I think the way the interfaces work is that to import the patient's results into your EMR, they need to see your database to find the matching patient. I suppose the question is what data the lab can extract and use? As Wendell says, the answer should basically be "none" but that may not be the case. This is definitely one for the lawyers...
Of course if we were using a "cloud" EMR (Athena, Practice Fusion) we would have even less ability to determine who accesses our patient data.
