As a patient (ironically, I had to get bloodwork done this morning), it is terrific that you no longer have to rely exclusively on your doctor. Thinking back to this morning's experience, though, the lab I went to is part of a big chain. However, there was one receptionist/admissions person who did everything from welcoming patients to entering in their data on the computer and answering phones (she was very pleasant, btw). She, I'm guessing, will be the one to also hand over patient's paperwork or email it to them if they request it. Already overworked, I'd imagine it would be relatively easy to find a gap in her defenses, especially if a social engineer waited (as they would) for a time when she was most vulnerable, based on her workload.
While i was checking in someone called and asked for their results and she referred them to their doctor. That, of course, will change in a few months. Interesting to see what will happen then.