The sign outside of the U.S. Department of Health and Human Services building.

The Centers for Medicare and Medicaid Services (CMS) has stirred controversy with its decision to alter regulations governing the qualifications of high complexity laboratory directors and recognize the Doctorate in Clinical Laboratory Science (DCLS) as an acceptable degree for this role. The final rule has prompted questions from key lab associations, including the Association for Diagnostics & Laboratory Medicine (ADLM, formerly AACC).

In a joint letter to CMS, the American Society for Microbiology (ASM) and ADLM voice reservations over what they see as inadequate public discourse about this shift and note that it was made without formal endorsement from the Clinical Laboratory Improvement Advisory Committee (CLIAC), which typically advises on such policies.

While ASM and ADLM acknowledge the importance of advancing education within the field, they stress the critical role of high complexity laboratory directors in overseeing complex laboratory operations, including the development and validation of laboratory developed tests (LDTs). “At a time when LDTs are facing increasing scrutiny from the Food and Drug Administration and the public, CMS must ensure that [high complexity laboratory directors] can meet these and other challenges,” the associations wrote.

ASM and ADLM are asking that CMS hold a public forum conducted by CLIAC to address questions around qualifications for high complexity laboratory directors. Key stakeholders, such as the three universities that offer the degree, the CMS certifying boards, accrediting organizations, relevant professional societies, and other important parties should be invited to participate, according to the letter.

FDA PLANS RECLASSIFICATION OF HIGH-RISK DIAGNOSTIC DEVICES

FDA's Center for Devices and Radiological Health (CDRH) announced its intention to reclassify most high-risk in vitro diagnostic devices from class III to class II. The sweeping move initially targets infectious disease and companion diagnostic tests.

Reclassification would significantly streamline regulatory processes, allowing manufacturers to seek marketing clearance through the less rigorous premarket notification (510(k)) pathway instead of the premarket approval pathway that often requires clinical trials.

According to the FDA, the aim is to foster increased competition and accessibility as more manufacturers are expected to develop these tests. The reclassification proposal focuses on devices where sufficient information exists to establish what the agency calls special controls, ensuring safety and effectiveness.

This initiative aligns with CDRH's risk-based approach to device classification and periodic reviews to ensure appropriate regulatory oversight, according to the agency. Previous reclassification efforts have included nucleic acid and serology-based tests for hepatitis B virus, serology tests for human parvovirus B19, and cell-mediated immune reactivity tests associated with tuberculosis infections.

HHS SETTLES $4.75M CYBERSECURITY CASE WITH MONTEFIORE MEDICAL CENTER

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), announced a $4.75 million settlement with Montefiore Medical Center in New York City, covering multiple potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule.

The investigation unearthed revelations that over a 6-month period, an employee at Montefiore Medical Center stole protected health information of 12,517 patients and sold it to an identity theft ring. The breach was initially brought to light by the New York Police Department in May 2015. Under the terms of the 2024 settlement, Montefiore Medical Center must implement a comprehensive corrective action plan.

In light of increasing cyber threats, OCR is urging providers to bolster their cybersecurity posture by implementing robust safeguards, including vendor oversight, regular risk analyses, audit controls, multi-factor authentication, encryption, and staff training.

OCR noted that more than 134 million individuals were affected by large breaches in 2023, an increase over the 55 million affected in 2022.