Research · 10 min read
Who May Order a Lab Test, and Who the Result Goes To
Federal laboratory rules say a test needs a request from an authorized person, list what that request must ask for, and control who the answer may be released to. They also decide what a report has to carry and how long anyone has to keep it.
Key takeaways
- A laboratory needs a written or electronic request from an authorized person, defined as someone authorized under state law to order tests or receive results, or both.
- An oral request is allowed if written or electronic authorization is solicited within 30 days and kept, along with documentation of the effort.
- The requisition must solicit a defined list including a contact for reporting imminently life-threatening results or panic or alert values.
- A patient's chart may serve as the requisition, but it must be available to the laboratory at the time of testing.
- The report must name the laboratory location where the test was performed, and must carry information about specimens that failed acceptability criteria.
- Reference intervals are determined by the performing laboratory, which is why two labs can print different ranges for the same value.
- Results go only to authorized persons, those responsible for using them, and the requesting laboratory — except for the patient-access paragraph.
- A referring laboratory may not revise the testing laboratory's results or interpretation, and must tell the ordering person where the test was actually run.
- On a detected error, the laboratory must notify promptly, reissue promptly, and keep both the original and the corrected report.
- Retention runs from two years for most records to ten years for pathology reports and histopathology slides, and survives the laboratory closing.
Answer first: the order comes from an authorized person, and state law decides who that is
The rule is one sentence. The laboratory must have a written or electronic request for patient testing from an authorized person.
The definition then hands the question to somewhere else. An authorized person means an individual authorized under state law to order tests or receive test results, or both.
Read the last three words carefully. The definition contemplates that a person might be authorized to do one and not the other, so ordering and receiving are separable questions.
And the answer varies by state. A single federal definition pointing at fifty state answers is why the same arrangement can be routine in one place and not permitted in another.
Oral requests are allowed with a follow-up. A laboratory may accept an oral request if it solicits a written or electronic authorization within 30 days and maintains that authorization, or documentation of its efforts to obtain it.
What the request form has to ask for
The laboratory must ensure the requisition solicits a specific list, and the list explains several things people notice on a form.
The name and address or other suitable identifiers of the person requesting the test and, where appropriate, the individual responsible for using the results, or the name and address of the laboratory submitting the specimen.
That entry carries a purpose clause worth knowing. It includes, as applicable, a contact person to enable the reporting of imminently life threatening laboratory results or panic or alert values.
The patient's name or unique patient identifier. The sex and age or date of birth. The test or tests to be performed. The source of the specimen, when appropriate. The date and, if appropriate, time of specimen collection.
One test type has its own extra fields, and the regulation names it specifically. For Pap smears, the patient's last menstrual period, and an indication of whether there was a previous abnormal report, treatment or biopsy.
The list closes open-ended. Any additional information relevant and necessary for a specific test to ensure accurate and timely testing and reporting of results, including interpretation where applicable.
A chart can serve as the form. The patient's chart or medical record may be used as the requisition or authorization. It must be available to the laboratory at the time of testing, and available to the agency or its agent on request.
What the report has to carry
The report requirements are the ones a patient actually sees, and there are seven.
For positive patient identification, either the patient's name and identification number, or a unique patient identifier and identification number.
The name and address of the laboratory location where the test was performed. That is the entry that answers who actually ran it, and it is required.
The test report date. The test performed. The specimen source, when appropriate.
The test result and, if applicable, the units of measurement or interpretation, or both.
And any information regarding the condition and disposition of specimens that do not meet the laboratory's criteria for acceptability. A rejected or compromised sample is meant to be visible on the report, not silently absent.
Where the reference range comes from
A line in the same section explains something that confuses people comparing two reports.
Pertinent reference intervals or normal values, as determined by the laboratory performing the tests, must be available to the authorized person who ordered the tests and, if applicable, the individual responsible for using the results.
As determined by the laboratory performing the tests. The range beside a number is that laboratory's range, which is why two laboratories can report the same value against different intervals.
More is available on request. The laboratory must, on request, make available to clients a list of the test methods it uses and, as applicable, the performance specifications it established or verified.
So is the fine print that changes what a number means. Information that may affect the interpretation of test results, for example test interferences, must be provided on request.
And updates are pushed, not just pulled. Pertinent updates on testing information must be provided to clients whenever changes occur that affect test results or their interpretation.
Who the result may be released to
There is a release rule and it is narrow, with one paragraph opening a door for the patient.
Except as provided in the patient-access paragraph, test results must be released only to authorized persons and, if applicable, the persons responsible for using the test results and the laboratory that initially requested the test.
The patient-access paragraph is the exception. On request by a patient or the patient's personal representative, the laboratory may provide access to completed test reports. Access runs to the patient, their personal representative, and certain persons specified in the federal health privacy rule. The reports have to be ones the laboratory's authentication process can identify as belonging to that patient.
Two conditions sit inside that. The reports have to be completed, and the laboratory's own authentication process has to be able to identify them as yours.
One obligation overrides the ordinary reporting timetable entirely. The laboratory must immediately alert the individual or entity requesting the test, and if applicable the individual responsible for using the results, when any result indicates an imminently life-threatening condition, or panic or alert values.
Delays have a rule too. When the laboratory cannot report results within its established time frames, it must determine, based on the urgency of the tests requested, whether to notify the appropriate individuals of the delay.
When your sample goes somewhere else
Specimens are frequently sent on to another laboratory, and three rules govern what happens then.
The first protects the result. A referring laboratory must not revise results or information directly related to the interpretation of results provided by the testing laboratory.
The second permits a direct route with a condition. A referring laboratory may allow each testing laboratory to send the result directly to the authorized person who initially requested the test. The referring laboratory must still retain, or be able to produce, an exact duplicate of each testing laboratory's report.
The third is the one that answers a question people ask constantly. The authorized person who orders a test must be notified by the referring laboratory of the name and address of each laboratory location where the test was performed.
Combined with the report requirement to name the performing location, that means the identity of the laboratory that actually ran a test is meant to be knowable, not proprietary.
What happens when a result was wrong
Corrections have their own three-step rule, and the third step is the one that preserves the trail.
When errors in reported patient test results are detected, the laboratory must promptly notify the authorized person who ordered the test and, if applicable, the individual using the results.
It must issue corrected reports promptly to those same people.
And it must maintain duplicates of the original report as well as the corrected report.
That last requirement matters if a decision was made on the strength of a wrong number. Both versions are supposed to still exist.
There is also a general accessibility standard. All test reports, or records of the information on them, must be maintained in a manner that permits ready identification and timely accessibility.
How long any of it is kept
The retention rules are specific, and the intervals differ by record type.
Records of test requisitions and authorizations, including a chart used as the requisition, are retained for at least two years.
A copy of each test procedure is retained for at least two years after the procedure is discontinued, and each procedure must carry its dates of initial use and discontinuance.
Quality control and patient test records, including instrument printouts where applicable, and records documenting analytic systems activities, are retained for at least two years. Records of test system performance specifications are kept for as long as the laboratory uses the system, and no less than two years.
Proficiency testing records and quality systems assessment records are each retained for at least two years.
Reports run longer in one case. A copy of the original report, including final, preliminary and corrected reports, is retained or retrievable for at least two years after the date of reporting. Pathology test reports run for at least ten years.
Slides and blocks have their own clocks. Cytology slide preparations for at least five years from the date of examination, histopathology slides for at least ten years, and pathology specimen blocks for at least two years.
And closing down does not end it. If the laboratory ceases operation, it must make provisions to ensure all records, and as applicable slides, blocks and tissue, are retained and available for those time frames.
What this turns into when a program bundles lab work
Five questions come straight out of the rules above, and each has a defined answer somewhere.
Who is the authorized person ordering the test, and are they authorized under the law of your state to order it, to receive the result, or both.
Which laboratory performed it. The report has to name the performing location, and a referring laboratory has to tell the ordering person the name and address of each place a test was run.
Whose reference range is printed beside your number. It is the performing laboratory's, determined by that laboratory.
Whether anything about the specimen was flagged. Information about specimens that failed the acceptability criteria belongs on the report.
And how to get the report itself. The laboratory may provide a patient or personal representative with access to completed test reports it can authenticate as theirs.
What this page does not tell you
Three boundaries, stated where you can see them.
Everything above is drawn from the federal laboratory requirements regulation. No company's laboratory arrangements were examined and no seller is named.
Who counts as an authorized person is not answered here, because the federal definition points at state law. That is a state-by-state question and nothing here resolves it for any state.
And the general health-privacy right to get your own records is a separate framework covered elsewhere. What appears above is the laboratory rule and its own cross-reference, not that framework.
Sources
- 42 CFR Part 493 — Laboratory Requirements (test request, test report and retention standards)Section 493.2 for the definition of authorized person as an individual authorized under State law to order tests or receive test results, or both. Section 493.1241(a) for the requirement of a written or electronic request for patient testing from an authorized person; 493.1241(b) for oral requests with written or electronic authorization solicited within 30 days and maintained, along with documentation of efforts to obtain it; 493.1241(c)(1) through (8) for the information the requisition must solicit, including the requester's name and address or other suitable identifiers and, as applicable, a contact person to enable the reporting of imminently life threatening laboratory results or panic or alert values; the patient's name or unique patient identifier; sex and age or date of birth; the tests to be performed; the specimen source when appropriate; the date and if appropriate time of collection; the additional Pap smear fields covering last menstrual period and previous abnormal report, treatment or biopsy; and any additional information relevant and necessary for a specific test; 493.1241(d) for the patient's chart or medical record serving as the requisition provided it is available to the laboratory at the time of testing and to CMS or a CMS agent on request. Section 493.1291(c)(1) through (7) for the seven items a test report must indicate, including positive patient identification, the name and address of the laboratory location where the test was performed, the report date, the test performed, specimen source when appropriate, the result with units of measurement or interpretation where applicable, and information regarding the condition and disposition of specimens not meeting acceptability criteria; 493.1291(d) for pertinent reference intervals or normal values as determined by the laboratory performing the tests being available to the authorized person who ordered them and, if applicable, the individual responsible for using them; 493.1291(e) for making available to clients on request a list of test methods and, as applicable, performance specifications established or verified, for providing information that may affect interpretation such as test interferences on request, and for pertinent updates whenever changes occur that affect results or their interpretation; 493.1291(f) for release only to authorized persons, persons responsible for using the results and the laboratory that initially requested the test, except as provided in the patient-access paragraph; 493.1291(g) for immediately alerting the requester and, if applicable, the individual responsible for using results, on an imminently life-threatening condition or panic or alert values; 493.1291(h) for determining, based on urgency, whether to notify of delayed testing; 493.1291(i)(1) for the bar on a referring laboratory revising results or interpretation information from the testing laboratory, (i)(2) for permitting direct reporting while retaining or being able to produce an exact duplicate, and (i)(3) for notifying the ordering authorized person of the name and address of each laboratory location where the test was performed; 493.1291(j) for maintaining reports in a manner permitting ready identification and timely accessibility; 493.1291(k)(1) through (3) for prompt notification of reporting errors, prompt issuance of corrected reports, and maintaining duplicates of the original and corrected reports; 493.1291(l) for patient access on request by a patient or personal representative to completed test reports the laboratory's authentication process can identify as belonging to that patient, and for the cross-reference to 45 CFR 164.524(c)(3)(ii). Section 493.1105(a)(1) through (7) for the retention intervals covering test requisitions and authorizations, test procedures after discontinuance with their dates of initial use and discontinuance, analytic systems records including performance specification records for the period of use and no less than two years, proficiency testing records, quality system assessment records, original reports including final, preliminary and corrected versions with the ten-year pathology report interval, and the slide, block and tissue intervals; 493.1105(b) for the obligation on a laboratory that ceases operation to make provisions for records, slides, blocks and tissue to be retained and available for those time frames.
Frequently asked questions
Who is allowed to order a lab test?
The laboratory must have a written or electronic request from an authorized person. The regulation defines that as an individual authorized under state law to order tests or receive test results, or both. So the federal rule sets the requirement and state law decides who satisfies it — and the definition allows for someone authorized to do one but not the other.
Can a test be ordered over the phone?
Yes, with a follow-up. A laboratory may accept oral requests if it solicits a written or electronic authorization within 30 days of the oral request and maintains that authorization, or documentation of its efforts to obtain it.
What has to be on a lab report?
Seven items. Positive patient identification, by name and identification number or by a unique patient identifier and identification number. The name and address of the laboratory location where the test was performed. The test report date and the test performed. Specimen source where appropriate. The result, with units of measurement or interpretation or both where applicable. And any information about the condition and disposition of specimens that did not meet the laboratory's criteria for acceptability.
Why do reference ranges differ between labs?
Because the regulation says they are the performing laboratory's own. Pertinent reference intervals or normal values, as determined by the laboratory performing the tests, must be available to the authorized person who ordered them and, if applicable, the individual responsible for using the results. A laboratory must also make its test method list and, as applicable, its established or verified performance specifications available to clients on request.
Can I get my own results directly from the lab?
The regulation has a paragraph for that. On request by a patient or the patient's personal representative, the laboratory may provide access to completed test reports. Access runs to the patient, their personal representative, and certain persons specified in the federal health privacy rule. The reports have to be ones the laboratory's authentication process can identify as belonging to that patient. Otherwise, results must be released only to authorized persons, the persons responsible for using them, and the laboratory that initially requested the test.
What if my specimen was sent to a different laboratory?
Three rules apply. The referring laboratory must not revise results or information directly related to the interpretation of results provided by the testing laboratory. It may let the testing laboratory send the result directly to the authorized person who ordered it, but must retain or be able to produce an exact duplicate of that laboratory's report. And it must notify the ordering person of the name and address of each laboratory location where the test was performed.
What happens if a result turns out to be wrong?
The laboratory must promptly notify the authorized person who ordered the test and, if applicable, the individual using the results. It must issue corrected reports promptly to those same people. And it must maintain duplicates of both the original and the corrected report. Separately, it must immediately alert the requester when any result indicates an imminently life-threatening condition, or panic or alert values.
How long are lab records kept?
Requisitions and authorizations, test procedures after discontinuance, analytic systems records, proficiency testing records and quality systems assessment records are each retained for at least two years. Original reports including preliminary and corrected versions are retained or retrievable for at least two years after reporting, and pathology reports for at least ten. Cytology slides run at least five years, histopathology slides at least ten, and pathology blocks at least two. If the laboratory closes, it must make provisions for those time frames to be met anyway.