Duty, law, accreditation, code, and policy are not the same thing

A laboratory professional operates under five layers at once, and they do not all carry the same weight or come from the same source. Ethical duty is the broadest: the obligation to protect patient welfare, tell the truth, and stay within your competence, independent of any written rule. Law and regulation, such as HIPAA and CLIA, are federally enforceable and apply nationwide to covered laboratories.

Accreditation standards, from a body such as the College of American Pathologists, are conditions of a voluntary accreditation relationship. Professional codes, such as the American Society for Clinical Laboratory Science (ASCLS) Code of Ethics and the American Society for Clinical Pathology (ASCP) Board of Certification (BOC) Credential Holder Code of Conduct, are voluntary membership or credential standards, not government regulations, though violating one can still cost a credential. Organizational policy sits closest to the bench: your laboratory's specific hemolysis threshold, access matrix, and escalation ladder, built to satisfy the layers above it.

The ASCLS Code of Ethics organizes duty around three relationships: to the patient (welfare above self, competence, confidentiality, safeguarding against incompetent or illegal practice), to colleagues and the profession (honesty, integrity), and to society (legal compliance, patient advocacy). The ASCP BOC Credential Holder Code of Conduct adds a concrete expectation: protect patient information and results as confidential except when disclosure is legally required, act honestly, follow applicable law, and report illegal or improper conduct to the appropriate authority. Neither code replaces HIPAA or CLIA; both sit alongside them and shape how a laboratory professional applies them.

One recurring decision cuts across all five layers: how much protected health information (PHI) a given request actually needs. HIPAA's minimum necessary standard (45 CFR 164.502(b), 164.514(d)) requires a covered entity to limit PHI use, disclosure, and requests to what is reasonably needed for the stated purpose, matched to the requester's role. The standard does not require justification for disclosures to a treating provider for treatment, to the patient, under a valid authorization, when required by law, or when requested by the Department of Health and Human Services (HHS) for enforcement.

A covered entity may reasonably rely on a requester's own statement that a request is minimum necessary, but that reliance must itself be reasonable, not automatic, and full-record disclosure is not the default; the laboratory should be able to say why a result or panel is not enough for the stated purpose.

Before acting on a pressured or ambiguous request, ask whether the action is legal, follows policy and code, protects the patient, can be defended if reviewed, and shares only information the recipient needs. When you are not sure which layer applies, start with the patient and work outward, and treat the loudest voice on the phone as one more input, not the deciding one.