Privacy and Security

HEALTH POLICY BRIEF — Thursday, October 8

CMS has opened a consequential but technical front: modernizing remote laboratory work without letting accountability evaporate into the cloud.

Matt Reid

— 2 min read
Share

Executive Briefing

CMS has opened a consequential but technical front: modernizing remote laboratory work without letting accountability evaporate into the cloud. Its CLIA proposal puts cybersecurity, data retention, laboratory-director responsibility, workforce flexibility, and small-laboratory burden on the same docket. Otherwise, the CMS/ONC and CPT lanes are quiet—no fresh ONC implementation move or CPT challenge survived changed-state verification. Today’s useful work is to shape the CLIA proposal, not recycle old noise.

Federal Health Policy Watch

  • CMS proposes a permanent CLIA framework for virtual laboratory access. Published today, the proposed rule would let qualified personnel remotely review digital laboratory data, results, live imaging, and images under the originating laboratory’s CLIA certificate; cytology would remain outside that flexibility. It would separately permit digital images for gynecologic cytology proficiency testing and revise personnel qualifications. Laboratories choosing virtual access would need secure connections and confidential environments, quality controls, retention of digital data and images, and records identifying personnel, software version, and device used. Comments are due December 7, 2026. Policy relevance: CMS is converting pandemic-era discretion into durable regulation, so operational safeguards and burden allocation are still contestable. Physician policy angle: pathology and laboratory leaders need workable security and traceability rules that preserve quality without imposing hospital-scale storage and compliance costs on smaller laboratories. Prepare: convene laboratory, pathology, privacy/cybersecurity, digital-health, and physician-practice experts now to frame comments on cytology scope, director accountability, personnel qualifications, access logs, retention, and small-laboratory burden. CMS and CDC, “Clinical Laboratory Improvement Amendments of 1988 (CLIA); Virtual Access, Gynecologic Cytology Proficiency Testing (PT), Personnel Qualifications, and Other Changes,” October 8, 2026 (https://www.federalregister.gov/documents/2026/10/08/2026-20613/clinical-laboratory-improvement-amendments-of-1988-clia-virtual-access-gynecologic-cytology)

Policy Action Implications

  • Build a cross-functional CLIA issue list this week, with separate questions for privacy/security, laboratory quality, workforce qualifications, and digital-image retention.
  • Ask small and independent laboratories for concrete cost and workflow evidence before comment positions harden; CMS’s proposal names modernization, but the compliance bill will arrive in storage, controls, supervision, and auditability.
  • Map the December 7 deadline backward to an early policy recommendation and draft outline, leaving time to test the proposal against current remote-review workflows.

Read more