A patient calls Tuesday morning and asks for "the protein test from March." Your medical assistant opens the chart and finds three documents: a numeric result panel that came in through the lab interface, a scanned PDF containing a graphical tracing, and a separate narrative report that arrived four days later under a different accession number. Which of those do you release? All of them. This post walks through the records, retention, vendor, and release workflow that surrounds a serum protein electrophoresis order — what your staff must capture at intake, what has to survive an EHR migration, and where your Business Associate Agreements actually bite.
None of this is clinical guidance. The clinical facts here exist only to explain why the paperwork behaves the way it does.
One Order, Four Record Artifacts
Administrators get burned on this test because it does not produce a single tidy result line. A serum protein electrophoresis order typically generates several distinct documents, and they arrive on different days through different channels.
The requisition
The order itself carries diagnosis codes, the ordering provider's identity, the specimen collection date, and — for Medicare patients where coverage is uncertain under a contractor's policy — potentially an Advance Beneficiary Notice. If your practice draws the specimen and sends it out, the requisition is a record you created. It belongs in the designated record set.
The quantitative report
Total protein, albumin, and the fraction percentages usually flow in as discrete data through your lab interface. This is the piece your EHR handles well. It is also the only piece some practices think of when a records request arrives.
The graphical tracing
The densitometry curve is an image. It rides in as a PDF attachment or a faxed page, and in many systems it lands in a scanned-documents folder rather than the structured results table. That split is the single most common reason a release of information packet goes out incomplete.
The interpretive narrative and any reflex testing
A pathologist's written interpretation often arrives separately, sometimes days after the numbers. If the lab performs reflex or add-on testing, those results may come from a different performing laboratory entirely, under a new accession number, with their own report format. Your chart now spans three organizations for what the patient experienced as one blood draw.
Write these four artifacts into your ROI checklist by name. "Lab results" is not a specific enough instruction for a temp working the fax queue.
What Must You Release When a Patient Requests Serum Protein Electrophoresis Results?
Short answer: everything in the designated record set relating to that encounter, in the form and format requested if you can readily produce it, within 30 calendar days of the request — with one permitted 30-day extension if you notify the patient in writing of the delay and the reason.
For a serum protein electrophoresis encounter, that generally includes:
- The signed or electronic test requisition and any standing order
- The quantitative result report, including reference ranges
- The densitometry tracing or electropherogram image
- The pathologist's or laboratory director's interpretive comments
- Any reflex or add-on test reports tied to the same specimen
- Correspondence with a referral specialist that you placed in the chart
You may charge a reasonable, cost-based fee. You may not condition release on the patient explaining why they want it, and you may not require them to come in person. OCR's individual right of access guidance is the operative reference, and the agency has pursued a long run of enforcement actions specifically over access delays. Note also that a 2020 federal court decision narrowed the patient-rate fee cap as applied to records the patient directs to a third party — if your ROI vendor bills those differently, confirm the basis in writing.
Since 2014, the Lab Can Release Directly — Your Policy Should Say So
CLIA and the Privacy Rule were amended in 2014 to let laboratories provide completed test reports directly to the patient on request. Before that, HIPAA carved out CLIA-regulated labs from the access right, and clinics could tell patients that results only came through the ordering provider. That answer has been wrong for over a decade.
Practically, this means two organizations may release the same serum protein electrophoresis report on different timelines. Your front desk should never tell a patient the reference lab is prohibited from giving them results. Train the script. It comes up.
It also means your access log and the lab's access log are separate records. If a patient later disputes what they received and when, you can only speak to your own.
Three Organizations, One Specimen: Mapping Your BAA Obligations
This is where practices most often have a paperwork gap, because the biggest counterparty is frequently not a business associate.
The reference laboratory is usually a covered entity in its own right. When you send PHI to it for treatment purposes, that is a permitted disclosure between covered entities. No BAA is required. You will still have a laboratory services agreement, and it should address specimen handling, result delivery method, and breach notification cooperation — but do not assume a signed BAA exists just because a large lab is involved.
These, by contrast, almost always are business associates:
- A courier or specimen transport company you contract with, because the requisition attached to the tube contains PHI
- Your interface or integration vendor moving results between systems
- Fax-to-email and secure-messaging providers
- Document scanning and indexing services that handle the tracing PDFs
- Your release of information vendor
- Transcription services touching the interpretive narrative
- Cloud storage or backup holding scanned lab documents
- Patient portal vendors, if separate from your EHR
The conduit exception is narrow. It covers entities that transmit but do not access PHI other than randomly or incidentally — the postal service, telecom carriers. A vendor that stores your scanned electropherogram PDFs is not a conduit, no matter how the sales deck describes it.
Run this exercise: list every organization that touched one serum protein electrophoresis encounter from order entry to specialist referral. For each, decide covered entity, business associate, or neither, and write the reason in one sentence. If any row says "business associate" and you cannot produce an executed agreement, you have a documented gap that a complaint investigation will find. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export — one-time purchase, no subscription — which is faster than waiting three weeks for a vendor's legal team to send a template you will have to redline anyway.
Portal Release Timing and the Information Blocking Problem
A blanket policy that holds certain result types in the portal for a fixed number of days is a compliance risk. Under the information blocking rules, electronic health information must be available to patients without practices interfering with access, exchange, or use — subject to specific, narrow exceptions.
The preventing harm exception exists, but it requires an individualized determination that meets defined conditions, not a category-wide hold on all interpretive reports. HHS has finalized disincentives for providers found to have committed information blocking, applied through CMS programs. Review the current framework on HealthIT.gov's information blocking resources before you set portal release rules.
Whatever your policy, document it, date it, and record any individual delay decision in the chart with the reason and the person who made it. An undocumented delay looks identical to a blocked release when someone else reviews it two years later.
Retention: CLIA's Two Years Is Not Your Retention Policy
Laboratories operating under CLIA are generally required to retain test requisitions and test reports for at least two years, with longer periods for certain specialty records. That obligation runs to the performing laboratory. It says nothing about how long your practice keeps the copy in your chart.
HIPAA sets no medical record retention period at all. It requires six years for compliance documentation — policies, BAAs, risk analyses, notices, sanctions records — under the administrative requirements. Your medical record retention period comes from state law, payer contracts, and in some cases federal program participation rules. Check the CMS CLIA program materials if you operate an in-house lab, then check your state statute separately.
The migration trap
Scanned tracing images are the artifacts most likely to be lost in an EHR conversion, because they live in an attachment table rather than the structured results schema. Before any migration, pull a sample of ten serum protein electrophoresis encounters spanning several years and confirm all four artifacts render in the target system. Do that during the vendor's validation window, not after go-live.
Amendment Requests for Results You Did Not Author
A patient writes in disputing a value or a demographic field on a lab report. You have 60 days to act, with one 30-day extension on written notice.
If the record was created by another entity — the reference lab — and that entity is available to act on the request, you may deny the amendment on that basis. The denial is not the end of your obligation. You must provide a written denial in plain language, tell the patient where to direct the request, explain their right to submit a statement of disagreement, and explain how to complain to you and to OCR.
Log the request and the outcome. Amendment handling is a routine audit item and a common source of complaints that escalate.
A Fifteen-Minute Audit You Can Run This Week
- Pull three completed serum protein electrophoresis encounters from the last 18 months.
- For each, confirm the requisition, quantitative report, tracing image, and interpretive narrative are all locatable by a staff member who did not work the encounter.
- Time it. If it takes more than five minutes per chart, your ROI turnaround is at risk.
- Check whether any reflex or add-on report is filed under a separate patient identifier or an unassigned queue.
- List every vendor that touched those records and match each to an executed BAA with a current signature date.
- Confirm your fax cover sheet and result-routing rules send nothing to a number entered manually by staff.
- Verify your portal release configuration matches your written policy, and that the policy has a review date within the last 12 months.
- Spot-check that ABNs or financial notices from those encounters were scanned, not left in a drawer.
- Confirm your accounting-of-disclosures log captured any non-TPO disclosure from those charts.
- Write down every gap with an owner's name and a due date.
Items one through four are a records problem. Item five is a contracting problem, and it is the one most likely to still be open next quarter.
Close the Contract Gap Before the Records Request Arrives
Records requests are predictable. Vendor paperwork gaps are predictable. The failure mode is discovering both at once, on day 28 of a 30-day access clock, with a courier contract nobody can find.
Start with the vendor list from step five and produce the missing Business Associate Agreements in an afternoon. If your broader documentation set — risk analysis, policies, workforce training records — is equally thin, automating the full compliance document set is the more efficient path than rebuilding it one Word file at a time.