On July 16, 2026, CMS and the CDC published a request for information asking the public what, if anything, should change in the CLIA regulations at 42 CFR part 493 — the first broad public inquiry of its kind since those regulations were implemented in 1992. Comments are due September 14, 2026, under file code CMS-3485-NC (91 FR 43586; RIN 0938-AW01; docket CMS-2026-2345).
An RFI is not a proposed rule and creates no obligation. But it is the stage at which the evidence base for a future rulemaking gets built, and the questions CMS and the CDC chose to ask are unusually specific about problems laboratory directors have been raising for years: AI-assisted interpretation, remote competency assessment, factory-calibrated analysers, data-only facilities, and blood culture contamination.
Why now
The agencies frame the exercise plainly: “Clinical laboratory testing technology has advanced significantly since the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations were implemented in 1992.” The original implementing rule is at 57 FR 7002 (February 28, 1992). CMS says the topics were identified by CMS, the CDC, interested parties and state agency surveyors as areas where the regulations may need updating to reflect current knowledge and practice.
Two of the questions trace directly to formal recommendations from the Clinical Laboratory Improvement Advisory Committee: CLIAC recommended in November 2024 that CMS allow remote assessment for the direct-observation component of competency assessment, and in November 2023 that blood culture contamination rate monitoring be brought into the laboratory quality management system. A third traces to a 2025 HHS Office of Inspector General report recommending that CMS consider requiring emergency preparedness plans for independent laboratories participating in Medicare — a gap left when the 2016 emergency preparedness final rule (81 FR 63860) excluded CLIA-certified independent labs from its scope.
The four areas, and what is actually being asked
A. Breath testing
When the CLIA regulations were written, breath testing existed for law enforcement, not clinical diagnosis. Development of COVID-19 breath tests during the public health emergency changed that, and CMS says it has received inquiries about whether breath testing for cancer diagnosis, microbial identification and gastrointestinal disorders falls within CLIA at all. The agencies ask what breath tests facilities perform clinically, what methodologies they use, what types of facility perform them, and how specimens are collected, transported and stored.
B. Laboratory processes and procedures
This is the longest section, with eight subsections:
- Pathology specimen block retention. Section 493.1105(a)(7)(ii) sets a two-year minimum. CMS notes molecular diagnostics now enable retrospective testing on much older tissue, and asks what requests laboratories receive beyond two years and how often.
- Specimen preparation activities and personnel. Under the definition of “laboratory” at 493.2, a facility that only collects or prepares specimens is not a laboratory for certification purposes. CMS is asking what activities labs consider to be specimen preparation — centrifuging, aliquoting, tissue processing, slide staining, plate inoculation, DNA/RNA extraction — and what education, training and competency assurance apply to the people doing them.
- Suboptimal specimens. Section 493.1242(a) requires written acceptability and rejection policies. CMS asks under what circumstances labs test specimens that fail those policies anyway, how often, how results are documented and reported, and how ordering providers are told.
- Establishment and verification of performance specifications. Section 493.1253 requires verification for unmodified FDA-cleared or approved test systems and full establishment for anything else. CMS asks what challenges arise for non-FDA-cleared tests and modifications, and which methods — toxicology and next-generation sequencing are named — have performance characteristics the regulations do not address. This intersects directly with the unsettled position on laboratory developed tests.
- Calibration verification. Section 493.1255(b)(1) requires labs to follow the manufacturer’s calibration verification instructions. CMS acknowledges the awkward case: factory-calibrated, non-adjustable closed systems and cartridge-based analysers, including point-of-care systems, where the end user cannot adjust anything.
- Postanalytic interpretation and use of AI. CMS asks how labs use software algorithms or AI in the postanalytic process, when software functions interpret results (naming NGS, histocompatibility and pharmacogenomics), what role AI plays in histopathology slide interpretation, how labs verify software performance including image resolution and monitor quality, and whether cloud analytics and automation should be addressed in the regulations at all.
- Data-only facilities. Facilities that only process analytical data or provide specialised interpretation — some of which are medical device software manufacturers — have asked CMS whether they need a CLIA certificate. CMS names genetic data review, digital image interpretation and risk-factor calculation as the recurring cases.
- Remote direct observation competency assessment. Sections 493.1413(b)(8) and 493.1451(b)(8) require direct observation of routine patient test performance and instrument maintenance. CMS asks how labs currently use remote observation, on what devices — smartphones, tablets, VR headsets, dedicated video systems — and what the limitations are.
C. Emergency preparedness, biosafety and biosecurity, and cybersecurity
The cybersecurity questions are the most granular in the entire RFI, and they are pointed. CMS asks about the frequency and process for verifying user identity and access; whether individuals or entities outside the US and its territories are ever allowed to access lab systems containing personal information, and under what conditions; how lab systems restrict ports and IP addresses; what is in the incident response plan; which job position owns cybersecurity in the laboratory; and how personnel are trained. Respondents are told not to include proprietary or confidential information.
D. Specialty testing areas
CMS says it has received inquiries about adding specialties including Mohs testing, andrology and molecular testing. It asks specific questions on clinical cytogenetics, on immunohematology — particularly the operational and quality-assurance differences between electronic crossmatch and traditional serologic crossmatch — and on microbiology, where it notes there are currently no CLIA regulations governing blood culture contamination rates or mandating systematic monitoring and corrective action. Contaminated blood cultures drive unnecessary antimicrobial therapy and extended stays, which puts this question squarely in the path of hospital antimicrobial stewardship programmes.
Who is affected, and what to do about it
Every CLIA-certified facility is potentially in scope, because CLIA applies regardless of Medicare participation — from physician office laboratories through hospital labs to large reference laboratories. Practically, four groups have the most at stake:
- Hospital laboratory directors and quality managers. The remote competency assessment question is the one most likely to change day-to-day practice, and it is the one where CLIAC has already recommended a direction. If your laboratory has tried remote observation, the RFI is asking for exactly the operational detail — devices, challenges, limitations — that will determine whether a future rule permits it broadly or narrowly. Read this alongside the existing high complexity testing personnel and competency requirements.
- Laboratories running non-FDA-cleared or modified assays. The performance-specification questions are asking which analytical characteristics the current regulation fails to name. That list, if it forms, becomes the basis for what a future 493.1253 requires you to establish.
- Anyone deploying AI in the postanalytic step. CMS is asking, in effect, where the boundary of “the testing process” sits when an algorithm interprets the result. The answer determines whether AI verification becomes a CLIA obligation with survey consequences or stays a device-regulation question under the FD&C Act.
- Digital pathology and genomic interpretation vendors. The data-only facility question asks whether a CLIA certificate is required at all. That is an existential classification question for part of that market.
If you intend to comment, the mechanics matter: comments must be received by September 14, 2026, submitted electronically at regulations.gov under docket CMS-2026-2345 or by mail to CMS at file code CMS-3485-NC. CMS asks commenters to identify the specific section and question number addressed — for example “Section A. Breath Testing, Question 1” — and to organise submissions to match the RFI’s structure. All comments received before the close of the period are posted publicly, including any personally identifiable or confidential business information they contain.
What remains uncertain
Whether any rulemaking follows at all. CMS states the responses “may be used to help inform CMS and the CDC as to what types of action, if any, should be taken to update the existing CLIA regulations through future notice and comment rulemaking.” That is a genuine conditional, not a formality. An RFI can sit unacted upon indefinitely.
There is no proposed regulatory text, and no timeline. Nothing in this document tells a laboratory what a future requirement would look like or when it would arrive. Any vendor or consultant presenting this RFI as a signal that specific changes are coming is going beyond what the document supports.
The relationship to FDA’s separate authority over laboratory developed tests is not addressed here. The performance-specification and data-only-facility questions both touch territory FDA also claims, and the RFI notes only that certain software and software functions are regulated as medical devices under the FD&C Act. How the two regimes would divide AI-assisted interpretation is not asked, let alone answered.
Whether CLIA reaches breath testing is being asked, not asserted. CMS says these technologies “may fall within the scope of CLIA.” Laboratories currently performing clinical breath testing should not read the RFI as a determination either way.
Frequently asked questions
Does this RFI change any CLIA requirement now?
No. A request for information imposes no obligations and amends no regulation. The CLIA requirements at 42 CFR part 493 are unchanged. Any change would require a separate notice-and-comment rulemaking, which CMS has not committed to undertaking.
Can my laboratory use remote direct observation for competency assessment today?
The current regulations at 493.1413(b)(8)(i) and (iv) and 493.1451(b)(8)(i) and (iv) require direct observation of routine patient test performance and of instrument maintenance and function checks as part of competency evaluation, and do not address remote technology. CLIAC recommended in November 2024 that CMS allow remote assessment for that component, and CMS is now seeking evidence on it — but a CLIAC recommendation is advisory and the regulation has not changed. Laboratories should continue to follow their accrediting organisation’s current interpretation and document their approach.
Do we need a CLIA certificate if we only interpret data and never touch a specimen?
That is precisely the open question. Under 493.2, a facility that only collects or prepares specimens, or acts only as a mailing service and performs no testing, is not a laboratory for certification purposes — but that provision was not written with genomic-data interpretation or digital image analysis in mind. CMS says it has received inquiries and is seeking comment; it has not published a position.
Where do the questions about blood culture contamination come from?
From CLIAC’s November 2023 recommendation that CLIA regulations be updated to include blood culture contamination rate monitoring within the laboratory quality management system. CMS confirms in the RFI that there are currently no specific CLIA regulations governing contamination rates or mandating systematic monitoring and corrective action.
Primary source: Centers for Medicare & Medicaid Services and Centers for Disease Control and Prevention, “Request for Information; Clinical Laboratory Improvement Amendments of 1988 (CLIA) Regulations,” 91 FR 43586 (July 16, 2026), file code CMS-3485-NC, RIN 0938-AW01, comments due September 14, 2026. Cited within: 57 FR 7002 (February 28, 1992); 81 FR 63860 (September 16, 2016); CLIAC meeting summaries, November 2023 and November 2024; HHS OIG report on emergency preparedness plans for independent laboratories (2025).
