The answer is actually in the CMS rule published in the Federal Register on February 6, 2014: A link is attached here: https://www.govinfo.gov/content/pkg/FR-2014-02-06/pdf/2014-02280.pdf
In the HIPAA statute, the Centers for Medicaid and Medicare Services (CMS) is the designated enforcement agency and responsible for rules and procedures regarding protected health information privacy, security, disclosure and access. Laboratories as a covered provider also had to comply with the Consolidated Laboratories Improvement Act. Because of the conflict between the rules covered in both and states with varying levels of conflict after the passage of HITECH in 2009, CMS began working on issued this revised rule to set the NATIONAL minimum standard that every state must adhere to for patent data access. The rules were amended as follows (I'm paraphrasing for those who won't likely read the original Register notice:
If a laboratory does any electronic transaction, in the HIPAA-AS, they have to perform all electronically.
A laboratory must make the results available to a patient via direct access no later than 30 days after reporting, regardless of whether the patient's provider has discussed the results with them. (This one is important because another rule was conflicted with that was just implemented this year - come back to it later).
In addition to a patient, a provider must also release results to any designated representative, if the patient has made a request authorizing the release to that representative.
As a result of the sweeping change, this rule took 3 years to finalize and the time to implementation was extended because laboratories were releasing results to patients before providers and facilities. The final rule was revised to effect the requirements in 45 CFR 164.524.
Under the revised patient access rights, ALL covered entities must, within a set of limited exceptions for safety and protection of confidential sources, must disclose patient records within 30 days. This was the provision that sparked a lawsuit, revisions and the updated rule published in January 2023 after resolution of the original lawsuit: Ciox Health, LLC v. Azar, et al., No. 18-cv-0040 (D.D.C. January 23, 2020).
Under the Supremacy Clause of the US Constitution, no state can preempt a federal law unless its laws are more beneficial or stringent than the federal law. Because the maximum time to disclosure under federal law is no more than 30 days, and the option to charge a fee for copies is allowed, this is the guidance being provided to organizations, unless the state law is shorter or restricts the disclosure of fees.
After the Ciox decision, California, like many other states revised their own laws to meet 45 CFR 164.524. Because CA has a shorter timeframe (14 days per CA Civil Code), CA preempts federal law, but still preserves the absolute right to record access within the confines of 164.524, including charging a fee to provide copies.
The current controversy is alignment with the FCRA which requires one free disclosure of protected financial records. So a disclosure from a laboratory or hospital could be up to 14 days for the medical side of your records and could be not at all or up to 90 days under the Electronic Funds Transfer Act due to payment or billing errors.
