What Belongs in a Waiver Lab's Compliance Binder

A Certificate of Waiver comes with a short list of federal duties. CDC's self-assessment checklist sums them up: sites testing under a waiver "must meet the following requirements: Enroll in the CLIA program; Pay applicable certificate fees biennially; Follow the current manufacturer's instructions provided with the test." Add the change notices in 42 CFR 493.39 and the duty to let inspectors in, and that is the federal core.

Short is not the same as unenforced. A waiver lab must "Make records available and submit reports to HHS as HHS may reasonably require to determine compliance" (42 CFR 493.35(d)(1)), and CMS may inspect it "at any time during the laboratory's hours of operation" to look into a complaint or check whether it is testing beyond its certificate (493.1775(b)). Since the 2023 fee rule, CMS can also impose civil money penalties on waiver labs. A binder is how a small site shows, in ten minutes, that it does what it is supposed to do.

Most of what follows comes from CDC's "Ready? Set? Test!" booklet and self-assessment checklist, which CDC wrote for "physicians, nurses, medical assistants, pharmacists, and others" testing under a waiver. CDC is candid that "some of the recommendations in this self-assessment checklist exceed CLIA requirements for waived testing." That is fine: they are CDC's own description of good waived testing practice.

What goes in the certificate section?

• The current CLIA certificate, printed from the email CMS sends (paper certificates ended March 1, 2026).
• A copy of the signed CMS-116 as filed, including the Section VI test table.
• Any state registration, license or permit, with its own expiration date.
• Every change notice sent to the State Agency, with the date sent. Ownership, name, location and director changes are due within 30 days (493.39(b)).
• Fee coupons and pay.gov receipts. CMS's October 7, 2026 alert warns of third-party mailings "styled as bills or invoices," and tells labs to check "the sender, purpose of the communication, and any requested fees or payment instructions." Filing the real coupons makes a fake one easier to spot. See look-alike CLIA invoices.

How should the test menu section look?

• One page per test: analyte, test name, manufacturer, and the FDA CLIA database entry showing it is waived. See how to tell whether a test is CLIA-waived.
• The current manufacturer's instructions for each test, with superseded versions filed behind them. CDC asks whether you "check the manufacturer's instructions with each new lot and shipment," "file the old manufacturer's instructions and replace with the new copy if there are changes," and tell testing staff and the person overseeing testing about every change.
• A short bench guide written from the instructions, if you use one. Keep it dated and consistent with the current instructions, because a guide that drifts from them is how waived tests become off-label. See off-label use of waived tests.

Which logs does CDC recommend keeping?

CDC's booklet gives "Examples of records to maintain for easy access and retrieval of information":

• "Test orders, test results, confirmatory or additional testing results"
• "Quality control results"
• "Reagents, test kits, quality control material lot numbers, dates received and used, and expiration dates"
• "Daily temperature checks, test system or equipment function checks and maintenance"
• "Test system failures, troubleshooting, and corrective action taken when problems have been identified"
• "Test or product recall notices"
• "Personnel training and competency assessments"
• "Results of proficiency testing (PT) or other external quality assessment activities," where a site chooses to take part

CDC adds that "The person overseeing testing and operations should periodically review all records," and tells sites to "Check with your local/state public health department for record keeping requirements." The federal waiver rules (42 CFR 493.15(e) and subpart B) do not set a retention period for these logs, so a state rule, if there is one, decides.

What should the training section prove?

That each person who tests was trained before testing patients and still does it correctly. CDC's checklist asks whether you "provide and document that all staff have satisfactorily completed initial training before performing temperature checks, blood collection, sample testing, and reporting patient results." CDC's free Ready? Set? Test! online course offers continuing education credit and suits new staff. A training sign-off sheet per person, per test, with dates, is enough for most sites.

Which written policies belong in the binder?

CDC's checklist points to a handful of policies a waived site should have in writing:

1. Patient identification: "at least two unique patient-specific identifiers (e.g., patient name and date of birth)" before collecting and when matching orders.
2. Specimen rejection: "established criteria for sample rejection."
3. Critical results: which results are critical at your site, who is called, and how the call is documented.
4. Confirmatory testing: "written site-specific policies and procedures to ensure confirmatory or supplemental testing is performed or referred when needed."
5. Result reporting: report "only to authorized persons," document verbal reports followed by a written one, and keep your reports distinguishable from referral lab reports.
6. Error handling: how to detect, troubleshoot and correct a test error, and when to notify the person overseeing testing.
7. Public health reporting: reporting confirmed positive infectious disease results to public health agencies, if applicable.
8. Safety: CDC also asks whether the site follows OSHA's bloodborne pathogens rules, uses an EPA-registered disinfectant and disposes of sharps properly.

Should CDC's checklist itself go in the binder?

File a completed copy of CDC's self-assessment checklist and repeat it on a schedule. CDC says items marked "No" should go to "the individual responsible for overseeing or directing testing to determine the appropriate corrective actions," and asks you to "Document any corrective actions taken." A dated checklist with corrections noted is strong evidence that the site manages its own quality.

Do PPM labs need more?

Yes. A PPM certificate brings nonwaived quality requirements, and the director must "Evaluate and document the performance of individuals responsible for PPM testing at least semiannually during the first year the individual tests patient specimens. Thereafter, evaluations and documentation must be performed at least annually" (42 CFR 493.1359(d)). See the PPM certificate.

Can we build the binder for you?

Yes, as part of your application. Our Waiver Application with Compliance Binder is $549 per site: we prepare the CMS-116 and test menu, then assemble the binder sections and blank logs around your kits and CDC's guidance, ready for your staff to fill in. Your director decides how testing is run; we do not direct the lab, and we never handle proficiency testing samples. Renewal and Compliance Tracking ($299 per year for the first lab, $99 for each added site) keeps the certificate section current. For a site without a certificate yet, start with the Certificate of Waiver, start to finish.