CLIA Program and HIPAA Privacy Rule; Patients' Access to Test Reports, 56712-56724 [2011-23525]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 76, Number 178 (Wednesday, September 14, 2011)]
[Proposed Rules]
[Pages 56712-56724]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-23525]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Part 493

Office of the Secretary

45 CFR Part 164

[CMS-2319-P]
RIN 0938-AQ38


CLIA Program and HIPAA Privacy Rule; Patients' Access to Test 
Reports

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS; Centers 
for Disease Control and Prevention (CDC), HHS; Office for Civil Rights 
(OCR), HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: This proposed rule would amend the Clinical Laboratory 
Improvement Amendments of 1988 (CLIA) regulations to specify that, upon 
a patient's request, the laboratory may provide access to completed 
test reports that, using the laboratory's authentication process, can 
be identified as belonging to that patient. Subject to conforming 
amendments, the proposed rule would retain the existing provisions that 
provide for release of test reports to authorized persons and, if 
applicable, the individuals (or their personal representative) 
responsible for using the test reports and, in the case of reference 
laboratories, the laboratory that initially requested the test. In 
addition, this proposed rule would also amend the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to 
provide individuals the right to receive their test reports directly 
from laboratories by removing the exceptions for CLIA-certified 
laboratories and CLIA-exempt laboratories from the provision that 
provides individuals with the right of access to their protected health 
information.

DATES: To be assured consideration, comments must be received at one of 
the addresses provided below, no later than 5 p.m. on November 14, 
2011.

ADDRESSES: In commenting, please refer to file code CMS-2319-P. Because 
of staff and resource limitations, we cannot accept comments by 
facsimile (FAX) transmission.
    You may submit comments in one of four ways (please choose only one 
of the ways listed):
    1. Electronically. You may submit electronic comments on this 
regulation

[[Page 56713]]

to https://www.regulations.gov. Follow the ``Submit a comment'' 
instructions.
    2. By regular mail. You may mail written comments to the following 
address ONLY: Centers for Medicare & Medicaid Services, Department of 
Health and Human Services, Attention: CMS-2319-P, P.O. Box 8010, 
Baltimore, MD 21244-8010.
    Please allow sufficient time for mailed comments to be received 
before the close of the comment period.
    3. By express or overnight mail. You may send written comments to 
the following address ONLY: Centers for Medicare & Medicaid Services, 
Department of Health and Human Services, Attention: CMS-2319-P, Mail 
Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
    4. By hand or courier. Alternatively, you may deliver (by hand or 
courier) your written comments ONLY to the following addresses prior to 
the close of the comment period:
    a. For delivery in Washington, DC--Centers for Medicare & Medicaid 
Services, Department of Health and Human Services, Room 445-G, Hubert 
H. Humphrey Building, 200 Independence Avenue, SW., Washington, DC 
20201.

    (Because access to the interior of the Hubert H. Humphrey Building 
is not readily available to persons without Federal government 
identification, commenters are encouraged to leave their comments in 
the CMS drop slots located in the main lobby of the building. A stamp-
in clock is available for persons wishing to retain a proof of filing 
by stamping in and retaining an extra copy of the comments being 
filed.)
    b. For delivery in Baltimore, MD--Centers for Medicare & Medicaid 
Services, Department of Health and Human Services, 7500 Security 
Boulevard, Baltimore, MD 21244-1850.

    If you intend to deliver your comments to the Baltimore address, 
please call telephone number (410) 786-9994 in advance to schedule your 
arrival with one of our staff members.
    Comments erroneously mailed to the addresses indicated as 
appropriate for hand or courier delivery may be delayed and received 
after the comment period.
    Submission of comments on paperwork requirements. You may submit 
comments on this document's paperwork requirements by following the 
instructions at the end of the ``Collection of Information 
Requirements'' section in this document.
    For information on viewing public comments, see the beginning of 
the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT: For CLIA regulations:

Nancy Anderson, CDC, (404) 498-2280.
Judith Yost, CMS, (410) 786-3531.

    For HIPAA Privacy Rule:

Andra Wicks, OCR, (202) 205-2292.

SUPPLEMENTARY INFORMATION: 
    Inspection of Public Comments: All comments received before the 
close of the comment period are available for viewing by the public, 
including any personally identifiable or confidential business 
information that is included in a comment. We post all comments 
received before the close of the comment period on the following Web 
site as soon as possible after they have been received: https://www.regulations.gov. Follow the search instructions on that Web site to 
view public comments.
    Comments received timely will also be available for public 
inspection as they are received, generally beginning approximately 3 
weeks after publication of a document, at the headquarters of the 
Centers for Medicare & Medicaid Services, 7500 Security Boulevard, 
Baltimore, Maryland 21244, Monday through Friday of each week from 8:30 
a.m. to 4 p.m. To schedule an appointment to view public comments, 
phone 1-800-743-3951.

I. Background

A. CLIA Statute and Regulations

    The Clinical Laboratory Improvement Amendments of 1988 (CLIA) were 
enacted to establish quality standards for certain laboratory testing. 
These standards ensure the accuracy, reliability and timeliness of 
patient test results, regardless of where the test is performed. The 
standards are based on the complexity of the laboratory test method; 
the more complicated the test, the more stringent the requirements for 
the laboratory.
    CLIA established three categories of testing based on complexity 
level. In increasing order of complexity, these categories are waived 
complexity, moderate complexity which includes the subcategory of 
provider-performed microscopy (PPM), and high complexity. Laboratories 
must hold a CLIA certificate for the most complex form of CLIA-
regulated testing that they perform.
    CLIA covers all phases of laboratory testing, including the 
reporting out of test results. The CLIA-based limitations that govern 
to whom a laboratory may issue a test report have become a point of 
concern. The requirements for a laboratory test report are set forth in 
42 CFR 493.1291.
    Under the current regulations at Sec.  493.1291(f), CLIA limits a 
laboratory's disclosure of laboratory test results to three categories 
of individuals: the ``authorized person,'' the person responsible for 
using the test results in the treatment context, and, in the case of 
reference laboratories, the referring lab. Authorized person is defined 
in Sec.  493.2 as the individual authorized under State law to order or 
receive test results, or both. In States that do not provide for 
individual access to the individual's test results, the individual must 
receive his or her results through the ordering provider.
    While individuals can obtain test results through the ordering 
provider, we believe that the advent of certain health reform concepts 
(for example, individualized medicine and an individual's active 
involvement in his or her own health care) would be best served by 
revisiting the CLIA limitations on the disclosure of laboratory test 
results.
    Title XIII of Division A and Title IV of Division B of the American 
Recovery and Reinvestment Act of 2009 (The Recovery Act), which was 
enacted on February 17, 2009, incorporated the Health Information 
Technology for Economic and Clinical Health (HITECH) Act.
    HITECH created a Federal advisory committee known as the Health 
Information Technology (HIT) Policy Committee. The HIT Policy Committee 
has broad representation from major health care constituencies and 
provides recommendations to the Office of the National Coordinator for 
Health Information Technology (ONC) on issues relating to the 
implementation of an interoperable, nationwide health information 
infrastructure. Among other efforts, the HIT Policy Committee has 
sought to identify barriers to the adoption and use of health 
information technology. According to the HIT Policy Committee, CLIA 
regulations are perceived by some stakeholders as imposing barriers to 
the exchange of health information. These stakeholders include large- 
and medium-sized laboratories, some public health laboratories, 
electronic health record (EHR) system vendors, health policy experts, 
health information exchange organizations (HIOs) and healthcare 
providers who believe that the individual's access to his or her own 
records is impeded, preventing patients from a more active role in 
their personal health care decisions.
    CLIA staff worked with the Office of the National Coordinator for 
Health IT (ONC), and the CMS Office of E-Health Standards and Services 
(OESS) to

[[Page 56714]]

ensure an individual's direct access to his or her own medical records 
through laboratories.
    The collaborating offices believe the provision of direct patient 
access to laboratory test reports would support the commitments and 
goals of the Secretary of HHS and the CMS Administrator regarding the 
widespread adoption of EHRs by 2014.
    Therefore, in an effort to increase direct patient access rights, 
we are proposing that, upon a patient's request, CLIA regulations would 
allow laboratories to provide direct patient access to completed test 
reports that, using the laboratory's authentication processes, the 
laboratory can identify as belonging to that patient. We propose to 
retain the other categories of individuals who are eligible to receive 
test reports from laboratories, namely the individuals responsible for 
using the test reports, and, in the case of a reference laboratory, the 
laboratory that initially requested the test. We also propose certain 
conforming amendments to the existing regulations. CMS solicits 
comments from stakeholders regarding the potential impact of this 
change on improving patients' access to their laboratory results.

B. HIPAA Statute and Privacy Rule

    The Health Insurance Portability and Accountability Act of 1996 
(HIPAA), Title II, subtitle F--Administrative Simplification, Public 
Law 104-191, 110 Stat., 2021, provided for the establishment of 
national standards to protect the privacy and security of personal 
health information. The Administrative Simplification provisions of 
HIPAA apply to three types of entities, which are known as ``covered 
entities'': health care providers who conduct covered health care 
transactions electronically, health plans, and health care 
clearinghouses.
    A laboratory, as a health care provider, is only a covered entity 
if it conducts electronic transactions (for example, electronic 
submission of health care claims). The list of HIPAA transactions 
applicable to providers are:
     Health care claims or equivalent encounter information.
     Coordination of benefits.
     Health care claim status.
     Eligibility for a health plan.
     Referral certification and authorization.
    If a laboratory does not conduct any of the above transactions 
electronically (either because it does not conduct the transactions at 
all or because it does so via paper), then it is not subject to the 
HIPAA Privacy Rule. If a laboratory conducts a single transaction 
electronically, then it becomes a covered entity and is subject to the 
Privacy Rule with respect to all protected health information that it 
creates or maintains (that is, the application of the Privacy Rule is 
not limited to the individuals or records associated with an electronic 
transaction).
    Pursuant to HIPAA, on December 28, 2000, the Department published a 
final rule in the Federal Register (65 FR 82462) entitled ``Standards 
for Privacy of Individually Identifiable Health Information, known as 
the ``Privacy Rule,'' which was amended on August 14, 2002 (67 FR 
53182). The Privacy Rule at 45 CFR 164.524 provides individuals with a 
general right of access to inspect and obtain a copy of protected 
health information about the individual in a designated record set 
maintained by or for a covered entity. A ``designated record set'' is 
defined at Sec.  164.501 as a group of records maintained by or for a 
covered entity that is comprised of the medical records and billing 
records about individuals maintained by or for a covered health care 
provider; the enrollment, payment, claims adjudication, and case or 
medical management record systems maintained by or for a health plan; 
or used, in whole or in part, by or for the covered entity to make 
decisions about individuals.
    The definition of ``designated record set'' also clarifies that the 
term ``record'' means ``any item, collection, or grouping of 
information that includes protected health information and is 
maintained, collected, used or disseminated by or for a covered 
entity.'' Laboratory test reports maintained by or for a laboratory 
that is a covered entity fall within the definition of designated 
record set since they are medical records about individuals.
    The right of access under Sec.  164.524 extends not only to 
individuals, but also to individuals' personal representatives. The 
rules governing who may act as a personal representative under the 
Privacy Rule are set forth at Sec.  164.502(g).
    While individuals (and personal representatives) generally have the 
right to inspect and obtain a copy of their protected health 
information in a designated record set, the Privacy Rule includes a set 
of exceptions related to CLIA. The right of access under Sec.  164.524 
of the Privacy Rule does not apply to: protected health information 
maintained by a covered entity that is--(1) Subject to CLIA to the 
extent the provision of access to the individual would be prohibited by 
law; or (2) exempt from CLIA.
    These exceptions at Sec.  164.524(a)(1)(iii) were included in the 
Privacy Rule because the Department wanted to avoid a conflict with the 
CLIA requirements that limited patient access to test reports (65 FR 
82485). These exceptions only cover test reports at CLIA and CLIA-
exempt laboratories; the individual has a right to access the test 
reports when held by any other type of covered entity (for example, a 
hospital or treating physician).
    Because CMS is proposing to amend the CLIA regulations to allow 
CLIA-certified laboratories to provide patients with direct access to 
their test reports, there is no longer a need for the exceptions at 
Sec.  164.524 for CLIA and CLIA-exempt laboratories. Unless these 
exceptions are removed from the Privacy Rule, they would serve as a 
barrier to individuals' right of access to test reports. Failure to 
eliminate these barriers would be inconsistent with the CMS proposal 
and the goals of HHS to improve individuals' electronic access to their 
health information and have widespread adoption of EHRs by 2014. 
Accordingly, HHS is proposing to remove the exceptions for CLIA and 
CLIA-exempt laboratories from the right of access at Sec.  164.524.

II. Provisions of the Proposed Regulations

A. Proposed Changes to the CLIA Regulations (42 CFR 493.1291)

    This rule proposes revisions to Sec.  493.1291 to provide patients, 
upon request, with direct access to their laboratory test reports. To 
do so we are proposing to add Sec.  493.1291(l) to specify that, upon a 
patient's request, the laboratory may provide an individual with access 
to his or her completed test reports that, using the laboratory's 
authentication processes, can be identified as belonging to that 
patient. In using ``may,'' however, we would highlight the importance 
of reading the proposed CLIA provisions in concert with the applicable 
HIPAA provisions. As described in section IIB below, HIPAA generally 
requires covered entities to give patients access to their records. One 
exception to this general mandate is a provision that exempts entities 
subject to CLIA where a law bars disclosure. If finalized, the proposed 
HIPAA amendments will remove this exception, and covered entity 
laboratories will be required to provide patients with access to test 
reports. While a more detailed HIPAA preemption analysis is found in 
section IIB below, we note that the CLIA ``may''

[[Page 56715]]

plus the HIPAA ``must'' would result in a ``must disclose'' for 
laboratories that are HIPAA covered entities.
    We also note that, as proposed, the CLIA regulations would not 
spell out the mechanism by which patient requests for access would be 
submitted, processed, or responded to by the laboratories. In providing 
this latitude, we intend to allow patients and their personal 
representatives' access to patient test reports in accordance with the 
requirements of the HIPAA Privacy Rule.
    Subject to conforming amendments, we propose to retain the existing 
requirements at Sec.  493.1291(f) that otherwise limit the release of 
test reports to authorized persons and, if applicable, the individuals 
(or their personal representatives) responsible for using the test 
reports and, in the case of a reference laboratory, the laboratory that 
initially requested the test.

B. Proposed Changes to the Privacy Rule (45 CFR 164.524)

    The Department also proposes to amend the Privacy Rule at Sec.  
164.524 to remove the exceptions that relate to CLIA and affect an 
individual's right of access. This proposal would align the Privacy 
Rule with CMS' proposed changes and the Department's goal of improving 
individuals' access to their health information.
    As a result of this proposal, HIPAA covered entities that are 
laboratories subject to CLIA would have the same obligations as other 
types of covered health care providers with respect to providing 
individuals with access to their protected health information in 
accordance with Sec.  164.524. Similarly, HIPAA covered entities that 
are CLIA-exempt laboratories (as the term is defined at 42 CFR 493.2) 
would no longer be excepted from HIPAA's right of access under Sec.  
164.524(a)(1)(iii)(B). As with other covered entities, HIPAA covered 
laboratories would be required to provide access to the individual or 
the individual's personal representative.
    The current HIPAA Privacy Rule requires covered entities to provide 
an individual with access to protected health information in the form 
or format requested by the individual, if it is readily producible in 
such form or format. The Privacy Rule permits covered entities to 
charge a reasonable, cost-based fee to provide individuals with copies 
of their protected health information. The fee may include only the 
cost of copying (including supplies and labor) and postage, if the 
patient requests that the copy be mailed. If the patient has agreed to 
receive a summary or explanation of his or her protected health 
information, the covered entity may also charge a fee for preparation 
of the summary or explanation. The fee may not include costs associated 
with searching for and retrieving the requested information.
    On July 14, 2010, the Department issued a proposed rule to 
implement most of the privacy and security provisions of the HITECH 
Act, which included provisions to strengthen an individual's right to 
receive an electronic copy of his or her protected health information, 
where such information is maintained electronically in one or more 
designated record sets. Specifically, the proposed rule would require 
in such cases that the covered entity provide the individual with 
access to the electronic information in the electronic form and format 
requested by the individual, if it is readily producible in such form 
and format, or, if not, in a readable electronic form and format as 
agreed to by the covered entity and the individual. Additionally, the 
Department proposed changes to address and clarify the fees associated 
with the provision of electronic access. The Department proposed to 
allow reasonable cost-based fees reflecting the costs of labor for 
creating the electronic copy of the information and of supplies, such 
as CDs, if the individual requests that the electronic copy be provided 
on portable media. HIPAA covered laboratories would be required to 
comply with the Privacy Rule's provisions regarding form of access 
provided and fees, as they exist currently and then are ultimately 
modified by a final rule implementing the HITECH Act. With respect to 
the provision of electronic access, covered entities that have 
electronic reporting capabilities are expected to provide the 
individual with a machine readable or other electronic copy of the 
individual's protected health information. (The individual always 
retains the right to request and receive a paper copy, if desired.) The 
Department considers machine readable data to mean digital information 
stored in a standard format enabling the information to be processed 
and analyzed by computer. For example, this would include providing the 
individual with an electronic copy of the protected health information 
in the format of MS Word or Excel, text, HTML, or text-based PDF, among 
other formats. We request comment on the ability of laboratories to 
provide electronic copies of protected health information in machine 
readable or other electronic formats.
    Under our proposal, Sec.  164.524 would preempt any contrary 
provisions of State law. HIPAA, at section 1178 of the Social Security 
Act (the Act), provides that the administrative simplification 
regulations (``the HIPAA Rules'') preempt any contrary provisions of 
State law. A provision of State law is ``contrary'' to a provision of 
the HIPAA Rules if a covered entity would find it impossible to comply 
with both the State and Federal requirements; or the provision of State 
law stands as an obstacle to the accomplishment and execution of the 
full purposes and objectives of part C of title XI of the Act or 
section 254 of Public Law 104-191, as applicable.
    Pursuant to section 264(c)(2) of HIPAA, the HIPAA Privacy Rule 
includes an exception from this general preemption if ``the provision 
of State law relates to the privacy of individually identifiable health 
information and is more stringent than a standard, requirement, or 
implementation specification adopted under subpart E of part 164 of 
this subchapter.'' With respect to a State law pertaining to an 
individual's right to access his or her protected health information, a 
State law is more stringent than the Privacy Rule if the State law 
``permits greater rights of access or amendment, as applicable'' (Sec.  
160.202).
    A number of States have laws that prohibit a laboratory from 
releasing a test report directly to the patient or that prohibit the 
release without the ordering provider's consent. If adopted, the 
proposed changes to Sec.  164.524 would preempt any contrary State laws 
that prohibit the HIPAA-covered laboratory from directly providing 
access to the individual.
    We note that covered entities, including CLIA and CLIA-exempt 
laboratories under our proposal, must satisfy the verification 
requirement of Sec.  164.514(h) before providing an individual with 
access. This requirement is consistent with the proposed change to the 
CLIA requirements, which would allow a laboratory to provide patients 
with access to test reports when the laboratory can authenticate that 
the test report pertains to the patient. We recognize that a laboratory 
may receive a test order with only an anonymous identifier and thus may 
be unable to identify the individual who is the subject of the test 
report. It is not our intent to discourage such anonymous testing. In 
this case, the laboratory that receives a request for access from an 
individual but cannot verify that the requesting individual is the 
subject of a test report is under no obligation to provide access.

[[Page 56716]]

    We propose that, if finalized, HIPAA-covered laboratories would be 
required to comply with the revised Sec.  164.524 by no later than 180 
days after the effective date of the final rule. The effective date of 
the final rule would be 60 days after publication in the Federal 
Register, so laboratories would have a total of 240 days after 
publication of the final rule to come into compliance. This compliance 
period is consistent with section 1175(b)(2) of the Act, which provides 
that the Department must provide covered entities with at least 180 
days to come into compliance with modifications to standards under the 
HIPAA Rules. This compliance period also is consistent with our 
proposed changes to Sec.  160.105 found in the July 14, 2010 proposed 
rule (75 FR 40868). That proposal would establish at Sec.  160.105 a 
180-day compliance period for future modifications to the HIPAA Rules, 
unless otherwise specifically provided.

III. Collection of Information Requirements

    Under the Paperwork Reduction Act of 1995, we are required to 
provide 60-day notice in the Federal Register and solicit public 
comment before a collection of information requirement is submitted to 
the Office of Management and Budget (OMB) for review and approval. In 
order to fairly evaluate whether an information collection should be 
approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act 
of 1995 requires that we solicit comment on the following issues:
     The need for the information collection and its usefulness 
in carrying out the proper functions of our agency.
     The accuracy of our estimate of the information collection 
burden.
     The quality, utility, and clarity of the information to be 
collected.
     Recommendations to minimize the information collection 
burden on the affected public, including automated collection 
techniques.
    We are soliciting public comment on each of these issues for the 
information collection requirements (ICRs) in the proposals for 42 CFR 
493.1291.
    Except as provided in Sec.  493.1291(l), test reports must be 
released only to authorized persons and, if applicable, the individuals 
(or their personal representative) responsible for using the test 
reports and, in the case of a reference laboratory, the laboratory that 
initially requested the test. Under Sec.  493.1291(l), the laboratory 
may, upon request by the patient, provide access to the patient's test 
reports that the laboratory can identify as belonging to that patient. 
The CLIA regulations would not require that CLIA-certified laboratories 
provide this access--rather, the entities would be allowed to provide 
for access. We note, however, that CLIA-certified laboratories 
generally are covered entities under the HIPAA Privacy Rule. That rule 
also provides for patients' access to their records. CLIA-certified 
laboratories will need to ensure that their practices conform to CLIA 
and HIPAA requirements.
    We have prepared the Paperwork Reduction Act and the Regulatory 
Impact Analysis that represents the costs and benefits of the proposed 
rule based on analysis of identified variables and data sources needed 
for this proposed change. We identified known data elements (Table 1) 
and made assumptions on elements where a source could not be identified 
(Table 2). Our assumptions are based on internal discussions and 
consultation with two reference laboratories. We request comments on 
the assumptions used and analyses provided.

                                     Table 1--Summary of Known Data Elements
----------------------------------------------------------------------------------------------------------------
                  Variable                       Data element                         Source
----------------------------------------------------------------------------------------------------------------
States/territories where HIPAA will pre-empt                  20  Determination of this finding is based on two
 State Law.\1\                                                     reports as listed here:
                                                                  1. Privacy and Security Solutions for
                                                                   Interoperable Health Information Exchange,
                                                                   Releasing Clinical Laboratory Test Results;
                                                                   Report on Survey of State Laws prepared by
                                                                   Joy Pritts, JD, for the Agency for Healthcare
                                                                   Research and Quality and Office of the
                                                                   National Coordinator August 2009; RIT Project
                                                                   Number 0209825.000.015.100 (accessed July 15,
                                                                   2010).
                                              ..................     2. Electronic Release of Clinical
                                                                      Laboratory Results: A Review of State and
                                                                      Federal Policy prepared by Kitty
                                                                      Purington, JD, for the California
                                                                      Healthcare Foundations January 2010
                                                                      (Accessed July 15, 2010).\1\)
States/territories where laboratories are                     39  Determination of this finding is based on two
 impacted.                                                         reports as listed here:
                                                                  1. Privacy and Security Solutions for
                                                                   Interoperable Health Information Exchange,
                                                                   Releasing Clinical Laboratory Test Results;
                                                                   Report on Survey of State Laws prepared by
                                                                   Joy Pritts, JD, for the Agency for Healthcare
                                                                   Research and Quality and Office of the
                                                                   National Coordinator August 2009; RIT Project
                                                                   Number 0209825.000.015.100 (Accessed July 15,
                                                                   2010).
                                              ..................     2. Electronic Release of Clinical
                                                                      Laboratory Results: A Review of State and
                                                                      Federal Policy prepared by Kitty
                                                                      Purington, JD, for the California
                                                                      Healthcare Foundations January 2010
                                                                      Accessed July 15, 2010).
Laboratories impacted.......................              22,671  Data from CLIA Online Survey Certification and
                                                                   Reporting database (OSCAR) database accessed
                                                                   July 8, 2010.
Test results in impacted laboratories.......       6,108,678,992  Data from OSCAR database accessed July 8,
                                                                   2010.
Hourly salary of clerical level employee to               $30.09  2011 salary/wages and benefits--use 2010
 process test request.                                             salary/wages and benefits of $29.25 obtained
                                                                   from the U.S. Bureau of Labor Statistics,
                                                                   Economic News Release, March 2010 U.S.--Total
                                                                   employer costs per hour worked for employee
                                                                   compensation: Civilian workers; Occupational
                                                                   Group: Service-providing at (https://www.bls.gov/news.release/ecec.t01.htm) and
                                                                   adjusts annually by 2.78 percent to reflect
                                                                   an average increase in total compensation
                                                                   costs from 2005-2009.
Hourly salary of management level employee                $50.06  2011 salary/wages and benefits--use 2010
 to determine policy.                                              salary/wages and benefits of $48.66 obtained
                                                                   from the U.S. Bureau of Labor Statistics,
                                                                   Economic News Release, March 2010 U.S.--Total
                                                                   employer costs per hour worked for employee
                                                                   compensation: Civilian workers; Occupational
                                                                   Group: Service-providing at (https://www.bls.gov/news.release/ecec.t01.htm) and
                                                                   adjusts annually by 2.78 percent to reflect
                                                                   an l average increase in total compensation
                                                                   costs from 2005-2009.
----------------------------------------------------------------------------------------------------------------
\1\ Note that there may be circumstances where a laboratory is able to comply with both HIPAA and the State law.


[[Page 56717]]


                     Table 2--Summary of Assumptions
------------------------------------------------------------------------
            Variable                      Low                High
------------------------------------------------------------------------
Number of test results per test   10 test results...  20 test results.
 report.
Percentage of patients            0.05%.............  0.50%.
 requesting test report.
Time required to process request  10 minutes........  30 minutes.
 for test report.
------------------------------------------------------------------------

    We determined that the impacted CLIA-certified laboratories can be 
broken down into four categories: laboratories in States and 
territories where there is no law regarding who can receive test 
reports (N = 26), laboratories in States and territories where test 
reports can only be given to the provider (N = 13), laboratories in 
States and territories that allow test reports to go directly to the 
patient through some means or mechanism (N = 9), and laboratories in 
States and territories that allow the test reports to go to the patient 
with provider approval (N = 7) (see Table 3 for a list of states and 
territories by category). Of these four categories, we believe that 
laboratories in the 39 States and territories where there is either no 
law regarding receipt of test reports or where reports can only go to 
the provider would be affected by the proposals contained in this 
rulemaking. Laboratories in the remaining categories would most likely 
have existing procedures in place to respond to patient requests for 
test reports, whereas the laboratories in the first two categories 
would most likely not have procedures in place and would have to 
develop mechanisms for handling these requests and providing access.

         Table 3--Impact of Proposed Rule Change on Laboratories
------------------------------------------------------------------------
        Impacts laboratories             Does not impact laboratories
------------------------------------------------------------------------
                                                           Allows test
                      Allows test        Allows test       reports to
   No State law     reports only to      reports to       patient with
                        provider           patient          provider
                                                            approval
------------------------------------------------------------------------
Alabama            Arkansas           Delaware          California
Alaska             Georgia            District of       Connecticut
                                       Columbia
Arizona            Hawaii             Maryland          Florida
Colorado           Illinois           New Hampshire     Massachusetts
Guam               Kansas             New Jersey        Michigan
Idaho              Maine              Nevada            New York
Indiana            Missouri           Oregon            Virginia
Iowa               Pennsylvania       Puerto Rico       ................
Kentucky           Rhode Island       West Virginia     ................
Louisiana          Tennessee
Minnesota          Washington
Mississippi        Wisconsin
Montana            Wyoming
Nebraska
New Mexico
North Carolina
North Dakota
N. Mariana
 Islands
Ohio
Oklahoma
South Carolina
South Dakota
Texas
Utah
Vermont
Virgin Islands
------------------------------------------------------------------------

    The CMS Online Survey, Certification, and Reporting (OSCAR) 
database indicates that there are a total of 22,671 laboratories which 
provide approximately 6.1 billion tests annually (see Table 4) in the 
39 States and territories impacted by this rule. We assume Certificate 
of Waiver laboratories and Certificate of PPM laboratories would not be 
impacted because the tests are usually performed in these sites during 
a patient's visit. We assume that the physician or health practitioner 
would inform the patient of those results during the visit, and we 
anticipate that the patient would ask that person with whom they 
interacted as opposed to the laboratory, if they have reason to seek 
copies of the test report in the future. We request public comments on 
the potential impact of this rule on Certificate of Waiver and 
Certificate of PPM laboratories.
    If the proposals contained in this rule are finalized, most of 
these 22,671 laboratories will need to develop processes and procedures 
to provide direct patient access to test reports. However, we recognize 
that some of these 22,671 laboratories may not be covered entities 
under HIPAA (because they do not conduct covered health care 
transactions electronically, for example, filing electronic claims for 
payment) and therefore would not be required to provide direct patient 
access. We do not have information on the number of laboratories that 
are not covered entities under HIPAA and invite comment on this issue.

[[Page 56718]]



  Table 4--Number of Impacted Laboratories and Tests per Year in the 39
                     Affected States and Territories
------------------------------------------------------------------------
                                       Number of
              State                  laboratories       Number of tests
------------------------------------------------------------------------
Alabama.........................                 851         243,512,093
Alaska..........................                  95           8,456,680
Arizona.........................                 563         194,894,073
Arkansas........................                 513          66,845,370
Colorado........................                 498         125,645,501
Georgia.........................               1,172         194,786,593
Guam............................                  12           2,055,709
Hawaii..........................                 124          32,566,029
Idaho...........................                 231          25,623,535
Iowa............................                 536          75,797,879
Illinois........................               1,077         497,900,106
Indiana.........................                 640         172,798,521
Kansas..........................                 442         239,488,953
Kentucky........................                 697         110,373,950
Louisiana.......................                 666         119,794,280
Maine...........................                 138          32,909,637
Minnesota.......................                 831         145,496,862
Missouri........................                 665         163,380,564
N. Mariana Isl..................                   3              88,177
Mississippi.....................                 617          74,187,598
Montana.........................                 157          24,428,257
N. Carolina.....................               1,424         288,449,078
N. Dakota.......................                 139          19,783,502
Nebraska........................                 372          64,790,081
New Mexico......................                 190          42,105,436
Ohio............................               1,112         345,544,798
Oklahoma........................                 531         108,564,207
Pennsylvania....................               1,095         487,529,546
Rhode Island....................                 110          35,429,909
S. Carolina.....................                 709          92,320,737
S. Dakota.......................                 211         664,345,948
Tennessee.......................               1,070         219,535,503
Texas...........................               3,211         783,048,259
Utah............................                 315          61,663,359
Vermont.........................                  81           9,894,769
Virgin Islands..................                  12           1,902,023
Washington......................                 727         176,535,389
Wisconsin.......................                 748         146,846,804
Wyoming.........................                  86           9,359,277
                                 ---------------------------------------
    Totals......................              22,671       6,108,678,992
------------------------------------------------------------------------
Data from the CLIA OSCAR database accessed on 7/8/2010.
The ``Number of tests'' is self reported by the laboratory without
  validation.
Includes only moderate and high complexity laboratories issued a CLIA
  Certificate of Registration, Certificate of Compliance, or Certificate
  of Accreditation.

    We assume that the development of the mechanisms to provide patient 
access to laboratory test reports would be a one-time burden and that 
each laboratory would develop its own unique policies and procedures to 
address patient access or adopt mechanisms/procedures developed by 
consultants or associations representing laboratories. We assume a one-
time burden of 2-9 hours to identify the applicable legal obligations 
and to develop the processes and procedures for handling patient 
requests for access to test reports. While we provide a range of burden 
estimates in this proposed rule, for purposes of OMB review and 
approval we will submit burden estimates based on 9 hours. We also 
assume an hourly rate for a management level employee to be $50.06 (see 
Table 1).
    The range of costs for laboratories to develop the necessary 
processes and procedures for handling patient requests would be:

2 hours x $50.06 per hour = $100.12 per laboratory x 22, 671 
laboratories = $2,269,821
9 hours x $50.06 per hour = $450.54 per laboratory x 22, 671 
laboratories = $10,214,192

    The burden associated with responding to test report requests is 
dependent upon the total number of test reports that exist in affected 
laboratories, the percent of the results that would be requested and 
the cost of producing these reports for those individuals who ask for 
direct access.
    Laboratory test reports are commonly understood to contain multiple 
test results with many laboratory tests being ordered as panels of 
tests. Each laboratory may have their own unique test report panels 
which may contain anywhere from 1 to 20 individual test results.
    Using a range of 10 to 20 test results in a test report, we 
estimated the annual number of test reports that may be requested to 
be:

6,108,678,992 tests per year/20 tests per report = 305,433,950 test 
reports/year
6,108,678,992 tests per year/10 tests per report = 610,867,899 test 
reports/year

    We are unaware of any data that would provide a reasonable estimate 
for the number of patients who would

[[Page 56719]]

request test reports from laboratories if they are available. We are 
soliciting public comments in order to better estimate the number of 
patient requests a laboratory might receive. We assume a range of 1 in 
2,000 patients (0.05%) to 1 in 200 patients (0.50%) would request 
direct access to his or her test report.
    Using these figures the range of the number of patient requests per 
year would be:

305,433,950 test reports per year x .0005 = 152,717 patient requests 
per year
610,867,899 test reports per year x .005 = 3,054,339 patient requests 
per year

    The processing of a patient request for a test report generally 
covers steps from actual receipt of the patient's request to the 
delivery of the report and documentation of the delivery. Requests for 
laboratory results are usually handled by staff that is not management 
level. Due to the lack of data that indicates the amount of time it 
takes for staff to process a test report request, we assume a range of 
10 to 30 minutes to handle a request from start to finish. We also 
assume an hourly rate for a clerical level employee to be $30.09 (see 
Table 1)).
    Using these figures, we calculated the range of costs to produce 
one test report:

$30.09 per hour/60 minutes per hour = $0.50/minute
$0.50 per minute x 10 minutes = $5.00
$.50 per minute x 30 minutes = $15.00

We then multiplied this range by the range of the anticipated number of 
patient requests to obtain a range of costs to provide the patient 
requests per year:

152,717 patient requests per year x $5.00 = $763,585
3,054,339 patient request per year x $15.00 = $45,815,092

We then added the cost to develop the processes and procedures for 
handling patient requests to the cost to provide the test reports to 
obtain the range of the total costs to laboratories to provide patients 
with his or her test report upon request in 2011:

$2,269,821 cost to develop process + $763,585 cost to provide test 
reports = $3,033,405
$10,214,192 cost to develop process + $45,815,092 cost to provide test 
reports = $56,029,285 annual cost (undiscounted 2010 dollars)

                                                                  Table 5--Estimated Annual Recordkeeping and Reporting Burden
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                                                                          Hourly labor   Total labor      Total
                                                                                                               Burden per   Total annual     cost of       cost of      capital/     Total cost
             Regulation section(s)                       OMB  Control No.          Respondents    Responses     response       burden       reporting     reporting    maintenance       ($)
                                                                                                                 (hours)       (hours)         ($)           ($)       costs  ($)
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
42 CFR 493.1291................................  0938-New.......................        22,671        22,671             9       204,039         50.06    10,214,192             0    10,214,192
45 CFR 493.1291................................  0938-New.......................     3,054,339     3,054,339            .5     1,527,170         30.09    45,815,092             0    45,815,092
                                                ------------------------------------------------------------------------------------------------------------------------------------------------
    Total......................................  ...............................     3,077,010     3,077,010  ............     1,731,209  ............  ............  ............    56,029,285
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    We have provided an analysis of burden based on available 
information and certain assumptions. We request comments from 
laboratories that currently provide direct access to test reports for 
patients as to how they handle these requests (for example, through a 
Web portal, fax, hard-copy, with or without fees, etc) and the extent 
to which patient requests impact business operations. The Department 
solicits comments additionally on best practices in the direct 
provision of patients' laboratory results. We also request comment on 
the burdens associated with providing electronic formats as requested 
by individuals, machine readable or otherwise.
    To obtain copies of the supporting statement and any related forms 
for the proposed paperwork collections referenced above, access CMS' 
Web site address at https://www.cms.hhs.gov/PaperworkReductionActof1995, 
or E-mail your request, including your address, phone number, OMB 
number, and CMS document identifier, to Paperwork@cms.hhs.gov, or call 
the Reports Clearance Office on (410) 786-1326.
    If you comment on these information collection and recordkeeping 
estimates, please do either of the following:
    1. Submit your comments electronically as specified in the 
ADDRESSES section of this proposed rule; or
    2. Submit your comments to the Office of Information and Regulatory 
Affairs, Office of Management and Budget, Attention: CMS Desk Officer, 
CMS-2319-P, Fax: (202) 395-6974; or E-mail: OIRA_submission@omb.eop.gov.

IV. Response to Comments

    Because of the large number of public comments we normally receive 
on Federal Register documents, we are not able to acknowledge or 
respond to them individually. We will consider all comments we receive 
by the date and time specified in the DATES section of this preamble, 
and, when we proceed with a subsequent document, we will respond to the 
comments in the preamble to that document.

V. Regulatory Impact Analysis

A. Overall Impact

    We have examined the impacts of this rule as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993), 
Executive Order 13563 on Improving Regulation and Regulatory Review 
(February 2, 2011), the Regulatory Flexibility Act (RFA) (September 19, 
1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, 
section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 
1995; Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 
1999), and the Congressional Review Act (5 U.S.C. 804(2)).
    Executive Orders 13563 and 12866 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). Executive 
Order 13563 emphasizes the importance of quantifying both costs and 
benefits, of reducing costs, of harmonizing rules, and of promoting 
flexibility. This rule has been designated a ``significant regulatory 
action'' although not economically significant, under section 3(f) of 
Executive Order 12866. Accordingly, the rule has been reviewed by the 
Office of Management and Budget.
    Laboratories regulated under CLIA that do not currently provide 
patients with an opportunity to receive, upon request, a copy of their 
laboratory test report (defined in CLIA regulations at Sec.  493.1291) 
would be affected by this proposed rule. According to CMS OSCAR 
database accessed on July 8, 2010, there are 214,875 laboratories in 
the United States that are subject to CLIA. OSCAR is a data network 
maintained by CMS in cooperation with

[[Page 56720]]

the State surveying agencies and accrediting organizations that 
provides a compilation of all the data elements collected during 
inspection surveys conducted at laboratories for the purpose of 
certification for participation in the Medicare and Medicaid programs. 
Of the total CLIA-certified laboratories identified in the OSCAR 
database, we believe approximately 192,204, or 90 percent, of these 
would not be impacted by this change because they perform testing 
either under a Certificate of Waiver or Certificate of Provider 
Performed Microscopy (PPM) or they are located in States that already 
allow the laboratory to provide patient access to test reports, either 
directly or with provider approval. Removing the step in which the 
provider grants permission to the laboratory should not pose an 
additional impact on the laboratory, as we believe these laboratories 
already have processes in place to provide patients access to test 
reports once that permission is received.
    We expect that 22,671 laboratories located in the 39 states and 
territories identified in Table 3 as having no State law or a State law 
that provides test reports only to the provider would be impacted by 
the changes outlines in this proposed rule.
    We believe that, if finalized, this proposed rule would not 
constitute an economically significant rule because we estimate the 
range of overall annual costs that would be expended by the affected 
laboratories would be less than $100 million for 2011.
    The RFA requires agencies to analyze options for regulatory relief 
of small entities, if a rule has a significant impact on a substantial 
number of small entities. For purposes of the RFA, we assume that the 
great majority of medical laboratories are small entities, either by 
virtue of being nonprofit organizations or by meeting the SBA 
definition of a small business by having revenues of less than $13.5 
million in any 1 year. We believe at least 83 percent of medical 
laboratories qualify as small entities based on their nonprofit status 
as reported in the American Hospital Association Fast Fact Sheet 
updated June 24, 2010 (https://www.aha.org/aha/resource-center/Statistics-and-Studies/Fast_Facts_Nov_11_2009.pdf.)
    Other options for regulatory relief of small businesses as 
discussed in section E of this proposed rule, were determined not to be 
feasible and therefore these options were not analyzed for this 
proposed rule. We believe any alternative to allowing the laboratory to 
provide patient access to test reports would be counterproductive to 
HHS efforts to provide patient-centered healthcare. We are unaware of 
any instances in which the changes included in this proposed rule would 
affect health care entities operated by small government jurisdictions. 
We are requesting public comments in this area, particularly from 
laboratories in state health departments (including Newborn screening), 
prisons, school clinics or state universities that would be impacted, 
to assist us in making this determination in the final rule.
    Section 1102(b) of the Social Security Act also requires us to 
prepare a regulatory impact analysis if a rule may have a significant 
impact on the operations of a substantial number of small rural 
hospitals. This analysis must conform to the provisions of section 603 
of the RFA. For purposes of section 1102(b) of the Act, we define a 
small rural hospital as a hospital that is located outside of a 
metropolitan statistical area and has fewer than 100 beds. We do not 
expect this proposed rule would have a significant impact on small 
rural hospitals. The proposed rule would only apply to laboratories. If 
a small rural hospital were to operate its laboratory such that it 
would have to adopt means of complying with these proposed provisions, 
we anticipate that it would require minimal effort to put policies and 
procedures in place to respond to patient requests to the laboratory as 
we expect that the cahospital would already have procedures in place 
for responding to patient access requests for hospital records under 
the HIPAA Privacy Rule. We believe that these existing policies and 
procedures should be easy to translate for use in direct access 
requests to hospital-operated laboratories. Therefore, the Secretary 
has determined that this proposed rule, if finalized, would not have a 
significant impact on the operations of a substantial number of small 
rural hospitals.
    Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. In 2011, that 
threshold is approximately $136 million. We do not anticipate this 
proposed rule would impose an unfunded mandate on states, tribal 
governments, or the private sector of more than $136 million annually. 
We request comments from States, tribal governments, and the private 
sector on this assumption.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a proposed rule (and subsequent 
final rule) that imposes substantial direct requirements and costs on 
state and local governments, preempts State law, or otherwise has 
Federalism implications.
    The proposed changes to the CLIA regulations at Sec.  493.1291 
would not have a substantial direct effect on State and local 
governments, preempt State law, or otherwise have a Federalism 
implication and there is no change in the distribution of power and 
responsibilities among the various levels of government. We believe 
that this change is compatible with existing State law for 35 States 
and territories as shown in Table 6. Of the 35, we believe that nine 
already allow the laboratory to release test reports directly to the 
patient. In 26 States and territories, we believe that the licensing 
statutes and regulations are silent with respect to who is authorized 
to receive laboratory test reports. If finalized, the CLIA regulations 
will allow laboratories in these States and territories to provide, 
upon a patient's request, direct access to the patient's identifiable 
test reports.
    The Federalism implications of the Privacy Rule were assessed as 
required by Executive Order 13132 and published as part of the preamble 
to the final rule on December 28, 2000 (65 FR 82462, 82797). Regarding 
preemption, though the proposed changes to the Privacy Rule will 
preempt a number of State laws (see Table 6, below), this preemption of 
State law is consistent with the preemption provision of the HIPAA 
statute. The preamble to the final Privacy Rule explains that the HIPAA 
statute dictates the relationship between State law and Privacy Rule 
requirements, and the rule's preemption provisions do not raise 
Federalism issues.
    We do not believe that this rule would impose substantial direct 
compliance costs on State and local governments that are not required 
by statute. We do not believe that a significant number of laboratories 
affected by these proposals are operated by State or local governments. 
Therefore, the proposed modifications in these areas would not cause 
additional costs to State and local governments.
    In considering the principles in and requirements of Executive 
Order 13132, the Department has determined that this proposed 
modification to the Privacy Rule will not significantly affect the 
rights, roles and responsibilities of the States.

[[Page 56721]]



 Table 6--Existing Laws in States/Territories Pertaining to Test Reports
------------------------------------------------------------------------
    HIPAA will preempt State law           Compatible with State law
------------------------------------------------------------------------
                      Allows test
   Allows test         reports to        Allows test
 reports only to      patient with       reports to       No State law
     provider      provider approval       patient
------------------------------------------------------------------------
Arkansas           California         Delaware          Alabama
Georgia            Connecticut        District of       Alaska
                                       Columbia
Hawaii             Florida            Maryland          Arizona
Illinois           Massachusetts      New Hampshire     Colorado
Kansas             Michigan           New Jersey        Guam
Maine              New York           Nevada            Idaho
Missouri           Virginia           Oregon            Indiana
Pennsylvania                          Puerto Rico       Iowa
Rhode Island                          West Virginia     Kentucky
Tennessee                                               Louisiana
Washington                                              Minnesota
Wisconsin                                               Mississippi
Wyoming                                                 Montana
                                                        Nebraska
                                                        New Mexico
                                                        North Carolina
                                                        North Dakota
                                                        N. Mariana
                                                         Islands
                                                        Ohio
                                                        Oklahoma
                                                        South Carolina
                                                        South Dakota
                                                        Texas
                                                        Utah
                                                        Vermont
                                                        Virgin Islands
------------------------------------------------------------------------

B. Anticipated Effects

    The current CLIA regulations and related laws of the States and 
territories pose potential barriers to the laboratory exchange of 
health care information (test reports) directly with the patient. These 
proposed regulatory changes would amend Sec.  493.1291(f) and add Sec.  
493.1291(l) to the CLIA regulations and also amend Sec.  164.524 of the 
Privacy Rule. These changes are being made in support of HHS' efforts 
toward achieving patient-centered and health IT-enabled healthcare and 
would allow patients direct acces