CLIA Quality Control Requirements (42 CFR 493)

CLIA quality control depends on test complexity. Waived tests must follow the manufacturer's instructions, including any QC they specify (42 CFR 493.15(e)). Nonwaived tests must meet 42 CFR 493.1256. That means at least two control levels each testing day for quantitative tests, or positive and negative controls for qualitative tests, plus specialty rules, unless the lab has an IQCP.

Sound Lab Consultants (SLC) helps clinical laboratories nationwide build QC programs that hold up to CMS, state agency, and accreditation surveys. This page summarizes what the regulation says. It is not legal advice. Always check the current text of 42 CFR Part 493 on eCFR and your accrediting organization's checklist, which may be stricter.

Book a free consultation

Where the 30-day figure comes from

The 30-day number isn't a CLIA rule. It shows up in two places:

The Developing an IQCP - A Step-By-Step Guide (CDC/CMS workbook) uses an example test system whose package insert recommends external controls at least every 30 days. The example lab's QC plan runs normal and abnormal external QC every 30 days or on the first day of patient testing each month, plus at each new reagent lot and at other trigger events.
the CAP's public IQCP FAQ (updated Nov 2024) uses 30 days as its example: if a lab wants external QC every 30 days, the in-house study must span at least 30 days. CAP also says it removed an older checklist statement that required external QC at least every 31 days under an IQCP.

So the interval is the lab's choice, made by the laboratory director and backed by data. 30 days is a common example, not a ceiling or a default.

What the supporting data must show

CMS says in-house data, collected in your own environment by your own personnel, must show that the test system's stability supports the number and frequency of QC in the plan. CMS isn't prescriptive about how much data that takes; the laboratory director decides (CMS IQCP Frequently Asked Questions (Aug 2016)). The CAP FAQ adds:

The study period has to cover at least the maximum interval you choose between external QC runs.
Consecutive days aren't specifically required when testing is sporadic or not done seven days a week.
Historical data for tests already in place can be used, and published literature can supplement it.
For a new test, the CAP describes starting with a shorter interval (for example, a seven-day study and weekly QC) and extending it only after more data is gathered and the director approves the updated IQCP.

Data commonly pulled into the study includes daily QC results run under default QC, internal control records, proficiency testing results, verification studies, maintenance and function-check logs, and corrective action records.

What external QC still has to happen

New lots and shipments: the CAP requires external QC with each new lot and shipment of reagents in an IQCP's quality control plan.
Manufacturer triggers: the CDC/CMS workbook example also runs external QC when lab conditions change significantly, when staff are trained or retrained, and when results don't match the patient's clinical picture.
Never below the manufacturer: CMS, CDC and the CAP all say the QC plan can't be less stringent than the manufacturer's instructions.

Internal and procedural controls

Extended external QC only makes sense when something else watches the test between external runs. CMS describes IQCP as recognizing electronic, internal and procedural controls built into test systems. The CAP limits most IQCP eligibility to test systems with an internal control process (electronic, procedural or built-in), with exceptions in microbiology. Your risk assessment has to show which errors those internal controls actually catch. The CAP notes that function checks and electronic checks may monitor only part of the analytic process.

How the three IQCP parts fit a 30-day plan

Risk assessment: evaluate specimen, test system, reagent, environment and testing personnel risks across all phases of testing, and document which control catches each one. See IQCP risk assessment.
Quality control plan: state the number, type and frequency of controls, the acceptance criteria and the trigger events. The laboratory director signs and dates it, and CMS says that approval can't be delegated.
Quality assessment: monitor QC failures, errors, PT results and complaints to confirm the 30-day interval is still working. See IQCP quality assessment and review.

When to tighten or revert

Go back to a shorter interval, or to default QC, when quality assessment shows the plan isn't working. Typical signals are QC or internal-control failures, PT problems, clinician complaints, or a change in reagents, staff, location or the test system. CMS notes that surveyors don't usually cite a director's risk decisions directly. They find the downstream problems in QC, QA and PT and cite those.

For a point-of-care angle, Westgard's outside review of a point-of-care IQCP shows how a sample POC IQCP built mostly from manufacturer documents missed environment, personnel and multiple-device risks. That kind of gap makes a long QC interval harder to defend.

IQCP 30-Day QC checklist

☐ Confirm the test is nonwaived and eligible (not pathology; CAP labs also check CAP's internal-control rule)
☐ Pull the manufacturer's QC frequency and make sure 30 days isn't shorter than it allows
☐ Gather in-house QC and internal-control data spanning at least 30 days
☐ Add PT, verification, maintenance and corrective-action records
☐ Document which internal or procedural control catches each identified risk
☐ Write the QC plan: number, type, frequency, acceptance criteria, new lot/shipment and trigger events
☐ Get laboratory director signature and date before use
☐ Set quality assessment monitors and a review schedule
☐ Define the triggers for returning to a shorter interval

CDC resources on CLIA

CDC's overview of the CLIA program: CDC explains that CLIA applies to every U.S. site that tests human specimens to assess health or to diagnose, prevent, or treat disease. It also explains that CDC supports the program alongside CMS and FDA.
CDC on CLIA test complexity categories: CDC explains how FDA scores tests as moderate or high complexity using seven criteria. It also notes that lab-developed or modified tests default to high complexity, and that moderate and high complexity standards differ only in personnel requirements.
CDC's free CLIA educational materials: CDC offers brochures and booklets on waived testing, PPM, and IQCP.

Frequently asked questions

Can IQCP extend QC to once every 30 days?

Yes, if your in-house data spans at least 30 days and supports the interval, the risk assessment backs it, the manufacturer doesn't require more frequent QC, and the laboratory director approves the plan.

How many days of data do I need for an IQCP?

CMS doesn't set a number; the laboratory director decides. The CAP says the study must cover at least the maximum interval between external QC runs, so a 30-day interval needs at least 30 days of data.

Do the 30 days of QC have to be consecutive?

The CAP says consecutive days aren't specifically required if testing is sporadic or not done seven days a week.

Can an IQCP be less stringent than the manufacturer's instructions?

No. CMS, CDC and the CAP all say the QC plan can't be less stringent than the manufacturer's instructions.

Do I still run external QC on new reagent lots?

Yes. The CAP requires external QC with each new lot and shipment in an IQCP's quality control plan, and manufacturers often list other trigger events.

Is 31-day external QC still required by the CAP under IQCP?

No. The CAP says it removed that statement in 2017. The data still has to cover the maximum interval you choose.

When should a lab go back to daily QC?

When quality assessment shows QC failures, errors, PT problems or complaints suggest the plan isn't controlling risk, or when the test system, reagents, staff or location change.

Official sources and further reading

Related IQCP guides

Talk to an IQCP consultant

Sound Lab Consultants helps labs nationwide build, review and maintain IQCPs from their own data and the official CMS and CDC guidance.

Sound Lab Consultants, PO Box 2135, Chandler, AZ 85244Where CLIA quality control requirements live in 42 CFR 493

CLIA rules are in Title 42, Part 493 of the Code of Federal Regulations. Quality control falls mainly under Subpart K (Quality System for Nonwaived Testing) and its Analytic Systems condition, 42 CFR 493.1250. Under that condition, every lab that does nonwaived testing must meet §§ 493.1251 through 493.1283, unless HHS approves an equivalent procedure in Appendix C of the State Operations Manual. That alternative is how IQCP works.

QC requirements for waived tests

A lab with a Certificate of Waiver may perform only waived tests. Under 42 CFR 493.15(e), the lab must:

Follow the manufacturer's instructions for performing the test. For QC, this means running every control the package insert calls for, at the frequency it states, and using any built-in or procedural controls exactly as directed.
Meet the requirements of Subpart B (Certificate of Waiver). These include permitting announced or unannounced inspections and notifying HHS or its designee before performing any test not on the waived list. The lab must also notify within 30 days of any change in ownership, name, location, or director (§ 493.39).

The Subpart K QC rules do not apply to waived testing. Still, a waived test can only be run correctly if the instructions are followed in full. If the insert says to run external controls with each new lot, each new shipment, or each new operator, then for that test the lab must do so. Keep a record of those control results so you can show that you followed the instructions.

For practical waived QC habits, see SLC's waived test quality control guide and CLIA Certificate of Waiver requirements.

QC requirements for nonwaived tests (moderate and high complexity)

General control procedures: § 493.1256

42 CFR 493.1256 is the core CLIA QC standard. Each test system needs control procedures that do two things. They must detect immediate errors from test system failure, environmental conditions, or operator performance. They must also monitor accuracy and precision over time. The lab sets the number, type, and frequency of controls based on its verified performance specifications. It may follow the manufacturer's frequency only when that frequency meets or exceeds the CLIA minimum (§ 493.1256(b)–(d)(2)).

Minimum frequency. At least once each day patient specimens are tested (§ 493.1256(d)(3)), include:

Quantitative tests: two controls of different concentrations.
Qualitative tests: a positive and a negative control.
Graded or titered tests: a negative control and a graded or titered control.
Tests with an extraction phase: two controls, one of which detects extraction errors.
Molecular amplification: two controls, plus an inhibition control if inhibition is a significant cause of false negatives.

Thin layer chromatography and electrophoresis have their own control rules (§ 493.1256(d)(4)–(5)).

Other core rules:

Re-run controls before resuming testing after a complete reagent change, major preventive maintenance, or replacement of a critical part.
Rotate QC among all operators, and test controls the same way as patient specimens.
Define the mean and SD for each lot of quantitative control. Verify the stated values of assayed controls before relying on them (§ 493.1256(d)(6)–(10)).
Check each new batch, lot, and shipment of reagents, stains, antisera, and identification systems when it is prepared or opened.
Check media for sterility and growth support before or at first use.
Check fluorescent and immunohistochemical stains each time they are used (§ 493.1256(e)).
Controls must be acceptable before patient results are reported. All QC must be documented (§ 493.1256(f)–(g)).

Calibration and calibration verification: § 493.1255

Under 42 CFR 493.1255, calibrate according to the manufacturer's instructions, at least as often as the manufacturer recommends, and whenever calibration verification fails. Verify calibration using low (or zero), mid-point, and high values across the reportable range. Do this at least once every 6 months, and also:

after a complete reagent change, unless you can show that lot changes do not affect the reportable range or control values,
after major maintenance or replacement of critical parts, and
when control trends or shifts cannot be resolved by other troubleshooting.

Specialty and subspecialty QC: §§ 493.1261–493.1278

The specialty rules add to or replace the general rules (§ 493.1256(d)(1)). Key examples:

Bacteriology (§ 493.1261):
Gram stain controls each week of use.
Beta-lactamase controls (methods other than Cefinase) each day of use.
Antisera controls when opened and every 6 months.
Susceptibility-testing control organisms each day of testing.
Mycobacteriology, mycology, parasitology, virology (§§ 493.1262–493.1265):
Mycobacteriology: acid-fast positive and negative controls each day of use.
Parasitology: permanent stains checked monthly.
Virology: an uninoculated cell control when using cell culture.
Blood gases (§ 493.1267):
One control each 8 hours of testing, with low and high values each day.
One control each time specimens are tested, unless the analyzer internally verifies calibration at least every 30 minutes.
Hematology and coagulation (§ 493.1269):
Automated coagulation: two levels each 8 hours of operation and with each reagent change.
Manual cell counts and manual coagulation: controls and patients tested in duplicate.
Immunohematology (§ 493.1271):
Follow the manufacturer's instructions and the cited 21 CFR 606 rules.
Confirm ABO group with A1 and B red cells.
Monitor blood storage with an audible alarm.
Histopathology and cytology (§§ 493.1273–493.1274):
Histopathology: run a control slide with special stains.
Cytology: Papanicolaou staining, plus review of at least 10 percent of negative gynecologic cases.
Cytogenetics and histocompatibility (§§ 493.1276–493.1278): Specimen identification controls, temperature monitoring, and cell exchange participation.

Every specialty section requires that all control procedures be documented.

IQCP: the alternative to default QC frequency

An Individualized Quality Control Plan (IQCP) is the CMS-approved alternative described in Appendix C of the State Operations Manual. Under IQCP, a nonwaived lab can tailor its QC to its own test systems, environment, and staff instead of running the default § 493.1256 frequency. CMS's brochure Considerations When Deciding to Develop an IQCP puts the choice simply. A lab either performs QC using the CLIA requirement for daily testing of two levels of external control materials and follows all specialty and subspecialty requirements, or it performs an IQCP. The brochure also states that, effective January 1, 2016, a lab that wants to keep running less QC than that default must do an IQCP. It adds that IQCP control procedures may not be less than what the manufacturer requires.

According to CMS's What Is an IQCP? brochure, an IQCP has three parts:

Risk Assessment (RA): Evaluate at least five components: specimen, test system, reagents, environment, and testing personnel. Cover the pre-analytic, analytic, and post-analytic phases.
Quality Control Plan (QCP): The control procedures the lab will follow. The laboratory director must review, sign, and date it before patient testing begins.
Quality Assessment (QA): Ongoing monitoring to confirm the plan works.

For details, see SLC's IQCP (Individualized Quality Control Plan) guide, plus our guides to IQCP risk assessment, IQCP eligibility, and using IQCP for 30-day QC, and the official CMS Individualized Quality Control Plans page, which links the CMS IQCP workbook.

QC records and retention: § 493.1105

Under 42 CFR 493.1105, the lab must keep the following:

QC and patient test records, including instrument printouts, and records of all analytic systems activities in §§ 493.1252–493.1289: at least 2 years (§ 493.1105(a)(3)). This covers control results, calibration and calibration verification, maintenance and function checks, reagent and media checks, and corrective actions.
Performance specification records (§ 493.1253): for as long as the test system is in use, and never less than 2 years (§ 493.1105(a)(3)(i)).
Test procedures: at least 2 years after a procedure is discontinued, with dates of initial use and discontinuance (§ 493.1105(a)(2)).
Proficiency testing and quality system assessment records: at least 2 years (§ 493.1105(a)(4)–(5)).
Immunohematology, blood, and transfusion records: as specified in 21 CFR 606.160 (§ 493.1105(a)(3)(ii)).
Pathology test reports: at least 10 years. Cytology slides: at least 5 years. Histopathology slides: at least 10 years. Blocks: at least 2 years (§ 493.1105(a)(6)–(7)).

If the lab closes, it must arrange for records to stay available for these periods (§ 493.1105(b)). State law or your accreditor may require longer retention.

Corrective action when QC fails: § 493.1282

Under 42 CFR 493.1282, corrective action policies must be available and followed, and all corrective actions must be documented. When control or calibration results fail the lab's acceptability criteria, the lab must evaluate all patient results from the unacceptable run and since the last acceptable run to see if they were affected. It must then take whatever action is needed to report accurate results.

A defensible QC failure record usually shows:

the failed control (level, lot, value, rule violated),
the date, time, and operator,
troubleshooting steps and root cause,
the fix, with acceptable repeat QC,
the patient-result look-back and any corrected reports, and
reviewer sign-off.

See SLC's QC corrective action documentation guide for a worked example.

Westgard rules and QC acceptability

CLIA does not name a specific statistical rule set. It requires the lab to establish or verify acceptability criteria for its controls, define statistical parameters such as mean and SD for quantitative controls (§ 493.1256(d)(10)), and confirm that controls are acceptable before reporting (§ 493.1256(f)). Many labs meet this requirement with Levey-Jennings charts and multirule criteria such as 1-3s, 2-2s, and R-4s. Whatever rules you choose, write them into the procedure manual and apply them the same way every time. For how these rules work in practice, see SLC's guide to Westgard rules for CLIA quality control.

CLIA quality control checklist

Use this checklist as a self-check for each nonwaived test system. For waived tests, use item 1 and the manufacturer's instructions.

☐ Current package insert or manufacturer instructions on file and followed, including the manufacturer's QC frequency.
☐ Written QC procedure in the procedure manual (§ 493.1251) stating control levels, frequency, acceptability criteria, and rules.
☐ Controls meet the § 493.1256(d)(3) minimum (two levels for quantitative tests, positive and negative for qualitative tests, and so on), or an approved IQCP is in place and signed by the director.
☐ Specialty-specific QC applied (§§ 493.1261–493.1278), such as every 8 hours for blood gases and coagulation, or daily or weekly organism controls in microbiology.
☐ Mean and SD established or verified for each new control lot, with assayed values verified for your method and instrument.
☐ Controls run before resuming testing after a complete reagent change, major maintenance, or critical part replacement.
☐ Control testing rotated among all operators and run like patient specimens.
☐ New reagent lots, shipments, stains, and media checked before or at first use.
☐ Calibration done per the manufacturer, and calibration verification done at least every 6 months and when triggered (§ 493.1255).
☐ Maintenance and function checks documented (§ 493.1254).
☐ QC reviewed and accepted before patient results are released.
☐ Every QC failure has a documented corrective action and patient look-back (§ 493.1282).
☐ Twice-yearly comparison of results across methods, instruments, or sites where applicable (§ 493.1281).
☐ QC, calibration, maintenance, and corrective action records kept for at least 2 years (§ 493.1105).
☐ QC data reviewed as part of analytic systems quality assessment (§ 493.1289).

Book a free consultation to have SLC review your QC program before your next survey.

CDC resources on CLIA

CDC's overview of the CLIA program: CDC explains that CLIA applies to every U.S. site that tests human specimens to assess health or to diagnose, prevent, or treat disease. It also explains that CDC supports the program alongside CMS and FDA.
CDC on CLIA test complexity categories: CDC explains how FDA scores tests as moderate or high complexity using seven criteria. It also notes that lab-developed or modified tests default to high complexity, and that moderate and high complexity standards differ only in personnel requirements.
CDC on waived tests: CDC notes that waived tests are simple and low-risk but not error-proof. Errors can happen when the manufacturer's instructions are not followed.
CDC's free CLIA educational materials: CDC offers brochures and booklets on waived testing, PPM, and IQCP.

CMS resources for clinical labs

CMS MLN006270: CLIA Program & Medicare Lab Services: Links CLIA compliance to Medicare payment for lab services.

FAQs

What are the CLIA quality control requirements for waived tests?

Waived labs must follow the manufacturer's instructions for performing the test (42 CFR 493.15(e)). This includes any controls the instructions call for. The detailed Subpart K QC standards do not apply to waived testing.

How many levels of QC does CLIA require per day?

For nonwaived quantitative tests, the minimum is two control materials of different concentrations at least once each day patient specimens are tested. Qualitative tests need a positive and a negative control (§ 493.1256(d)(3)). Some specialties require more, such as controls every 8 hours for blood gases and automated coagulation. A lab can run less often than this default only under an approved IQCP.

What is IQCP and who can use it?

IQCP is the CMS-approved alternative QC option for nonwaived testing. It is built from a risk assessment, a quality control plan, and quality assessment. It lets a lab tailor its QC frequency. Per CMS, an IQCP may not be less stringent than the manufacturer's requirements, and the laboratory director must sign the QC plan before patient testing.

How often is calibration verification required under CLIA?

At least once every 6 months. It is also required after a complete reagent change (with an exception for lots shown not to affect results), major maintenance or critical part replacement, unresolved control trends or shifts, or when the lab's own schedule calls for it (§ 493.1255(b)(3)).

How long must QC records be kept?

At least 2 years for QC and other analytic systems records (§ 493.1105(a)(3)). Some records must be kept longer: performance specification records for as long as the test system is in use, pathology reports for 10 years, and cytology slides for 5 years. Your state or accreditor may require more.

What does CLIA require when QC fails?

Do not report patient results until controls are acceptable (§ 493.1256(f)). Document the corrective action, and evaluate all patient results from the failed run and since the last acceptable run (§ 493.1282(b)(2)).

Does CLIA require Westgard rules?

No. CLIA requires the lab to establish or verify acceptability criteria and statistical parameters for its controls. Westgard multirules are a common way to apply those criteria, but the regulation does not name them.

Get help with CLIA quality control

Sound Lab Consultants works with clinical laboratories nationwide. Our services include QC procedure writing, IQCP development, calibration verification plans, and survey readiness reviews.

Sound Lab Consultants Mailing address: PO Box 2135, Chandler, AZ 85244

Book a free consultation