I read on http://www.chcf.org/~/media/MEDIA%20LIBRARY%20Files/PDF/E/PDF%20ElectronicLabResultsExchangePolicy.pdf :

enter image description here

(CA = California).

which means patients used to not be authorized to access their lab results without an agreement from their provider.

Luckily, this absurd law changed last year:

While patients can continue to get access to their lab tests from their physicians, under the new rule, labs will be required to provide patients copies, including electronic copies, of their lab test results within 30 days of a request.

However, a Quest Diagnostics lab based in California told me that patients can have access to lab result's after a few weeks through their website, even though it takes less than one week for the lab to get the results and send them to the provider: I was told that Quest Diagnostics was not authorized not to release results to patients earlier:

Due to state laws in California (14 days) and Oregon (7 days) requiring that your physician have an opportunity to discuss your results with you prior to our release of results to you, you may experience additional delays. In all circumstances and in accordance with HIPAA requirements you will receive your results from us no later than 30 days from the date of your request.

I asked Quest Diagnostics to point me to the actual ruling, to no avail yet:

enter image description here

Hence my questions:

  • In the state of California, how long do patients have to wait to get lab results in California?
  • Are labs allowed to charge any amount of money to process result requests from patients?
  • Do you have a link to the actual ruling?
    – Dale M
    Commented Jul 16, 2015 at 3:46
  • @DaleM Sorry, I don't. Commented Jul 16, 2015 at 4:36
  • Well. The answer will be in that
    – Dale M
    Commented Jul 16, 2015 at 6:59
  • @DaleM I am not familiar with the legal literature in the United States. Where should I start looking for? Commented Aug 1, 2015 at 19:21
  • 3
    @DaleM I think the OP knows the answering will be in the ruling, and part of the question is in fact "what ruling?"
    – Andy
    Commented Feb 9, 2017 at 22:20

2 Answers 2


The answer is actually in the CMS rule published in the Federal Register on February 6, 2014: A link is attached here: https://www.govinfo.gov/content/pkg/FR-2014-02-06/pdf/2014-02280.pdf

In the HIPAA statute, the Centers for Medicaid and Medicare Services (CMS) is the designated enforcement agency and responsible for rules and procedures regarding protected health information privacy, security, disclosure and access. Laboratories as a covered provider also had to comply with the Consolidated Laboratories Improvement Act. Because of the conflict between the rules covered in both and states with varying levels of conflict after the passage of HITECH in 2009, CMS began working on issued this revised rule to set the NATIONAL minimum standard that every state must adhere to for patent data access. The rules were amended as follows (I'm paraphrasing for those who won't likely read the original Register notice:

If a laboratory does any electronic transaction, in the HIPAA-AS, they have to perform all electronically.

A laboratory must make the results available to a patient via direct access no later than 30 days after reporting, regardless of whether the patient's provider has discussed the results with them. (This one is important because another rule was conflicted with that was just implemented this year - come back to it later).

In addition to a patient, a provider must also release results to any designated representative, if the patient has made a request authorizing the release to that representative.

As a result of the sweeping change, this rule took 3 years to finalize and the time to implementation was extended because laboratories were releasing results to patients before providers and facilities. The final rule was revised to effect the requirements in 45 CFR 164.524.

Under the revised patient access rights, ALL covered entities must, within a set of limited exceptions for safety and protection of confidential sources, must disclose patient records within 30 days. This was the provision that sparked a lawsuit, revisions and the updated rule published in January 2023 after resolution of the original lawsuit: Ciox Health, LLC v. Azar, et al., No. 18-cv-0040 (D.D.C. January 23, 2020).

Under the Supremacy Clause of the US Constitution, no state can preempt a federal law unless its laws are more beneficial or stringent than the federal law. Because the maximum time to disclosure under federal law is no more than 30 days, and the option to charge a fee for copies is allowed, this is the guidance being provided to organizations, unless the state law is shorter or restricts the disclosure of fees.

After the Ciox decision, California, like many other states revised their own laws to meet 45 CFR 164.524. Because CA has a shorter timeframe (14 days per CA Civil Code), CA preempts federal law, but still preserves the absolute right to record access within the confines of 164.524, including charging a fee to provide copies.

The current controversy is alignment with the FCRA which requires one free disclosure of protected financial records. So a disclosure from a laboratory or hospital could be up to 14 days for the medical side of your records and could be not at all or up to 90 days under the Electronic Funds Transfer Act due to payment or billing errors.

  • "14 days per CA Civil Code": Can you give a citation to the specific section where this rule is set out? Commented Sep 21, 2023 at 15:08
  • CA Health & Safety Code Section 123130(a) "A health care provider may prepare a summary of the record, according to the requirements of this section, for inspection and copying by a patient. If the health care provider chooses to prepare a summary of the record rather than allowing access to the entire record, he or she shall make the summary of the record available to the patient within 10 working days from the date of the patient’s request...."
    – mobiledork
    Commented Sep 22, 2023 at 16:38

The answer lies in California Health and Safety Code 123148

(a) Notwithstanding any other law, a health care professional at whose request a test is performed shall provide or arrange for the provision of the results of a clinical laboratory test to the patient who is the subject of the test if so requested by the patient, in oral or written form. The results shall be disclosed in plain language and in oral or written form, except the results may be disclosed in electronic form if requested by the patient and if deemed most appropriate by the health care professional who requested the test. The telephone shall not be considered an electronic form of disclosing laboratory results subject to the limits on electronic disclosure of test results for the purpose of this section.

(b) (1) Consent of the patient to receive his or her laboratory results by Internet posting or other electronic means shall be obtained in a manner consistent with the requirements of Section 56.10 or 56.11 of the Civil Code. In the event that a health care professional arranges for the provision of test results by Internet posting or other electronic manner, the results shall be disclosed to a patient in a reasonable time period, but only after the results have been reviewed by the health care professional. Access to clinical laboratory test results shall be restricted by the use of a secure personal identification number when the results are disclosed to a patient by Internet posting or other electronic manner.

(2) Nothing in paragraph (1) shall prohibit direct communication by Internet posting or the use of other electronic means to disclose clinical laboratory test results by a treating health care professional who ordered the test for his or her patient or by a health care professional acting on behalf of, or with the authorization of, the treating health care professional who ordered the test.

(c) When a patient requests access to his or her laboratory test results by Internet posting, the health care professional shall advise the patient of any charges that may be assessed directly to the patient or insurer for the service and that the patient may call the health care professional for a more detailed explanation of the laboratory test results when delivered.

(d) The electronic disclosure of test results under this section shall be in accordance with any applicable federal law governing privacy and security of electronic personal health records. However, any state statute that governs privacy and security of electronic personal health records, shall apply to test results under this section and shall prevail over federal law if federal law permits.

(e) The test results to be reported to the patient pursuant to this section shall be recorded in the patient’s medical record, and shall be reported to the patient within a reasonable time period after the test results are received at the offices of the health care professional who requested the test.

(f) Notwithstanding subdivision (a), unless the patient requests the disclosure, the health care professional deems this disclosure as an appropriate means, and a health care professional has first discussed in person, by telephone, or by any other means of oral communication, the test results with the patient, in compliance with any other applicable laws, none of the following clinical laboratory test results and any other related results shall be disclosed to a patient by Internet posting or other electronic means:

(1) HIV antibody test, unless an HIV test subject is anonymously tested and the test result is posted on a secure Internet Web site and can only be viewed with the use of a secure code that can access only a single set of test results and that is provided to the patient at the time of testing. The test result shall be posted only if there is no link to any information that identifies or refers to the subject of the test and the information required pursuant to subdivision (h) of Section 120990 is provided.

(2) Presence of antigens indicating a hepatitis infection.

(3) Abusing the use of drugs.

(4) Test results related to routinely processed tissues, including skin biopsies, Pap smear tests, products of conception, and bone marrow aspirations for morphological evaluation, if they reveal a malignancy.

(g) Patient identifiable test results and health information that have been provided under this section shall not be used for any commercial purpose without the consent of the patient, obtained in a manner consistent with the requirements of Section 56.11 of the Civil Code. In no event shall patient identifiable HIV-related test results and health information disclosed in this section be used in violation of subdivision (f) of Section 120980.

(h) A third party to whom laboratory test results are disclosed pursuant to this section shall be deemed a provider of administrative services, as that term is used in paragraph (3) of subdivision (c) of Section 56.10 of the Civil Code, and shall be subject to all limitations and penalties applicable to that section.

(i) A patient may not be required to pay a cost, or be charged a fee, for electing to receive his or her laboratory results in a manner other than by Internet posting or other electronic form.

(j) A patient or his or her physician may revoke consent provided under this section at any time and without penalty, except to the extent that action has been taken in reliance on that consent.

  • This addresses the question of under which law the delay is permitted (it appears to be subdivision (f) above), but it doesn't really mention anything about a 14-day requirement. Commented Mar 15, 2018 at 21:25
  • 2
    Quoting a law with zero explanation of its relevance or how it answers the question of time and payment for results.
    – user4657
    Commented Mar 16, 2018 at 19:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .