Compliance & clinical governance
Laboratory data is regulated data. This page explains how progmedlab handles CLIA certification, HIPAA obligations, GDPR transfers and clinical review — in plain language, without marketing adjectives.
Short version: CLIA-certified performing labs, HIPAA-aligned handling with a BAA available, GDPR data residency on request, and a licensed clinician reviewing every result before release.
CLIA-certified laboratory network
Clinical laboratory testing in the United States is regulated under CLIA. Every laboratory we route specimens to holds a valid CLIA certificate covering the specialties it performs, is inspected on the CLIA schedule, and participates in proficiency testing. Where a test is only available in a CAP-accredited lab, the accreditation body and certificate number appear on the report.
- Certificate numbers printed on every result
- Proficiency testing per specialty
- Documented specimen rejection and recollect policy
HIPAA-aligned PHI handling
We treat protected health information as the highest-sensitivity class of data in the system. PHI is encrypted in transit (TLS 1.2+) and at rest (AES-256), access requires role-based authorisation plus per-request audit logging, and the audit trail is append-only. A Business Associate Agreement is available for covered entities and business associates.
- BAA available, returned within 2 business days
- Append-only audit log for every PHI access
- Least-privilege scoped API keys per environment
GDPR and international transfers
For EU/UK data subjects we offer regional data residency, execute a DPA before go-live, publish the sub-processor list, and support data subject rights through a documented request workflow with defined SLAs. Transfers outside the EEA rely on Standard Contractual Clauses plus a transfer impact assessment.
- EU and UK residency options
- DPA and sub-processor list on request
- Data subject request workflow with SLA
Clinical safety and result release
Results are never auto-released to end users without clinician review. Abnormal and critical values follow a defined escalation path, amendments are versioned rather than overwritten, and the ordering clinician of record is always identifiable on the report.
- Licensed clinician review before release
- Critical-value escalation with call-back
- Versioned amendments, never silent edits
Your obligations as the integrator
| Area | Requirement |
|---|---|
| Consumer consent | You must capture informed consent for testing and, where applicable, authorisation for release of results to a third party. |
| Ordering clinician | Tests must be ordered by or on behalf of a licensed clinician in the patient’s jurisdiction. We provide the network; you keep the clinical relationship. |
| Marketing claims | Do not describe our tests as diagnostic of any condition without clinician interpretation. Screening language is required by most advertising regulators. |
| Data minimisation | Send only the identifiers you need. Use external_id instead of full demographics wherever the flow allows. |
Need the full pack — BAA template, DPA, security overview, sub-processor list? Write to compliance@progmedlab.com.
Compliance FAQ
Are your partner laboratories CLIA-certified?
Yes. Every laboratory in the network holds a current CLIA certificate for the test categories it performs, and most are additionally accredited by CAP. Certificate numbers are listed on each result and available on request.
Is progmedlab HIPAA compliant?
progmedlab is built HIPAA-aligned: PHI is encrypted in transit with TLS 1.2+ and at rest with AES-256, access is role-based and logged, and a Business Associate Agreement is available for covered entities. We act as a business associate when we handle PHI on your behalf.
How does GDPR apply?
For EU and UK data subjects we offer EU and UK data residency, process data under a Data Processing Agreement, publish our sub-processor list, and honour access, rectification and erasure requests through a documented workflow.
Who reviews results?
Every result is reviewed and released by a licensed physician or clinical scientist in the jurisdiction where the specimen was collected. Critical values trigger an escalation call to the ordering clinician.
Can we get an audit report?
Yes. We provide a security overview pack with access-control design, encryption details, incident response runbook and sub-processor list. SOC 2 Type II readiness documentation is available under NDA.
Build lab testing into your product this week
Sandbox API keys are free. You only pay per test once you move to production.
CLIA-certified labs · HIPAA-aligned · No subscription