CMS SOM App. C, Tag D5811

(f) Except as provided in §493.1291(l), test results must be released only to

authorized persons and, if applicable, the persons responsible for using the test

results and the laboratory that initially requested the test.

Interpretive Guidelines §493.1291(f)

Test results must be released to the authorized person and, if the authorized person is a

patient, the patient’s personal representatives and those persons specified under 45 CFR

164.524(c)(3)(ii), as applicable. If the authorized person is not a patient, test results must

be released to the authorized person, and, if applicable, the persons responsible for using

the test results and the laboratory that initially requested the test. Test results must also

be released to any additional individuals/entities designated on the test requisition. These

entities are understood to be “responsible for using” the test results.

When the authorized person, and, if applicable, the individual responsible for using the

test results receives the results, the laboratory’s CLIA responsibility ends. When a

reference laboratory receives a specimen from another referring laboratory, the referring

laboratory is responsible for getting the results back to the authorized person and, if

applicable, any individuals responsible for using the results.

See D5301 for the definition of an “authorized person”.

Probes §493.1291(f)

What security measures have been instituted to ensure that reports go directly from the

device sending reports (e.g., LIS, facsimile) to the authorized person and: (i) if the

authorized person is a patient, the patient’s personal representatives and those persons

specified under 45 CFR 164.524(c)(3)(ii), as applicable; and (ii) if the authorized person

is not a patient, the persons who are identified as responsible for using the test results and

the laboratory that initially requested the test, as applicable?

How does the laboratory ensure that only the authorized person(s) can access a patient’s

results?