A regulatory conflict exists between HIPAA and CLIA

CLIA permits returning results to individuals for the “diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of, human beings” only if results are generated in a CLIA-certified laboratory.

Centers for Medicare and Medicaid Services (CMS) representatives appear to interpret this provision as prohibiting the return of results from a research laboratory and recommend referring an individual for re-testing (even if a potentially actionable result is found) at a CLIA-certified laboratory.

In contrast, HIPAA requires providing access to information held in the Designated Record Set (DRS), which may include research test results, depending on whether the test results are included in the covered entity’s medical record, billing record, or otherwise used to make decisions about the individual, such as determining whether to offer the individual enrollment in a research study.

These regulations conflict when research participants desire access to test results from a non-CLIA-certified research laboratory that exists within a HIPAA covered entity.

Joint HIPAA/CLIA Rule (2014):

With the intent of harmonizing CLIA and HIPAA on individuals’ access rights, a joint CMS/Office for Civil Rights (OCR) rule was issued in 2014.

• The Rule amended CLIA to permit CLIA-certified laboratories to give completed test results directly to a patient or the patient’s representative.
• The Rule amended HIPAA to require laboratories that are “covered entities” subject to HIPAA to provide patients access rights to their protected health information (PHI) held in a designated record set (DRS). The DRS includes a covered entity’s medical record, billing record, and other records that are used by the covered entity to make decisions about the individual.
• Regarding the return of IRR, this rule reduces barriers for participants to obtain CLIA-certified research results. The rule expresses support for a legal right of access to one’s personal results, but remains unclear as to the return of IRR from CLIA-exempt labs, even when those results exist in a HIPAA-covered DRS.

What should researchers do?

There are licensing requirements in many countries, including CLIA regulations in the US. Researchers should consult with their legal department for guidance on how to return IRR in any regulatory environment, including from CLIA-exempt labs in the US.

The Secretary’s Advisory Committee on Human Research Protections (SACHRP) has released recommendations on how to amend this regulatory conflict, which can be a starting point for organizations deciding how to approach. Recommendations and analysis have also been provided by the National Academies of Sciences, Engineering, and Medicine (NASEM).

In general, if a result is generated in a CLIA-approved lab, it can be shared in accordance with other details in the return of IRR plan. When creating the IRR plan in advance of study initiation, whether test results will require action should be considered. If they are likely to result in actionable results, they should be performed in a CLIA-approved lab. If that is not possible, a plan for rapid re-testing in a CLIA-approved lab is needed.

Reminder: why this matters

We encourage researchers not to get dissuaded by the complexity that may be introduced by returning IRR. We elaborate elsewhere about why to get started but will reiterate these points: returning IRR is rooted in ethical principles of research, meets participants’ wishes, shares the value created by their research participation, and anticipates/responds to evolving expectations about data transparency and ownership.

Take a look at how to get started.