On September 19, 2013, the U.S. Department of Health and Human Services (HHS) issued a statement that for certain laboratories, it is delaying enforcement of the requirement to revise the notice of privacy practices (NPP). This exemption only applies to laboratories that are NOT part of a larger institution (eg, hospital) and would not be included in a larger institution's NPP.
In the coming months, the Department anticipates publishing an amendment to the HIPAA Privacy Rule and the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations regarding the right of individuals to receive their test reports directly from CLIA and CLIA-exempt laboratories. (This is discussed in more detail on the following page). If the amendment is finalized as proposed, it would result in a material change to the privacy practices of the HIPAA-covered laboratories identified above. Consequently, the affected laboratories would need to ensure that their NPPs inform individuals of this new right and include a brief description of how to exercise the right.
Given the potential proximity of the two rulemakings, HIPAA-covered laboratories identified above are relieved of having to revise their NPPs twice within a short period of time, once by September 23, 2013, to comply with the Omnibus Rule, and again by the impending issuance of any CLIA-related amendment to the individual access requirements. Specifically, with respect to the HIPAA-covered laboratories identified above, the Office of Civil Rights (OCR) will not take enforcement action or seek to impose civil money penalties where the HIPAA-covered laboratory has not revised its NPP by September 23, 2013 to comply with the Omnibus Rule. OCR will issue a notice at least 30 days in advance to advise the public when this enforcement delay will end. The notice will be published on OCR's website at http://www.hhs.gov/ocr/hipaa/
, and, if applicable, included in any final rule regarding a CLIA-related amendment to the Privacy Rule.
Reference: Statement of delay in enforcement of HIPAA requirement for certain CLIA and CLIA-exempt laboratories to revise their notices of privacy practices (NPP). HHS website. Available at: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/clia-labs.html
. Accessed September 23, 2013.