FDA, CLIA, and ISO—Which Regulations Apply to Your Clinical Lab?

The regulations and guidelines that govern clinical laboratories’ operations are constantly being expanded and updated. 

The U.S. Food and Drug Administration (FDA) is phasing out its enforcement discretion over laboratory-developed tests (LDTs), the Clinical Laboratory Improvement Amendments (CLIA) have established new quality standards for lab personnel and proficiency testing, and even the International Organization for Standardization (ISO) updates its requirements at least once every five years. 

With so many changes happening at once, how can labs ensure they stay up-to-date and in compliance?

Experts Julie Ballard, founder and principal consultant at Carrot Clinical, and Lindsay Strotman, PhD, NRCC, a CLIA lab director and technical consultant at Lighthouse Lab Services, untangle the complexities of today’s regulatory environment for clinical labs.

     

What are the key differences between the FDA, CLIA, and ISO?

Julie Ballard: The FDA is a US federal government regulatory agency. They regulate medical devices, including in vitro diagnostic (IVD) tests, which are used in clinical laboratories. They also categorize the complexity of tests (waived, moderate-complexity, high-complexity, and so on).

CLIA is a set of mandatory federal regulations that apply specifically to clinical laboratories. Laboratories must be CLIA-certified by the Centers for Medicare & Medicaid Services (CMS) before accepting human specimens for testing. CLIA requirements focus on quality standards in all aspects of laboratory operations, including specimen collection, quality control procedures, result reporting, personnel qualifications, training, and competency.

ISO is an international voluntary organization. They provide guidelines that are not legally binding unless they have been adopted by a country’s regulatory framework. ISO 15189 specifies requirements for quality and competence in clinical laboratories. ISO certification is akin to College of American Pathologists (CAP) accreditation in that neither is required, but laboratories may choose to have these to demonstrate their commitment to quality and continuous improvement.

     

Lindsay Strotman: Each accrediting agency has its own unique role in regulating laboratories, but there is overlap. Laboratorians in the US are most familiar with CLIA, because its certification is mandatory. CLIA regulates laboratories that perform testing on patient specimens to ensure that the tests are accurate and reliable. Its focus is mainly on day-to-day lab operations, with specific attention paid to personnel qualifications and competencies.

Clinical laboratories use FDA-approved IVDs but were not subjected to many FDA regulations—until recently, when the FDA introduced its final rule on LDT regulation. Now, clinical labs that offer IVDs as LDTs are subjected to FDA regulations because they are considered “manufacturers” and are responsible for proving the safety and effectiveness of their tests.

Finally, although ISO standards are not legally required for laboratories, compliance can enhance laboratory quality and reliability and may be required for specific contracts or international work.

Which labs and activities are governed by each of the three bodies?

JB: The three main bodies that regulate US medical laboratories are the Centers for Disease Control and Prevention (CDC), CMS, and the FDA. The CDC develops technical standards and laboratory practice guidelines, CMS issues CLIA certificates and monitors compliance with CLIA regulations, and the FDA categorizes tests based on their complexity. Of the three, CMS is the central authority for laboratories because they are the primary administrators of CLIA, including conducting lab inspections, enforcing regulatory compliance, and approving accreditation agencies. With the publication of the FDA’s LDT final rule, however, the FDA will play a greater role in regulating LDTs going forward.

Blood banks are a unique case in which the FDA bears a greater responsibility. CMS and CLIA play a role in testing all donated blood, but the FDA, through its Center for Biologics Evaluation and Research, regulates the blood supply by licensing and inspecting blood banks, setting quality standards and guidelines to ensure blood safety, and monitoring adverse events.

For clinical laboratories, ISO certification is optional and is “icing on the cake” for a laboratory that is already CLIA-certified.

LS: Labs should prioritize understanding the standards set by these bodies in the following order: CLIA (mandatory), FDA (mandatory if considered a manufacturer), and ISO (voluntary). Laboratorians must be well-versed in all CLIA requirements, as well as the accreditation standards of agencies like CAP, COLA, and The Joint Commission.

Regarding FDA regulations, labs must determine whether they qualify as a manufacturer of an IVD offered as an LDT without falling under any of the exceptions in the final rule. If they do, they are required to comply with FDA regulations; if not, they should be familiar with medical device reporting requirements, strictly follow approved IVD instructions for use, and use the FDA CLIA database, which is a valuable resource to determine test complexity.

ISO compliance, though voluntary, enhances a lab’s quality management system. Notably, the FDA has aligned its quality guidelines with ISO 13485, creating significant overlap—if not complete equivalence—between the two.

Are there any areas in which these regulations conflict—or may in future?

JB: Historically, laboratories have had to comply with CLIA and FDA requirements primarily as IVD users. For example, if a laboratory, as a user of an FDA-cleared device, becomes aware that the device may have caused a death or serious injury, they’re required to report this adverse event to both the FDA and the manufacturer.

With the FDA’s LDT final rule, laboratories are considered the manufacturers of their LDTs and will have to comply with requirements as the manufacturer. Going back to the adverse event as an example, if the laboratory’s LDT may have caused a death or serious injury, they’re required to report the adverse event to the FDA as the manufacturer of the device. However, because the laboratory is also the user, reporting requirements as a user may also apply. I say “may” because there are still many uncertainties and unanswered questions regarding the interpretation and implementation of the final rule; in this example, requiring the laboratory to report as both the manufacturer and the user may be redundant.

LS: For labs that are considered manufacturers of LDTs, the regulations may be duplicative or more stringent. A key example is the quality system requirements defined under Stage 3 of the FDA’s LDT final rule. Though laboratories already adhere to quality regulations under CLIA, they will need to meet additional requirements and familiarize themselves with the terminology the FDA and ISO use for quality standards. For validations, the FDA may be more specific than CLIA about the required studies and methodologies; as an example, the FDA might mandate adherence to specific Clinical & Laboratory Standards Institute guidelines they recognize as consensus standards, whereas CLIA provides recommendations without explicitly mandating specific protocols.

What common regulatory errors or misunderstandings have you encountered?

JB: A common misconception at the moment is the belief that CLIA regulations no longer apply to LDTs now that the FDA is regulating them. This is not the case at all. The FDA’s regulations are in addition to, not instead of, CLIA requirements.

LS: In the past, there were fewer inquiries, but recently, more laboratorians are seeking clarity on navigating the various regulations. Most of the current questions revolve around understanding the LDT rule—specifically, whether individual labs are classified as manufacturers of IVDs offered as LDTs. Some of these questions concern what is considered a “modification” of a test; although the FDA somewhat defined this in the final rule, more guidance would be helpful.

Where do labs struggle most with quality and compliance—and do those areas differ between FDA, CLIA, and ISO requirements?

JB: CLIA requirements focus on laboratory processes and personnel, whereas the FDA’s focus on processes to ensure IVD quality, including design control and risk management. For laboratories with LDTs that will need to comply with the final rule, design control will be the most challenging. CLIA already requires some processes, such as complaint handling or acceptance activities, so labs will already be familiar with them—but no CLIA requirement resembles the FDA’s design control stipulations.

LS: Labs are primarily facing challenges due to a lack of personnel and expertise to fully grasp the new FDA requirements, not to mention ISO standards. This issue is further compounded by the fact that many laboratorians are already stretched for time to ensure compliance with these standards. Additionally, because many quality regulations are duplicative—though they may use different and unfamiliar terminology—the learning curve is expected to be steep.

Are there upcoming or anticipated changes to any of these sets of guidance?

JB: The FDA’s LDT final rule defines the general regulation but does not explain how the Final Rule will be interpreted or regulated. The FDA plans to issue guidance documents to communicate their compliance expectations. Laboratories should look for these documents during the enforcement phaseout timeline over the next several years.

LS: Labs need to stay informed about recent CLIA changes, particularly those related to proficiency testing and laboratory director requirements. Regarding the FDA, many labs affected by the LDT final rule must first understand whether they need to comply with the first two stages and, if so, how. Beyond these stages, most labs are awaiting further guidance or actions.

Laboratories are facing a perfect storm of impending regulatory changes—and, to continue meeting patients’ needs, it’s crucial to stay ahead of the curve.