Hizmedia logoHIZMEDIA

Laws & regulations

The rules for lab testing clinics.

Lab testing combines lab regulation, state rules on who can order tests, medical devices, and health data, and the rules change by state. These are the ones we design around.

5 specific rules · plus 12 for every clinic · Last reviewed 10 November 2026

How we build for lab testing clinics
01RegulationCMS

CLIA laboratory certification

Read the source (opens in a new tab): 42 CFR Part 493: laboratory requirements

What it says

Labs that test human samples for health purposes must be certified under the Clinical Laboratory Improvement Amendments.

Your website
Your partner labs' CLIA certification noted on test pages.
Your systems
Orders routed only to certified labs.
How we work
No direct impact.
02State lawState health departments

State rules on ordering tests

What it says

Most states require a licensed clinician to order lab tests, and a few, including New York, New Jersey, Rhode Island, and Maryland, tightly restrict direct to consumer testing.

Your website
Test pages that say where each test is available.
Your systems
Clinician ordering built into checkout, and availability checked against the patient's state before payment.
How we work
We set availability per test and state with you before launch.
03RegulationFDA

Home collection kits and home tests

Read the source (opens in a new tab): FDA, Home use tests

What it says

Home use tests and home collection kits are medical devices regulated by the FDA.

Your website
Kit pages that describe the kit accurately and name the lab that runs the test.
Your systems
Kit records that carry the lot number for each order.
How we work
No direct impact.
04RegulationHHS · FTC

HIPAA, or the FTC Health Breach Notification Rule

Read the source (opens in a new tab): 16 CFR Part 318: Health Breach Notification Rule

What it says

If you are a HIPAA covered provider, HIPAA applies. Some cash only testing businesses fall outside HIPAA, and then the FTC's Health Breach Notification Rule and state health privacy laws apply instead, including to unauthorized sharing with advertisers.

Your website
No advertising pixels on test, checkout, or results pages.
Your systems
Results in a secure portal, and no health data shared with third parties without consent.
How we work
We work out with you which regime applies before we build.
05GuidanceClinical governance

Follow up on abnormal and critical results

What it says

The ordering clinician is responsible for acting on results, so abnormal and critical values need a clear route back to them.

Your website
No direct impact.
Your systems
Abnormal and critical results routed to the ordering clinician, with follow up tracked.
How we work
No direct impact.

Built in, not bolted on

A site that follows the rules.

We build every rule on this page into the websites and systems we make for lab testing clinics. This is a plain English summary, not legal advice, so check each source and check with your healthcare attorney, compliance lead, or state board.