Regulatory Conflict in HHS Privacy, Lab Rules to Get Review

Stay ahead of developments in federal and state health care law, regulation and transactions with timely, expert news and analysis.

By Jeannie Baumann

A new National Academies project aims to tackle a long-standing discrepancy that pits the HIPAA Privacy Rule against laboratory testing requirements for when a research lab can share results with patients.

The Health Insurance Portability and Accountability Act Privacy Rule requires research subjects to have access to their data on request. But these data can’t be shared if they’re from a research laboratory that isn’t certified under a 2014 final rule about the Clinical Laboratory Improvement Amendments, which are regulated by the Centers for Medicare & Medicaid Services. Most research laboratories in HIPAA-covered entities such as academic medical centers aren’t CLIA certified, creating a regulatory conundrum between the two Department of Health and Human Services rules.

More research studies, both academic and industry-sponsored, are using non-CLIA-certified research laboratories to run their tests as part of protocols that have been approved by institutional review boards, a group of research attorneys wrote in a 2015 Bloomberg BNA Insights, The CLIA/HIPAA Conundrum of Returning Test Results to Research Participants.

“This conflict between the legal requirements of CLIA and HIPAA—the regulations and interpretations of two offices within HHS—has therefore further complicated an already difficult set of ethical calculations regarding the return of research tests’ results to research participants.”

The HHS Secretary’s Advisory Committee on Human Research Protections issued recommendations on this regulatory conflict two years ago as part of a larger recommendation on the return of research results. They called on the relevant agencies to clarify what to do when individuals ask for their research tests run through a non-CLIA lab in a HIPAA-covered entity. They further recommended the CMS take a “more nuanced approach to the provision of results to individuals, upon their request, from non-CLIA-certified research labs that conduct research tests.”

Precision Medicine, Common Rule

Carrie Wolinetz, the National Institutes of Health’s policy director, noted the National Academies project comes as the NIH is recruiting 1 million people for its precision medicine study. "[A] central tenet of the program will also make data available to those participants, as well as the findings of research that use their samples and data,” she wrote in a May 30 blog. “Recent revisions to the Common Rule [on human research protection] have anticipated this movement, and the changes that will take effect in 2018 include new provisions that are specific to the return of research results.”

The National Academies project website said a committee would make “recommendations on the issue of returning individual-specific research results generated in research laboratories that are regulated by CLIA, and also taking into consideration any other applicable laws or regulations.” No completion date was listed.

On top of the CLIA-HIPAA regulatory conflict, Wolinetz added, the Food and Drug Administration medical device regulations may also require additional measures before returning individual-level research results.

“As the research enterprise works to determine how and when to provide participants access to their individual-level research results and data, questions have emerged regarding whether the current regulatory environment is conducive to such access,” she wrote.

The NIH, FDA, and CMS are sponsoring the study, Wolinetz said. The National Academies will convene a committee with representatives from a diverse set of viewpoints, she said, including clinicians, laboratory directors, researchers, research participants and advocates.

According to the National Academies website, the committee will:

  •  review the current evidence concerning the return of individual-specific research results to individuals,
  •  review the current regulatory environment for conducting tests and returning individual-specific research results,
  •  review current practices in returning research results and identify what are considered to be best practices, if any, for doing so,
  •  identify and assess available evidence of benefits and harm to individuals and society regarding the return of research results generated in research laboratories, and
  •  make recommendations on the issue of returning individual-specific research results generated in research laboratories that are regulated by CLIA, and also taking into consideration any other applicable laws or regulations.

To contact the reporter on this story: Jeannie Baumann in Washington at

To contact the editor responsible for this story: Randy Kubetin at

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Health Care on Bloomberg Law