Article
What CMS is asking
The request for information, published July 16 with comments due Sept. 14, says the Clinical Laboratory Improvement Amendments regulations have not kept up with newer technology. CMS and CDC will use the answers to decide whether to propose changes later. Nothing is required yet, but RFIs like this often shape the rule that follows.
The cybersecurity questions stand out. The notice says lab reliance on laboratory information systems, EHR connections, networked instruments and remote access has created new risks. It asks labs how they protect data and operations, how often they verify user identity and access, how they restrict ports and IP addresses, what their incident response plans include, who is responsible and how staff are trained. It also asks whether anyone outside the United States and its territories can access systems that hold personal information, and under what conditions.
Other topics with hospital impact
- Emergency preparedness. The notice points out that independent labs were left out of the 2016 preparedness rules and cites a 2025 inspector general recommendation to require plans.
- Software and automated interpretation. CMS asks how labs verify software tools used to interpret results, including in histopathology, and whether facilities that only generate or interpret data should need CLIA certificates.
- Point-of-care testing. Questions about calibration of cartridge-based instruments touch the bedside testing that hospital labs oversee.
- Remote competency assessment. CMS asks how labs observe staff remotely, which matters for rural and multi-site systems.
- Blood culture contamination. The RFI notes that no current rule requires labs to monitor contamination rates, even though an advisory committee recommended it.
Why leaders should pay attention
Labs sit at the center of hospital operations, and many run on connected instruments and middleware that fall outside the main IT security program. Reference lab contracts and vendor support models may also involve offshore access to patient data. If CMS writes security expectations into CLIA, they would become survey items, not just best practices.
Steps to take
- Ask the CIO and lab director to confirm that lab systems and instruments are in the enterprise asset inventory and covered by vulnerability management and access reviews.
- Check vendor and reference lab contracts for offshore access to systems or data.
- Make sure lab downtime procedures are part of incident response exercises.
- Work with your hospital association or lab society on comments that reflect real costs and practices.
Archive entry for Jul 18, 2026, added Nov. 11, 2026.