CLIA Sanctions, Including Penalties for Waiver Labs

CLIA enforcement lives in subpart R of 42 CFR Part 493. Its stated purposes are to protect patients "against substandard testing of specimens," to safeguard the public, and "to motivate laboratories to comply with CLIA requirements" (493.1804(a)). For most of CLIA's history, the tools available against a Certificate of Waiver lab were blunt: suspend, limit or revoke. The 2023 rule changed that.

What sanctions can CMS impose?

There are two tiers (493.1806):

• Principal sanctions: "suspension, limitation, or revocation of any type of CLIA certificate."
• Alternative sanctions: a directed plan of correction (493.1832), state onsite monitoring paid for by the lab (493.1836), and a civil money penalty (493.1834).

CMS may also sue to stop any activity that "would constitute a significant hazard to the public health" (493.1806(d)), and an individual convicted of intentionally violating CLIA may be imprisoned or fined (493.1806(e)). The CMS-116 states the criminal terms: up to 1 year, or up to 3 years for a second or later violation.

Labs paid by Medicare face additional sanctions: cancellation of Medicare approval, or suspension of payment for some or all tests (493.1807). Suspending or revoking any CLIA certificate cancels Medicare approval at the same time (493.1808(a)), and Medicaid pays only for labs with a CLIA certificate or an approved state license (493.1809).

What changed for waiver labs in 2024?

CMS-3326-F, effective January 27, 2024, amended 493.1804(c)(1), which now reads: "CMS may impose alternative sanctions in lieu of, or in addition to, principal sanctions." The earlier text said CMS did not impose alternative sanctions on waiver labs. CMS's reasoning, in its summary memo QSO-24-03-CLIA: waiver labs are not routinely surveyed, but they "are surveyed as a result of a complaint, and based on the complaint survey, may be found to be out of compliance with a condition-level requirement." Before the change, CMS's only recourse was a principal sanction. The memo says the ability to impose alternative sanctions "will be particularly useful in instances in which we find PT referral violations."

One drafting wrinkle: as of October 2026, eCFR's text of 493.1806(c) still lists the alternative sanctions as available "except on a laboratory that has a certificate of waiver." The rule's preamble and 493.1804(c)(1) are clear about CMS's intent, so a waiver lab should assume a civil money penalty is possible.

Which findings trigger a sanction?

Sanctions follow condition-level deficiencies, meaning "noncompliance with one or more condition level requirements" (493.2), or unsuccessful participation in proficiency testing (493.1804(b)). How fast CMS moves depends on whether the finding is immediate jeopardy, which the regulation defines as "a situation in which immediate corrective action is necessary because the laboratory's noncompliance with one or more condition level requirements has already caused, is causing, or is likely to cause, at any time, serious injury or harm, or death." In immediate jeopardy, CMS "requires the laboratory to take immediate action to remove the jeopardy," and if a revisit shows it has not, may suspend or limit the certificate no earlier than 5 days after notice (493.1812). In choosing among sanctions, CMS weighs factors such as the severity and duration of the deficiencies, whether they repeat, the lab's records and compliance history, and the State Agency's recommendation (493.1804(d)).

What puts a certificate at risk?

CMS may act to suspend, limit or revoke any CLIA certificate if the lab's owner, operator or an employee has (493.1840(a)):

1. been "guilty of misrepresentation in obtaining a CLIA certificate";
2. performed, or claimed the right to perform, a test "not within a category of laboratory examinations or other procedures authorized by its CLIA certificate";
3. failed to comply with certificate requirements and performance standards;
4. failed to comply with reasonable requests for information or work on materials;
5. refused a reasonable request to inspect the lab, its operation and its records;
6. "violated or aided and abetted in the violation of any provisions of CLIA";
7. failed to comply with an alternative sanction; or
8. within the preceding two years, owned or operated a lab whose CLIA certificate was revoked.

That last ground follows people, not buildings. An owner whose lab loses its certificate cannot simply open a new lab under a new name the next month. Proficiency testing referral has its own, heavier rules: at least a one-year revocation and a one-year owner and operator ban in the worst cases (493.1840(b)). See proficiency testing basics.

For a waiver lab, the most common practical risk is the second ground: running a test that is not waived, or using a waived kit off-label, which CMS says "defaults to high complexity." See off-label use of waived tests.

How are civil money penalties set?

Under 493.1834, CMS may impose a civil money penalty "against any laboratory determined to have condition level deficiencies regardless of whether those deficiencies pose immediate jeopardy." The regulation sets ranges, "as adjusted annually under 45 CFR part 102," per day of noncompliance or per violation:

• for a condition-level deficiency that poses immediate jeopardy, $3,050 to $10,000 before adjustment;
• for one that does not, $50 to $3,000 before adjustment.

The current adjusted amounts are published under 45 CFR part 102, so check there rather than relying on the base figures. CMS weighs the nature, scope, severity and duration of noncompliance, repeat deficiencies across three consecutive inspections, compliance history, the lab's intent and the state of its records (493.1834(d)(1)).

The process: a notice of intent; a penalty that begins accruing 5 days after notice for immediate jeopardy or 15 days otherwise; 60 days to request a hearing; and a penalty due 15 days after the final notice, with CMS able to approve installment payments over up to a year. If the lab does not request a hearing, "CMS may reduce the proposed penalty amount by 35 percent" (493.1834(e), (f), (h)).

How does the process unfold before a sanction takes effect?

For alternative sanctions, CMS gives written notice of the noncompliance, the proposed sanction and the rationale, and at least 10 days to respond (493.1810(a)). The sanction takes effect at least 5 days after notice when there is immediate jeopardy, and at least 15 days otherwise (493.1810(c)(2)). It lasts until the lab corrects all condition-level deficiencies, which a credible allegation of compliance or a revisit must verify (493.1810(d), (e)). If deficiencies that do not pose immediate jeopardy are not corrected within 12 months of the inspection, CMS cancels Medicare approval and moves toward suspension, limitation or revocation (493.1814(b)).

Revocation generally waits for an administrative law judge's decision (493.1840(e)). Suspension or limitation also waits, except where there is immediate jeopardy or the lab refused a reasonable request for information or for inspection (493.1840(d)). Medicare and Medicaid payments, however, can be suspended on the effective date of a noncompliance notice "even if there has been no appeals decision issued" (493.37(e)(3) for waiver labs).

Are sanctions public?

Yes. Section 353 of the PHS Act requires the Secretary "to publish annually a list of all laboratories that have been sanctioned during the preceding year" (493.1800(a)(3)(iii)), and survey results are posted on CMS's QCOR site. Under a directed portion of a plan of correction, CMS can also require a lab to list its clients so they can be notified of the sanction (493.1832(b)(2)).

How does a lab stay clear of all this?

• Test only what the certificate covers, exactly as each manufacturer's instructions say.
• Tell the truth on the CMS-116: every test, every lab the director directs, every owner.
• Report ownership, name, location and director changes within 30 days.
• Answer State Agency requests and allow inspections.
• Keep the certificate current and the fee paid.

White Glove CLIA prepares accurate CMS-116s and change notices from the information the lab provides, and tracks renewals and 30-day deadlines (see pricing). The owner or director reviews and signs every filing and stays responsible for its truth. We do not represent labs in enforcement actions or hearings; a lab facing a proposed sanction should talk to a health care attorney promptly. See also when a waiver lab gets inspected.