ONC Vindicated. Patients Want Immediate Access to Test Results

by | Mar 24, 2023 | HIPAA, Information Blocking, Tools & Resources

  • JAMA study finds 95.7% of patients overall would like to receive immediately released test results, even if it meant reviewing their results before their providers.

  • JAMA study also found 95.3% of patients who received abnormal test results also want to to continue to receive immediately released results.

  • But, receiving abnormal results was associated with nearly twice the likelihood of worry compared to respondents who received normal results.

Subscribe HERE to Legal HIE’s backend compliance library to gain access to tools, checklists, whitepapers, sample policies and a lot more to help your organization stay on top of the newest compliance challenges in 2023! 

JAMA Network Open, a publication of the American Medical Association (AMA), published a study earlier this week in which 8,000 patients who accessed their test results via an online patient portal were asked whether they wanted to continue to immediately receive test results through their portal. The general finding? ….. More than 95% wanted such immediate access to test results to continue.

I find this conclusion particularly interesting considering the specific concerns commentators submitted to ONC received during rulemaking of the Information Blocking Rule (IBR). Even after the IBR was published, many clinicians accustomed to a “default delay” (e.g., 5 days) before releasing a test result to the patient pushed back against their compliance and legal folks who were attempting to implement the new “no delay” standard. During the IBR rulemaking process, commentators argued to ONC that,

“[c]linical experience indicates a systematic and substantial risk that releasing some patient data through a patient portal or API without first communicating the particular results or diagnosis with the patient in a more interactive venue would pose risks of substantial harm’ to patients.”

One example cited was genetic testing results which could indicate a high risk of developing a neurodegenerative disease for which there is no effective treatment or cure. Commentators recommended that ONC allow delay of the electronic release of such genetic testing results so that families are not exposed to this information without appropriate counseling and context. See 85 Fed Reg at 25843.  One commentators even asserted that,

“[d]elivery by the clinician of the combined results, counseling, and context is clinically appropriate and consistent with the conclusions of relevant research.”

However, at the time, ONC was not convinced that the required “harm” standard was met to justify withholding or delaying test results to patient who request them. It pointed out,   

“Currently [the HIPAA Privacy Rule] requires that for a covered entity to deny an individual access to their PHI within the designated record set, the disclosure of that PHI must be reasonably likely to endanger the life or physical safety of the patient or another person. No commenter cited evidence that routinely delaying EHI availability to patients in the interest of fostering clinician-patient relationships substantially reduces danger to life or physical safety of patients or other persons that would otherwise routinely arise from patients’ choosing to access the information as soon as it is finalized.” see 85 Fed Reg at 25842.

What many covered entity providers often do not realize is that when ONC adopted the “danger to life or physical safety” standard to allow potential withholding of test results from a patient, this was not a new requirement.  During the HIPAA Privacy Rule rulemaking, HHS had already explained its interpretation of this standard when attempting to “deny” a patient’s request for access to his/her protected health information (PHI). Specifically, back in 2000, HHS had explained,

“If a licensed health care professional determines that an individual exhibits such tendencies and that permitting inspection or copying of some of the individual’s [PHI] is reasonably likely to result in the individual committing suicide, murder, or other physical violence, then the health care professional may deny the individual access to that information. Under this reason for denial, covered entities may not deny access on the basis of the sensitivity of the health information or the potential for causing emotional or psychological harm.” 65 Fed Reg at 82555 (December 28, 2000).

So, in general, health care providers should already be adhering to this “harm” standard when deciding to withhold or deny a patient’s request to access his/her test result.

One thing that both the JAMA study and ONC support is patients’ choice (i.e., does the patient want to have access to his/her test result immediately). During rulemaking, ONC recognized,

“[w]e believe that where applicable law does not prohibit making particular information available to a patient electronically before it has been conveyed in another way, deference should generally be afforded to patients’ right to choose whether to access their data as soon as it is available or wait for the provider to contact them to discuss their results.”  See 85 Fed Reg at 25842.

But, were clinicians correct when they raised concerns to ONC that releasing abnormal test results without “appropriate counseling and context” might not be “clinically appropriate?” When speaking to ONC, the JAMA study’s lead researcher, Bryan Steitz, specifically noted that although 95.3% of patients who received abnormal test results responded that they still would like to continue to receive immediately released results, such “immediate” access to abnormal results was associated with nearly twice the likelihood of worry compared to respondents who received normal results. See www.healthit.gov/buzz-blog/information-blocking/new-study-shows-patients-prefer-immediate-access-to-test-results-and-have-unmet-information-needs

Interesting.

So, what are the takeaways in light of the JAMA study?  First and foremost, I think it reaffirms that allowing for patients to choose when they want to access their test results is important. For health care providers that have not implemented a process for this choice to be captured in one or more ways, including during an office visit and also as part of the patient portal registration/log-on process, they should strongly consider doing so. Yet, I think the fact that patients who receive a negative result were found to “more worry” should also not be dismissed. In fact, this finding is consistent with exactly this concern raised by commentators during the IBR rulemaking process. Yet, the HIPAA and IBR “harm” standard is clear – emotional distress and psychological harm are not enough to allow a health care provider to unilaterally withhold test results from patients. However, what providers can do is introduce additional education about the potential “downsides” of their receiving immediate access to test results.  That is NOT to say that health care providers should begin discouraging patients from choosing to access test results immediately; but, educating patients about the “pros & cons” of receiving a test results immediately (e.g., “more worry” if negative) versus from his/her clinician (e.g., “counseling, context and support”), I believe, is appropriate and consistent with informed choice.

_________________________

If you are not a subscriber to our backend Legal HIE compliance library, download our Table of Contents here to check out all of the tools, checklists, whitepapers, sample policies and more we make available to our members to help their organizations comply with Information Blocking, HIPAA, 42 CFR Part 2, Data Breaches and more. Ready to subscribe now? Click here to review our subscription options.

 

Print Friendly, PDF & Email
Share this:

If you are not a subscriber to our backend Legal HIE compliance library, download our Table of Contents here to check out all of the tools, checklists, whitepapers, sample policies we make available to our members to help their organizations comply with Information Blocking, HIPAA, 42 CFR Part 2, Data Breaches and more. Ready to subscribe now? Click here to review our subscription options.

Archives