UPDATE

• FAQs is also available in Portable Document Format (PDF)

Electronic Health Records and Access to Laboratory Test Results: Ensuring compliance with 10 NYCRR § 58–1.8

February 19, 2014

On January 17, 2014, the New York State Department of Health (the Department) posted frequently asked questions (FAQs) regarding patients´ access to laboratory test results using electronic health records (EHRs) and steps that could be taken to ensure compliance with New York State (NYS) regulation 10 NYCRR § 58–1.8. This regulation states that laboratory test results cannot be reported directly to the patient "except with the written consent of the physician or other authorized person." On February 6, 2014, the Federal Department of Health and Human Services published amendments to 42 CFR Part 493 and 45 CFR Part 164 which give patients a right to access medical records directly from clinical laboratories, including completed laboratory test reports (http://www.gpo.gov/fdsys/pkg/FR–2014–02–06/pdf/2014–02280.pdf).

The new Federal rule becomes effective on April 7, 2014, with a compliance date of October 6, 2014. To provide additional information on how this Federal rule affects NYS requirements related to patients´ access to laboratory results, the Department is providing this guidance.

FAQ1: The Federal rule will allow an individual or an individual´s personal representative to request and receive completed test reports directly from a laboratory that is a HIPAA covered entity. Current NYS regulations do not allow a laboratory that tests samples originating from New York State to release laboratory results directly to a patient unless written consent is first provided by the physician or other authorized person. Will the Department follow the amended Federal rule and allow patients direct access to their completed laboratory test results?

ANS1: Yes. Consistent with the amended Federal rule, the Department intends to repeal the State regulations requiring the written consent of the physician or other authorized person and to allow laboratories to provide patients with access to test reports without any consent from the practitioner who ordered the test.

FAQ2: The Federal rule states that HIPAA–covered laboratories will be required to provide individuals with access to their laboratory test reports within 30 days of the request from the patient. Can the laboratory release results sooner than 30 days without the written consent of the physician or other authorized person?

ANS2: Yes. Under the Federal rule, the laboratory generally must provide results to patients no later than 30 days after receipt of a request for test results. The laboratory may provide reports prior to the 30 days. The Department recommends that laboratories and/or EHR systems have a mechanism to ensure that the practitioner who ordered the test has the opportunity to review and discuss the test results with the patient. Thirty days is enough time for the practitioner who ordered the test to communicate with the patient regarding the test results. Good medical practice would be to allow the practitioner time to review the test results and contact the patient before providing the test results to the patient.

FAQ3: Are there circumstances where access to reports may be denied to patients?

ANS3: Yes. Both Federal and State laws will continue to allow health care professionals to deny patients access to laboratory test results on the grounds that the access requested is reasonably likely to endanger the life or physical safety of the patient or another person.