Action: Change The Rules and Get Your Labs

Dear HealthDataRights.org endorser,

We have an timely opportunity to put HealthDataRights into action! On Tuesday, the Health IT Policy Committee at ONC is holding a hearing regarding CLIA laws and access by consumers to their own test results. We have a unique chance to speak with one, resounding voice that the federal barriers to patient access to test results should be removed. Dr. Phil Marshall of WebMD will be testifying at the hearing, and he will be presenting the attached consensus letter that provides background on the issue, recommends two common sense ways the federal laws can be changed to allow greater access, and the benefits of making those changes. This letter has been vetted by some of the top health data experts and health data privacy lawyers. Here is a summary of the letter and what we’re asking you to do:

ISSUE: Federal regulations under the HIPAA Privacy Rule treat test results as a special case, separate from other protected health information. CMS has issued regulations that further state that results can only be delivered to “Authorized Persons”, which as it is currently defined does not include the patient who is the subject of the test.

PROPOSED CHANGE: We propose simply eliminating the special treatment of test result data, and have it be treated under HIPAA just like other protected health information. We also propose that Authorized Persons explicitly include the patient (upon request by the patient)

BENEFITS: While these changes do not address the state laws in a small number of states that further restrict access to test results, they remove substantial federal barriers to data access. It is unlikely to cause any harm because, under HIPAA, providers and labs generally would have up to 30 days to respond to the patient’s request, providing them great flexibility in how and when they deliver the test results. Also, because so many clinically significant test results (approximately 7%) are never reported to the patient, increased access can help ensure that test results aren’t “lost to the ether.” Third, because approximately 14% of labs and other tests are repeated because prior results aren’t available, making test results more available to consumers can help reduce this duplication and related costs. Finally, the explosion in health management applications and services that could make use of test results have the potential to help consumers better manage their health, make more informed health decisions, and help lower costs.

CALL TO ACTION

STEP 1: Simply email action@healthdatarights.org by close of business Monday October 20 with the following information:

That you support the letter, your name, and if you choose your organization.

Feel free to include stats, stories or other reasons why. (You can write if you don't support it as well).

STEP 2: Blog like crazy about this issue. Include stories. Include stats. Let’s generate some real energy around making this change!

HELP US CHANGE THESE LAWS. THIS IS JUST A FIRST STEP, BUT AN EXTREMELY IMPORTANT ONE!

And please help us to know additional actions that you feel might be appropriate for HealthDataRights.org to undertake.

You can download the letter as a PDF here
or see a posting of the full text here

Initial Signers of the letter:

Dr. Phil Marshall, WebMD
Dr. Daniel Sands, Harvard Medical School
Jamie Heywood, PatientsLikeMe
Dr. David Kibbe, The Kibbe Group, LLC
Nate McLemore, Microsoft
Adam Bosworth, Keas
Dave deBronkart, E-patients
Dr. Roni Zeiger, Google
Colin Evans, Dossia

A Consensus Letter to the Office of Civil Rights and the Centers for Medicare and Medicaid Services

A Consensus Letter to the Office of Civil Rights and the Centers for Medicare and Medicaid Services on the Need for Expanding the Rights of Individuals to Access their Test Results

October 20, 2009

To: Georgina Verdugo Director, Office of Civil Rights
US Department of Health and Human Services
To: Charlene Frizzera Acting Administrator, CMS
US Department of Health and Human Services
CC: Dr. David Blumenthal, National Coordinator for Health IT Dear Director Verdugo and Administrator Frizzera,

In 2003 the Office of Civil Rights enacted regulations pursuant to the Health Information Portability and Accountability Act (HIPAA) that gave individuals the right to access their protected health information. Section 164.524 of the Privacy Rule gave individuals a right to obtain a copy of protected health information, and the HITECH Act of 2009 broadened this right by providing that individuals can obtain a copy of their electronic record information in electronic format. This access right supports the intent of HIPAA to grant consumers greater knowledge and control over their information and is in line with the recent trend of consumers gaining secure online access to their own health data through Personal Health Records (PHRs).

Unfortunately, however, Section 164.524 of the Privacy Rule also included a provision, subsection (a)(iii)(A), which created an exception from this access right for protected health information maintained by a covered entity that is subject to the Clinical Laboratory Improvements Amendments of 1988 (CLIA), which includes test results from labs. In addition, regulations issued under 42 C.F.R. § 493.1291 issued by the Centers for Medicare and Medicaid Services (CMS), provide that test results must be released only to authorized persons and, if applicable, the individual responsible for using the test results. “Authorized person” is defined under 42 C.F.R. § 493.2 as “an individual authorized under state law to order tests or receive test results, or both.” Few states expressly authorize labs to release test results directly to patients. This regulatory framework has resulted in a complex tapestry of regulations that prevent individuals from gaining direct access to a copy of their test results in all but those few states. In essence, the combination of the HIPAA Privacy Rule, the CMS rule, and state laws has put test results in a uniquely restricted category compared to other protected health information and has impaired patients’ ability to see, save, share, and use their own test results.

We believe that it is time for this disparate treatment of test results to be changed. We believe that test results should be treated the same as other protected health information. And while we recognize that even with this change some state-specific medical privacy laws may still restrict patient access to test results, it is time to remove the substantial federal obstacles to patients’ access to test results. This is an important first step toward giving patients meaningful access to their health information so that they can better coordinate their care, realize cost savings, and track and improve their health over time.

Our recommendation is simply to make the following two changes:

(1) Remove subsection (a)(iii)(A) from 45 C.F.R. § 164.524. This change eliminates the disparate treatment of lab test results compared to other protected health information under HIPAA.

(2) Change 42 C.F.R. 493.1291(f) to the following: “Test results must be released only to (a) authorized persons, (b) if applicable, the individual responsible for using the test results and the laboratory that initially requested the test, and (c) upon request, the test subject.” This change clarifies that individuals can receive their results upon request.

First and foremost, this change is unlikely to cause harm. The greatest perceived risk with such a change is that patients would receive abnormal test results directly from a lab without any context or interpretation, resulting in emotional harm. But under Section 164.524 of the HIPAA Privacy Rule, covered entities/providers generally have up to 30 days to respond to an individual’s request for their information. While we recognize that in an era of electronic data 30 days is a very long time and eventually the 30 day rule should be reconsidered, this should afford ample opportunity for providers to consult with patients on test results, and it provides for a great deal of flexibility for how and when providers or labs might disclose test results. A lab might choose to release routine test results within a few days, for example, while delaying the results of more sensitive tests to allow more time for patient-provider consultation. Some health systems are already taking this approach. Kaiser Permanente has shown that delivering lab test results online directly to consumers in a timely fashion improves their patient relationships. [Silvestre A, et al, Health Affairs 28, no. 2 (2009): 334–344].

Second, this change could help remedy some harm which is already occurring in our health system. Approximately 7% of clinically significant test results – test results that would have a potential impact on the patient’s care – are not ever reported to patients, potentially delaying important treatment decisions and causing harm. [Casalino L. et al, Archives of Internal Medicine, June 22, 2009]. Giving greater access to consumers would help reduce the number of test results “lost to the ether.”

Third, practical impediments to the availability of test results at the time they are needed often results in lab tests being needlessly repeated, causing wasteful expenditures that are unacceptable at a time when policymakers are striving to bend the cost curve downward. Such redundancy is estimated to comprise over 14% of lab and radiology test orders and related costs [Kaelber, D. et al; The Value of Personal Health Records. Center for Information Technology Leadership; 2008]. If patients can get and maintain their own test results and make them directly available to providers when needed, they can help prevent unnecessary duplication of tests.

Finally, there is tremendous growth in useful health management applications and services that individuals could take advantage of if they had direct access to their test results. This potential explosion in improved patient self-management using these tools and services could be an important part of the transformation of our health care system.

It’s time to make these changes to help improve care and encourage greater consumer involvement in their health and health care. We feel that the two common-sense recommendations for changes to the federal regulations listed above are the best starting point, with the understanding that additional work will be necessary to address the complex tapestry of other state restrictions on patient access to and control of their own information. It’s time to make this change. A 1988 statute should not govern information access in 2009. Patients need and deserve the right to have meaningful, timely, and convenient access to all their health information, including their test results.

[To join email action@healthdatarights.org with your name and or affiliation and you will be added to the list until October 20]

Signers

Dr. Phil Marshall, WebMD

Dr. Daniel Sands, Harvard Medical School

Jamie Heywood, PatientsLikeMe

Dr. David Kibbe, The Kibbe Group, LLC

Nate McLemore, Microsoft

Adam Bosworth, Keas

Dave deBronkart, E-patients

Dr. Roni Zeiger, Google

Colin Evans, Dossia