ISO 15189 is the international standard that medical laboratories use to demonstrate quality and technical competence, and for a genomics lab it reaches well beyond the sequencer. Assessors expect the dry lab (bioinformatics, interpretation software, report generation) to be validated, version-controlled and auditable with the same rigor as the wet lab. If your lab also reports pharmacogenomics (PGx), they will look at how you keep guideline-based interpretation current. This guide explains what that means in practice and how to prepare.
TL;DR
- ISO 15189:2022 is a risk-based standard covering the whole workflow, from pre-examination through result reporting and clinical communication.
- Accreditation guidance for NGS testing treats bioinformatic pipelines, including database selection, data integrity and version control, as something to be formally validated.
- For PGx, a static lookup table that someone updates by hand is a quality risk. Plan a documented process for guideline version reconciliation and alerts.
- If you use third-party software or an external interpretation service, you remain responsible for the validity of its output, so keep vendor due diligence, service-level agreements and independent verification on file.
- Retention and confidentiality rules (HIPAA, GDPR and local law) must be written into your procedures before sequencing starts.
Table of Contents
- What ISO 15189 requires of a genomics laboratory
- Why the dry lab is where genomics labs get caught
- Pharmacogenomics adds a moving target
- The black box problem: third-party software and services
- Confidentiality and genetic data retention
- Our perspective: accreditation is a documentation culture
- A readiness checklist before your assessment
- Where a reporting platform fits
- FAQ
- Sources
What ISO 15189 requires of a genomics laboratory
The current edition, ISO 15189:2022, Medical laboratories: Requirements for quality and competence, is the primary international reference for demonstrating that a laboratory produces reliable results. It takes a risk-based view of the entire process: patient preparation and sample collection on the pre-examination side, analysis in the middle, and result reporting, interpretation and clinical communication at the end.
That last stretch matters most for genomics. A genome or a PGx panel produces enormous volumes of data, and the clinically meaningful product is the interpreted report, not the raw call set. The 2022 edition moves away from simple process compliance toward system-wide risk management, which fits the complexity of modern genomic data.
The transition is not optional if you hold an older accreditation. UKAS notes that laboratories accredited under ISO 15189:2012 had a three-year transition period with a deadline of December 2025, and that transition assessments are part of annual assessments. If you are in the United States, your accreditation body and its scheme rules govern how you demonstrate this, and ISO 15189 often sits alongside CLIA requirements rather than replacing them. Confirm with your accreditor how each applies to your scope.
Where genomics-specific guidance fills the gaps
The standard itself is general. Several bodies have published application guidance for molecular and genomic testing, and assessors draw on it:
- The EA-4/24 G:2025 document is written for national accreditation bodies that assess laboratories performing NGS-based genetic testing, including whole genome sequencing.
- The UKAS LAB 60 policy sets out how medical laboratories performing genomic tests are accredited in the UK, across several service delivery models.
- The Japanese Committee for Clinical Laboratory Standards guidance applies ISO 15189 to molecular-genetic examination.
- Singapore's SAC technical note MED 002 gives specific criteria for genetics and genomics testing.
These are regional documents, and none is a US legal requirement on its own. Read them as a picture of what assessors increasingly expect, then map each expectation to your own accreditor's checklist.
Why the dry lab is where genomics labs get caught
The most common surprise is that software is treated as part of the measurement system. Per the EA guidance, bioinformatic pipelines, including database selection, data integrity and version control, must be validated like analytical instruments. The JCCLS document makes the same point from the molecular-genetic side: raw-data-to-report software needs its own validation documentation, audit trails and a strategy for managing versions.
In practice, assessors will ask you to show:
- A defined pipeline version. Which aligner, caller, annotation sources and reference build produced this report, and when did any of them change?
- Validation evidence. Accuracy, reproducibility and limits of detection for the pipeline as a whole, not just for the chemistry.
- Change control. What happens when a database or software component is updated, who approves it, and what revalidation is triggered.
- Data integrity. Controlled access, traceable edits and a record of who approved each result.
If you need a general framework for risk-based software validation, a risk assessment approach to computer system validation under FDA CSA and ICH Q9(R1) is a useful reference for scoping how much testing each software function deserves. It comes from the pharmaceutical and device world, so adapt it to your accreditor's expectations instead of treating it as a laboratory requirement.
A worked example: one annotation update
Suppose your annotation source releases an update that changes the classification of a variant on your panel. Without change control, reports issued in March and in June may reach different conclusions on the same genotype, and nobody can say why. With change control, the update is logged, assessed for impact, verified against a set of known samples, approved by a named reviewer and recorded against the report version. That is the evidence an assessor wants to see, and it is also what lets you answer a clinician who asks why a result changed.
Pharmacogenomics adds a moving target
PGx reporting is unusual because the interpretation keeps changing even when the assay does not. CPIC and DPWG guidelines are revised, and FDA labeling is updated. Expert consensus from CPIC and ACMG-linked groups holds that analytical results alone are not enough: reports should include interpretive content such as drug-gene associations and clinical ramifications, written so a non-expert clinician can act on them.
The ACMG standards for CYP2D6 testing illustrate why. Variants in CYP2D6 can make patients intermediate or poor metabolizers of drugs such as tamoxifen, so a single allele call has real prescribing consequences. Copy number and structural variation add further complexity, which we cover in our CYP2D6 copy number guide for US labs.
Document the guideline version behind every report
A defensible report states what was concluded and which guideline version supports it. That allows re-analysis later, when the evidence changes. Practical elements to build in:
- A record of the CPIC, DPWG and FDA table versions used at the time of sign-out.
- A scheduled review cadence, plus a trigger when a guideline you rely on is revised.
- A rule for when prior reports are re-evaluated and how clinicians are notified.
- Evidence grading, so reviewers can see why a recommendation carries the weight it does. Our guide to evidence-graded PGx reporting shows how CPIC, PharmGKB and FDA sources map to a defensible report.
To see how the genotype becomes a clinical statement, read our genotype-to-phenotype reporting guide. For a broader operational plan, this CPIC implementation checklist walks through the steps.
The black box problem: third-party software and services
Many labs buy interpretation software or send work to an external service. Accreditation does not move with the work. Assessors hold the laboratory responsible for the validity of third-party output, so you need proof you are not simply accepting a vendor's interpretation.
A reasonable vendor oversight file includes:
| Evidence | What it shows |
|---|---|
| Vendor qualification record | You assessed the supplier before use, against defined criteria |
| Service-level agreement | Responsibilities, turnaround, change notification and support are explicit |
| Independent verification | Your own samples or reference cases confirm the output is correct |
| Change notifications | You learn of software or knowledge-base changes before they affect reports |
| Clinical oversight record | A named director or reviewer approves each report |
This is also the strongest argument for keeping a clinician in control of final sign-out. Automation should assemble evidence and draft the report. Your medical director should decide what is released, with an audit trail showing who reviewed what and when.
Confidentiality and genetic data retention
Genetic data is among the most sensitive information a laboratory holds, and ISO 15189 expects retention and confidentiality to follow both the standard and local law. In the US that includes HIPAA, and for international work GDPR may apply. Retention periods vary by data type, jurisdiction and accreditor, so write them down per data class: raw FASTQ and BAM files, VCFs, annotated outputs, reports and audit logs each behave differently in storage cost and risk.
Decisions that are cheap before sequencing and costly afterward:
- What you keep (raw reads, variant files, or both), and for how long.
- Where it lives and who can access it.
- How you honor a deletion or restriction request without breaking the audit trail.
- How stored data stays reproducible when pipelines change.
We lay out a practical sequence in Genomic Data Retention: 5 Steps Lab Stewards Can Take Before Sequencing. For privacy-policy design in a consumer context, the Future of Privacy Forum's best practices for genetic testing services cover collection, retention, sharing and use of genetic data. They were written for direct-to-consumer services, so treat them as a reference point rather than a clinical lab standard.
Our perspective: accreditation is a documentation culture
We build PGx reporting infrastructure for laboratories, and the pattern we see is consistent. Labs rarely fail on the assay. They struggle to show, months later, exactly why a report said what it said.
The WHO quality-management materials describe accreditation as a continuous improvement pathway. The SLIPTA checklist is built on that idea of stepwise progress. For PGx, that continuous view is the whole point: guidelines change, so a report is a snapshot of evidence at a moment in time, and your system should say which moment.
That is why we designed SignalPGx around three principles:
- Evidence fusion with grading. Genotype and medication data are combined with clinical evidence from 15+ authoritative sources, so reviewers see the basis for each recommendation.
- Living reanalysis. When guidelines evolve, recommendations are updated and alerts raised, which replaces manual lookup-table maintenance and the version drift that comes with it.
- Clinician control. Medical-director review and an audit trail sit between automation and release, because your lab, not the software, owns the result.
We would not tell any lab that software alone delivers accreditation. Your quality manual, validation studies and staff competence still carry the assessment. What good tooling does is make the evidence easy to produce.
— Tarek
A readiness checklist before your assessment
Use this as a gap-analysis starting point, then align it with your accreditor's own criteria.
- Map the workflow. Draw every step from sample receipt to report delivery, including the software at each step.
- Classify software by risk. Decide which components affect the clinical result and need full validation.
- Freeze and record versions. Pipeline, reference build, annotation sources, guideline versions.
- Write the change-control procedure and test it with a real update.
- Document the interpretation process. Who reviews, with what evidence, against which guideline.
- Audit your vendors. Qualification, SLAs, verification data.
- Set retention and access rules per data class and confirm they match HIPAA, GDPR or other applicable law.
- Run an internal audit and record corrective actions, since documenting deviations is the habit assessors value most.
Where a reporting platform fits
If your lab wants to offer PGx reports without building and validating the whole reporting stack yourself, our White-Label PGx Reporting platform delivers branded, physician-reviewed reports with living reanalysis, HL7/FHIR integration with EHRs, an audit trail and HIPAA/GDPR-aligned controls, typically deployed in 5 to 7 days. Our Discovery & Strategy, System Design and Deployment & Integration services help your team scope validation, map the workflow and connect the platform to your LIS. Discovery & Strategy starts from $7,000 per project, System Design from $9,000, and Deployment & Integration from $15,000. Plan pricing for the reporting subscription is not published, so contact us for a quote.
FAQ
What does ISO 15189 stand for?
It is the number of the international standard titled Medical laboratories: Requirements for quality and competence, published by ISO. The current edition is ISO 15189:2022. Laboratories use it to show competence and consistent quality of results.
Does ISO 15189 apply to bioinformatics and reporting software?
Yes, in practice. Accreditation guidance for NGS testing, such as EA-4/24 G:2025, expects pipelines, databases and version control to be validated. Interpretation and reporting are part of the examination process, so assessors review them.
Do I stay responsible if a vendor interprets the data?
Assessors expect you to. You should keep vendor qualification records, service-level agreements and your own verification evidence, and keep a qualified reviewer in charge of final approval. Outsourcing the work does not outsource the accountability.
How long should a lab retain genetic data?
There is no single answer. Retention depends on the data type, your accreditor, and laws such as HIPAA or GDPR, plus any state rules. Set a written period for each data class with your compliance officer and legal counsel, and see our data retention steps for how to plan it before sequencing.
Sources
- ISO 15189:2022, Medical laboratories: Requirements for quality and competence
- UKAS: the transition to ISO 15189:2022
- EA-4/24 G:2025
- UKAS LAB 60: accreditation of medical laboratories performing genomic tests
- JCCLS ISO 15189 Application Guidance Document for Molecular-Genetic Examination
- SAC MED 002: Genomics and Genetics Testing
- Pharmacogenomics Return of Results in the All of Us Research Program (CPIC)
- Laboratory testing of CYP2D6 alleles in relation to tamoxifen therapy (ACMG)
- Privacy Best Practices for Consumer Genetic Testing Services
- WHO SLIPTA checklist