HIPAA Compliance Requirements for Pulmonary Function Testing Labs

When does HIPAA apply to a pulmonary function testing lab?

A pulmonary function testing lab does not become subject to HIPAA solely because it performs medical tests. A lab is a HIPAA covered entity if it is a health care provider that conducts specified standard transactions electronically, such as certain billing or payment transactions. A lab may also have HIPAA duties if it acts as a business associate for a covered entity. HHS’s guidance on covered entities and business associates explains these categories.

To assess HIPAA covered entity status, consider the lab’s own activities and relationships—not just whether it receives identifiable health information. If the lab is neither a covered entity nor a business associate, the HIPAA Rules do not apply to it on that basis, though other laws or contractual duties may still govern its records.

Which pulmonary function test records qualify as protected health information?

Protected health information (PHI) is individually identifiable information related to a person’s health, health care, or payment for health care. It can be protected in electronic, paper, or oral form. HHS’s explanation of protected health information describes the definition and its identifying-information component.

For a covered lab or its business associate, records may include identified spirometry results, flow-volume loops, bronchodilator response, interpretations, test orders, referral details, and related billing or insurance information. Whether a specific record is PHI depends on whether it identifies—or could reasonably identify—the patient and relates to health or care.

When is a business associate agreement required for lab services?

A covered entity generally needs a written HIPAA business associate agreement (BAA) when it engages a separate organization to perform a function or service on its behalf that involves PHI, such as billing, claims administration, or data analysis. The agreement must set permitted uses and disclosures and require appropriate safeguards. HHS’s business associate guidance describes the relationship and its exceptions.

A BAA is not required just because one health care provider sends PHI to another provider for treatment. HHS specifically states that a physician does not need a BAA with a clinical laboratory as a condition of disclosing PHI to the lab for an individual’s treatment. A separate lab service performed on a provider’s behalf for another purpose may require a BAA. HHS’s guidance on provider-to-provider treatment disclosures explains this treatment disclosure exception.

How may providers share test results with a lab for treatment?

Covered providers may generally disclose PHI to another health care provider for treatment without first obtaining the patient’s HIPAA authorization. Treatment includes providing, coordinating, or managing care, consulting with another provider, and referring a patient. For example, a provider may send the relevant patient information and test order to a pulmonary function testing lab so the lab can perform the test and return results for care. HHS’s guidance on treatment disclosures describes these permitted exchanges.

Providers should use appropriate channels and verify the recipient, patient, and requested information. The minimum necessary standard does not apply to disclosures to or requests by a health care provider for treatment, but other privacy and security safeguards still matter.

How can patients access pulmonary function test reports?

Patients generally have an individual right of access to PHI about them in a covered entity’s designated record set. That can include clinical laboratory test reports and, where maintained in the record set, underlying test data. A patient can direct an access request to the covered lab or to the provider responsible for the relevant records. If the lab holds records as a business associate, the covered entity remains responsible for providing access, with the BAA determining how the lab assists. HHS’s guidance on information patients can access includes clinical laboratory reports.

A covered entity generally must act on an access request within 30 calendar days. It may use one additional 30-day extension if it gives the patient written notice explaining the delay and the expected response date. HHS’s access guidance for clinical laboratories explains the response timeframe.

What privacy safeguards and minimum-necessary limits apply?

Covered labs and business associates must use protected health information safeguards appropriate to their HIPAA duties. For electronic PHI, the Security Rule requires an accurate and thorough risk analysis and reasonable, appropriate measures to protect confidentiality, integrity, and availability. Administrative, physical, and technical protections should reflect the organization’s risks and operations; HIPAA does not prescribe one identical security setup for every lab. HHS’s Security Rule risk-analysis guidance explains this requirement.

When the minimum necessary standard applies—for example, to many disclosures or requests for payment or health care operations—a covered entity must reasonably limit PHI to what the purpose requires and apply role-based access policies for its workforce. The standard does not apply to disclosures to or requests by a health care provider for treatment, disclosures to the individual, or certain other specified situations. HHS’s summary of the HIPAA Privacy Rule sets out these limits and exceptions.

When may a lab disclose test results to an employer?

A lab that is subject to HIPAA generally should not send identifiable test results to an employer merely because the employer requested or paid for the test. The patient may authorize a disclosure, or a specific HIPAA permission may apply. One narrow occupational medical surveillance disclosure permits a covered health care provider to disclose relevant findings to an employer without authorization when the service is provided at the employer’s request or as part of the employer’s workforce, concerns workplace medical surveillance or work-related illness or injury, and the employer needs the information to meet a duty under OSHA, MSHA, or a similar state law.

Under that exception, the disclosure must be limited to the findings the employer needs for the legal obligation, and the individual must receive written notice that the information will be disclosed—or notice may be posted at the worksite when the service is provided there. Ordinary pre-employment or fitness-for-duty testing does not automatically qualify. HHS’s guidance on employer disclosures for medical surveillance explains the narrow conditions.

In practice, a lab’s HIPAA obligations depend on whether it is a covered entity or business associate, what purpose supports a disclosure, and which safeguards and patient rights apply. Treatment-related sharing is generally permitted without a BAA, while employer disclosures require authorization or a specific legal exception.

FAQs.

Does every pulmonary function testing lab have to comply with HIPAA?

No. A lab is subject to HIPAA if it meets the definition of a covered entity or acts as a business associate. A health care provider generally becomes a covered entity by conducting specified standard transactions electronically. Other privacy laws or contracts may apply even when HIPAA does not.

Does a lab need a business associate agreement to receive test results for treatment?

Not when a covered provider discloses PHI to a health care provider, such as a clinical lab, for the patient’s treatment. A BAA may be required if the lab performs a separate function or service on behalf of a covered entity that involves PHI.

Can patients request copies of pulmonary function test reports?

Generally, yes. Patients may request access to test reports held in a covered entity’s designated record set and may also have access to related information in that record set. The covered entity generally must act on the request within 30 calendar days, subject to one permitted extension with written notice.

Can a lab send pulmonary function test results to an employer without patient authorization?

Only when a HIPAA permission applies. One limited exception covers certain workplace medical surveillance or work-related illness and injury disclosures needed for an employer’s legal duty under OSHA, MSHA, or similar state law. The exception has specific conditions, limits the information shared, and requires notice to the individual.