Laboratory regulations in the United States come from five federal agencies whose rules routinely apply to the same facility at the same time. CMS runs the CLIA program that governs clinical testing quality. OSHA sets the worker safety standards for chemical and biological hazards. HHS enforces HIPAA privacy and security for patient information. The EPA controls hazardous waste under RCRA. The FDA oversees research integrity through Good Laboratory Practice and Institutional Review Board requirements. A single lab can sit under all of them, and each agency enforces its rules independently.
CLIA and Clinical Testing Quality
The Clinical Laboratory Improvement Amendments cover essentially every test performed on a human specimen in the country. CMS administers CLIA and scales the requirements to how complex a test is.1Centers for Medicare & Medicaid Services. Clinical Laboratory Improvement Amendments
Test Complexity Tiers
Every test falls into one of three categories: waived, moderate complexity, or high complexity.2eCFR. 42 CFR Part 493 – Laboratory Requirements Waived tests are simple procedures with minimal risk of error — urine dipsticks, rapid strep swabs, home-use blood glucose monitors, visual-read pregnancy tests. A lab that performs only waived tests is exempt from most CLIA requirements provided staff follow the manufacturer’s instructions exactly.
Moderate- and high-complexity testing brings the full weight of the regulation: documented staff education and training, written quality control protocols, detailed recordkeeping, and periodic inspections. High-complexity work carries the highest technical demands because errors are more likely to reach the patient.
Certificates and Fees
Before performing any testing, a lab must obtain a CLIA certificate by filing CMS Form 116.3Centers for Medicare & Medicaid Services. CLIA Application for Certification – Form CMS-116 Four certificate types cover the range of operations:
- Certificate of Waiver, for labs performing only waived tests.
- Certificate for Provider-Performed Microscopy, for providers doing a limited set of microscopy procedures during patient visits.
- Certificate of Compliance, for moderate- or high-complexity labs inspected by a state survey agency on behalf of CMS.
- Certificate of Accreditation, for moderate- or high-complexity labs inspected by an approved organization such as the College of American Pathologists or The Joint Commission.
Certificates run for two years. A Certificate of Waiver costs $248. Compliance and accreditation certificates range from $223 for low-volume labs (2,000 or fewer tests annually) to $11,801 for facilities running over one million tests a year, with survey fees added on top.4Centers for Medicare & Medicaid Services. CLIA Certificate Fee Schedule
Laboratory Director Qualifications
Every lab doing non-waived testing needs a qualified director, and the bar rises with complexity. A director overseeing high-complexity testing must hold a doctoral degree in a chemical, physical, biological, or clinical laboratory science from an accredited institution and hold active certification from an HHS-approved board such as the American Board of Clinical Chemistry or the American Board of Medical Microbiology.5Centers for Medicare & Medicaid Services. Certification Boards for Laboratory Directors of High Complexity Testing Documentation of these qualifications is submitted with the application.
Proficiency Testing
Non-waived labs must enroll in an approved proficiency testing program. The lab receives unknown samples, analyzes them, and reports results that are compared against those from other participating labs. The program has to include enough challenges each year, at the right frequency, to verify the lab meets minimum performance standards.6eCFR. 42 CFR Part 493 Subpart I – Proficiency Testing Programs Unsuccessful results can trigger follow-up surveys, mandatory training, and enforcement action against the certificate.
Enforcement
CMS starts with alternative sanctions — directed plans of correction, suspension of Medicare payments, state onsite monitoring, civil money penalties. If the lab is still noncompliant after a follow-up survey, CMS can move to principal sanctions: limiting, suspending, or revoking the CLIA certificate and canceling approval to receive Medicare and Medicaid payments.7Centers for Medicare & Medicaid Services. SOM Exhibit 241 – CLIA Enforcement A revoked certificate ends testing entirely.
OSHA and Worker Safety
OSHA sets the standards that protect lab workers from chemical exposures, infectious materials, and physical hazards. Two rules do most of the work in a lab setting. Penalties are steep: as of 2025, serious violations reach $16,550 each, and willful or repeated violations reach $165,514, with annual inflation adjustments.8Occupational Safety and Health Administration. OSHA Penalties
Chemical Hygiene Plan
Any lab where employees handle hazardous chemicals must maintain a written Chemical Hygiene Plan tailored to the chemicals actually in use.9Occupational Safety and Health Administration. 29 CFR 1910.1450 – Occupational Exposure to Hazardous Chemicals in Laboratories The plan has to cover standard operating procedures for handling those chemicals, the control measures the employer will use to limit exposure (engineering controls, personal protective equipment, hygiene practices), verification that fume hoods and other protective equipment work, employee training, medical consultation for potential overexposures, and a designated Chemical Hygiene Officer to run the program. Particularly dangerous substances, including known carcinogens and reproductive toxins, require added protections such as designated work areas and containment devices like glove boxes.10eCFR. 29 CFR 1910.1450 – Occupational Exposure to Hazardous Chemicals in Laboratories
Bloodborne Pathogens
A separate standard applies to any employee who can reasonably expect to contact blood or other infectious materials at work. It requires a written Exposure Control Plan built on Universal Precautions, meaning all human blood and certain body fluids are treated as if infectious.11Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens
Engineering controls come first: self-sheathing needles, puncture-resistant sharps containers, and similar devices that eliminate the hazard at its source. Where risk remains, the employer must provide appropriate personal protective equipment — gloves, gowns, face shields, eye protection — at no cost to the employee.12GovInfo. 29 CFR 1910.1030 – Bloodborne Pathogens The hepatitis B vaccination series must be offered to every employee with occupational exposure, again at no cost; the employee can decline, but the offer is mandatory.13Occupational Safety and Health Administration. Bloodborne Pathogens and Needlestick Prevention – Quick Reference Guide Training is required at initial assignment to tasks with potential exposure and at least annually after that.
Injury Reporting Deadlines
A work-related fatality has to be reported to OSHA within 8 hours of the employer learning about it. Any inpatient hospitalization, amputation, or loss of an eye has to be reported within 24 hours.14Occupational Safety and Health Administration. Updates to OSHA’s Recordkeeping Rule – Reporting Fatalities and Severe Injuries Hospitalizations solely for diagnostic testing or observation do not count.
HIPAA and Patient Information
Labs that create, receive, or transmit individually identifiable health information are covered entities under HIPAA. That sweeps in clinical labs, reference labs, and many research labs that handle patient-linked data. Two rules do most of the work.15U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
Privacy Rule
The Privacy Rule controls when and how protected health information can be used or shared. Its core is the minimum necessary standard: limit access to the information actually needed for the task at hand. The standard does not apply to disclosures for treatment, disclosures directly to the patient, uses the patient has authorized in writing, or disclosures required by law.16U.S. Department of Health and Human Services. Minimum Necessary Requirement
Security Rule
The Security Rule sets national standards for protecting electronic health information through three categories of safeguards.17U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule Administrative safeguards cover risk assessments, a designated security official, workforce access policies, security training, incident response, and contingency planning for data recovery. Physical safeguards protect the facility and the devices that store or access electronic health information — locked server rooms, workstation privacy controls, and rules governing hardware movement. Technical safeguards address access controls, encryption, and audit logging of who accesses patient data and when.
Penalties
Civil penalties are tiered by culpability. The lowest tier applies where the entity made reasonable efforts to comply and did not know about the violation. Higher tiers apply for lack of oversight, neglect that was corrected within 30 days, and neglect that was not corrected within 30 days. Maximum penalties per violation category can exceed $2 million a year in the worst cases. Criminal penalties, including imprisonment, apply to knowing misuse of patient information.
RCRA and Hazardous Waste
The EPA regulates lab waste under the Resource Conservation and Recovery Act, which tracks hazardous waste from generation through final disposal. The volume of waste your lab produces determines the category you fall into and the obligations that come with it.
Generator Categories
There are three tiers based on monthly output:18Environmental Protection Agency. Categories of Hazardous Waste Generators
- Very Small Quantity Generators produce 100 kilograms or less of hazardous waste per month, or 1 kilogram or less of acutely hazardous waste. Regulatory burden is lightest, but proper identification and disposal are still required.
- Small Quantity Generators produce more than 100 but less than 1,000 kilograms per month and face additional recordkeeping, storage, and training requirements.
- Large Quantity Generators produce 1,000 kilograms or more per month and carry the full RCRA load, including the shortest allowable on-site storage times and the most detailed reporting.
Most clinical and research labs are VSQGs or SQGs, but the category can shift month to month when a large study or an equipment decommissioning pushes output up. Misclassifying yourself can put you in violation of storage limits or recordkeeping rules without your realizing it.
Segregation, Labeling, and Manifests
Waste streams stay separate. Infectious waste like blood-contaminated items goes into approved red biohazard bags or containers; chemical waste like solvents and acids goes into separate hazardous waste containers. Every hazardous waste container has to be marked with the words “Hazardous Waste” and the date accumulation began.19Environmental Protection Agency. Hazardous Waste Containers
Shipping waste off-site requires a Uniform Hazardous Waste Manifest on EPA Form 8700-22, carrying a unique tracking number and naming a permitted disposal facility. Large and small quantity generators must also register with the EPA’s electronic manifest (e-Manifest) system.20eCFR. 40 CFR Part 262 Subpart B – Manifest Requirements The manifest builds an unbroken chain of custody from the lab to final disposal. The generator also certifies on the manifest that they have a program to reduce waste volume and toxicity to the extent economically practicable.
FDA Rules for Research and Product Testing
Research and product development labs pick up a second layer of oversight aimed at ethical conduct and data integrity.
Institutional Review Boards
Any study involving human subjects must be reviewed and approved by an IRB before research begins. Under FDA regulations, the board can approve, require modifications to, or disapprove a protocol. Its job is protecting participants’ rights and welfare, verifying adequate informed consent, and confirming that risks are minimized and reasonable in relation to anticipated benefits.21Food and Drug Administration. Institutional Review Boards and Protection of Human Subjects in Clinical Trials Review covers the protocol along with consent documents and investigator qualifications.
Good Laboratory Practice
Labs running nonclinical safety studies that will support FDA applications — for drugs, medical devices, or food additives — must follow the Good Laboratory Practice regulations in 21 CFR Part 58.22eCFR. 21 CFR Part 58 – Good Laboratory Practice for Nonclinical Laboratory Studies GLP is designed to make the safety data submitted to the FDA scientifically reliable and independently verifiable. Each study has a designated Study Director who is the single point of accountability. An independent Quality Assurance Unit monitors the study to confirm that facilities, equipment, personnel, methods, and records comply with GLP. Controlled standard operating procedures govern every part of the work, and raw data, documentation, and final reports are archived in a form that allows the study to be reconstructed from beginning to end.
Handling Overlapping Requirements
A single facility often lives under several of these frameworks at once. A hospital reference lab running high-complexity clinical tests, handling patient data electronically, storing chemical reagents, and disposing of blood-contaminated materials has to satisfy CLIA, HIPAA, both OSHA standards, and RCRA at the same time. A research lab testing a new drug on human tissue samples can add FDA GLP and IRB oversight on top of that.
The agencies do not coordinate inspections or enforcement, and a gap in one area does not wait for you to close a gap in another. Labs that treat these rules as separate silos are the ones that get caught during inspections. A single quality management system that maps each requirement to specific policies, assigns responsibility, and tracks deadlines for training, proficiency testing, certificate renewals, and waste manifests in one place is the practical way to keep all of them current.