OSUMyChart, you can simply sign on If you have access to OSUMyChart, you can simply sign on

and follow the directions to the test results tab and you can and follow the directions to the test results tab and you can have access to your test results today. have access to your test results today.

If you don’t have access to OSUMyChart, I will transfer you If you don’t have access to OSUMyChart, I will transfer you to our Medical Information Management department and to our Medical Information Management department and they will process your request. If you would like to sign up they will process your request. If you would like to sign up for OSUMyChart for future requests to see your lab results, for OSUMyChart for future requests to see your lab results, you can sign up in your doctor’s office at your next you can sign up in your doctor’s office at your next appointment. appointment.

Patient Request cont.Patient Request cont.

– If the patient is If the patient is notnot a current patient of OSUWMC and a current patient of OSUWMC and the test has simply been sent here to be performed, the test has simply been sent here to be performed, follow this script:follow this script: I will transfer your call to our Medical Information I will transfer your call to our Medical Information

Management department. They will be able to take your Management department. They will be able to take your information and process your request for your test results. information and process your request for your test results.

If we get disconnected, please call them directly back at If we get disconnected, please call them directly back at

the main number and ask for extension 293-8657.the main number and ask for extension 293-8657.

Patient Request cont.Patient Request cont.

– Transfer call to Medical Information Management 293-Transfer call to Medical Information Management 293-8657. This is our Release of Information HealthPort 8657. This is our Release of Information HealthPort office. It is staffed by HealthPort. office. It is staffed by HealthPort. HealthPort is our vendor that handles requests for copies HealthPort is our vendor that handles requests for copies

and release of medical records. and release of medical records.

– They will follow their current policy which is to verify the They will follow their current policy which is to verify the patient’s address and send the patient a Release of patient’s address and send the patient a Release of Information Authorization Form to complete and mail or Information Authorization Form to complete and mail or fax back to our office. The patients may fax fax back to our office. The patients may fax authorizations back to us at 366-9442, if they have authorizations back to us at 366-9442, if they have access to a fax machine access to a fax machine

Physician RequestPhysician Request

Physician calls the lab for results:Physician calls the lab for results:– Lab confirms that the caller was in fact the same Lab confirms that the caller was in fact the same

physician who ordered the patient’s labs physician who ordered the patient’s labs – Lab checks the CPD (Central Physician Database) to Lab checks the CPD (Central Physician Database) to

determine if the calling physician is listed as an OSU determine if the calling physician is listed as an OSU referring physician. referring physician. If yes, then Lab checks the CPD to see if the referring If yes, then Lab checks the CPD to see if the referring

physician’s fax number was confirmed for Confidential physician’s fax number was confirmed for Confidential Patient Communications. Patient Communications.

If the fax has not been confirmed for Confidential Patient If the fax has not been confirmed for Confidential Patient Communications, the Communications, the Lab transfers the call to MIM @ 3-Lab transfers the call to MIM @ 3-86578657

Physician Request cont.Physician Request cont.

Physician calls MIM for results:Physician calls MIM for results:– If the physician call comes to MIM, it is transferred to the If the physician call comes to MIM, it is transferred to the

Release of Information office Release of Information office – The HealthPort staff in the Release of Information office The HealthPort staff in the Release of Information office

verifies that the caller is the same physician who verifies that the caller is the same physician who ordered the test ordered the test After they have confirmed this, they fax the result to the After they have confirmed this, they fax the result to the

physician’s office fax number that is listed in the CPD physician’s office fax number that is listed in the CPD If the physician is not in the CPD, they ask the physician to If the physician is not in the CPD, they ask the physician to

send a request on letterhead with the fax number on it. send a request on letterhead with the fax number on it. Then they will fax the results and record the release in IHIS Then they will fax the results and record the release in IHIS