Last week the Department of Health and Human Services (“HHS”) announced that it has postponed the Sept. 23, 2013, HIPAA Omnibus Rule deadline for many clinical laboratories to revise their notices of privacy practices (“NPPs”). This means, with limited exceptions, that HHS will take no enforcement action against clinical laboratories that have not as yet revised their NPPs. HHS plans to issue a public notice at least 30 days before eliminating this enforcement delay and starting to enforce the requirement for updated NPPs.
Which clinical labs are affected by the HHS enforcement delay?
HHS’s enforcement delay extends to all CLIA and CLIA-exempt clinical laboratories (i.e., licensed in the states of New York or Washington), except:
-
Clinical laboratories presently required by state law to provide individuals with access to their laboratory test reports; and
-
Clinical laboratories that operate as part of a larger legal entity, such as a hospital, and therefore do not have their own, laboratory-specific, NPPs.
Why did HHS delay enforcement action?
HHS has chosen to delay enforcement to allow time for HHS to finalize its amendment (which was proposed Sept. 14, 2011) to the HIPAA Privacy Rule and CLIA regulations to permit individuals to receive their lab results directly from CLIA and CLIA-exempt laboratories. Once that amendment is final, clinical laboratories will have to make changes to their NPPs to inform individuals of the material change. As a result, HHS exercised its enforcement discretion to extend the Sept. 23 deadline to allow affected laboratories to avoid the burden and expense of multiple revisions to their NPPs within a short period of time—once to meet the Sept. 23 Omnibus Rule deadline and yet again to incorporate the changes of the impending CLIA/HIPAA amendment.
What should laboratories do now?
Except as noted above, CLIA and CLIA-exempt laboratories will not need to worry about facing HHS enforcement actions for failing to comply with Monday’s deadline. Affected laboratories, however, should watch for the final CLIA/HIPAA rule regarding access to lab results, and for HHS’s announcement that the enforcement delay will soon end. In the meantime, affected laboratories should identify and make ready the other changes to their NPPs necessitated by the Omnibus Rule so that they can promptly issue fully updated NPPs once HHS issues the final CLIA/HIPAA rule on access to lab results.
