US

42 CFR Part 2: Confidentiality of Substance Use Disorder Patient Records

HHS rule protecting the confidentiality of substance use disorder patient records; the HHS Office for Civil Rights enforces it.

Biosafety in Microbiological and Biomedical Laboratories (BMBL), 6th Edition

CDC and NIH advisory guidance on biosafety practices and containment levels for laboratories working with infectious agents and toxins.

Building and Fire Codes for Laboratory Facilities

Model building and fire codes used for laboratory and research facilities, published by the ICC and NFPA and adopted by state and local governments.

California Confidentiality of Medical Information Act (CMIA)

California law (Civil Code §56 et seq.) limiting how health care providers, health plans, contractors and others use and disclose medical information.

California Consumer Privacy Act (CCPA), as amended by the CPRA

California consumer privacy law, amended by the CPRA, enforced by the Attorney General and the California Privacy Protection Agency (CalPrivacy).

CAP Laboratory Accreditation Program

College of American Pathologists accreditation programs for laboratories, including the Laboratory Accreditation Program and CAP 15189.

Clinical Laboratory Improvement Amendments (CLIA)

Federal quality standards for US laboratories testing human specimens, administered by CMS with CDC and FDA under 42 CFR Part 493.

Clinical Laboratory Improvement Amendments (CLIA) and Clinical Genetic Testing

CLIA sets federal quality standards for clinical laboratory testing on humans, including genetic tests; CMS runs the program with FDA and CDC.

CMS Emergency Preparedness Rule

CMS rule requiring Medicare and Medicaid participating providers and suppliers to maintain emergency plans, procedures, communication, training and …

Common Rule (45 CFR Part 46) and IRB Oversight

HHS regulations at 45 CFR Part 46 protecting human research subjects and governing IRB review, overseen by the Office for Human Research Protections.

Contract Drug Manufacturing under cGMP

FDA current good manufacturing practice rules as they apply to contract drug manufacturers and to quality agreements between owners and contract …

Current Good Manufacturing Practice (CGMP) for Drugs

FDA current good manufacturing practice regulations for drug manufacturing, processing, packing and holding (21 CFR Parts 210 and 211).

Cyber Insurance Readiness

Topic entry: no single framework governs cyber insurance; insurers assess cyber risk in their own underwriting. Links regulator references.

Data Retention and Secure Destruction

Index of US federal sources on records retention and media sanitization, including HIPAA documentation rules, 21 CFR Part 11 and NIST SP 800-88.

Drug Supply Chain Security Act (DSCSA)

US law setting up electronic, interoperable tracing of prescription drug packages through the supply chain, implemented by the FDA.

ESG and Sustainability Reporting Standards

Index of sustainability disclosure standards and rules, including GRI, ISSB (IFRS S1 and S2), SASB, the EU CSRD and SEC climate rules.

FDA 21 CFR Part 11: Electronic Records and Electronic Signatures

FDA regulation, 21 CFR Part 11, setting criteria under which electronic records and electronic signatures are accepted in place of paper records.

FDA Artificial Intelligence-Enabled Medical Devices

FDA guidance and resources for medical devices with AI-enabled software functions, including predetermined change control plans (PCCPs).

FDA Device Software Functions and Mobile Medical Applications

FDA guidance on which software functions and mobile apps FDA regulates as medical devices and where it applies enforcement discretion.

FDA Quality Management System Regulation (21 CFR Part 820)

FDA's Quality Management System Regulation for medical device manufacturers, effective 2026-02-02, incorporating ISO 13485:2016 by reference.

Federal Risk and Authorization Management Program (FedRAMP)

GSA's government-wide program that assesses and certifies the security of cloud services used by US federal agencies.

Financial Conflict of Interest in PHS-Funded Research (42 CFR Part 50 Subpart F)

HHS rules at 42 CFR Part 50 Subpart F on managing investigator financial conflicts of interest in PHS-funded research, including NIH awards.

Good Clinical Practice (ICH E6(R3))

International standard for the design, conduct and reporting of clinical trials (ICH E6(R3)), issued by FDA as final guidance in the US.

Gramm-Leach-Bliley Act (GLBA)

US law requiring financial institutions to explain how they share customer information and to safeguard it, enforced in part by the FTC.

Health Industry Cybersecurity Practices (HICP), HHS 405(d) Program

Voluntary cybersecurity practices for health care organizations from the HHS 405(d) program, published on the HHS Cyber Gateway.

Health Information Technology for Economic and Clinical Health (HITECH) Act

2009 US law that strengthened HIPAA privacy, security, breach notification and enforcement; HHS OCR enforces the HIPAA rules that implement it.

Healthcare Accessibility under the ADA and Section 504

Federal disability rights rules for health care under the ADA and Section 504, enforced by the HHS Office for Civil Rights and the Department of …

HIPAA Business Associate Contracts

HHS requirements and sample provisions for HIPAA business associate contracts between covered entities and their service providers.

Massachusetts Cannabis Control Commission Regulations (935 CMR 500 and 501)

Massachusetts Cannabis Control Commission rules for adult-use (935 CMR 500) and medical (935 CMR 501) marijuana licensing and operations.

Massachusetts Cannabis Facility Security Requirements (935 CMR 500.110 and 501.110)

Massachusetts Cannabis Control Commission security rules for marijuana businesses: access control, alarms, surveillance and storage.

Medical Device Single Audit Program (MDSAP)

MDSAP lets one recognized auditing organization audit a device maker for the FDA, Health Canada, TGA, ANVISA and Japan's MHLW and PMDA.

Medicare and Medicaid Provider Enrollment

CMS requirements for enrolling and revalidating as a Medicare provider or supplier through PECOS, with Medicaid enrollment rules in 42 CFR 455.

Medicare Clinical Trial Policy (NCD 310.1)

CMS national coverage determination 310.1 on Medicare payment for routine costs in qualifying clinical trials.

Mental Health Parity and Addiction Equity Act (MHPAEA)

Federal law requiring parity between mental health and substance use disorder benefits and medical/surgical benefits in health plans.

Metrc Seed-to-Sale Tracking

Cannabis seed-to-sale tracking system run by Metrc LLC that state regulators such as the Massachusetts CCC require licensees to use.

NCI Best Practices for Biospecimen Resources

National Cancer Institute best practices for biospecimen resources: governance, collection, processing, storage, retrieval and dissemination of …

New York SHIELD Act (General Business Law §§899-aa, 899-bb)

New York law setting data security safeguards and breach notice rules for private information of New York residents, enforced by the Attorney General.

NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules

NIH biosafety requirements for research with recombinant or synthetic nucleic acid molecules at institutions that receive NIH support for such …

NIST Cybersecurity Framework (CSF) 2.0

NIST guidance for managing cybersecurity risk, organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

NIST SP 800-53 Rev. 5 Security and Privacy Controls

NIST catalog of security and privacy controls for information systems and organizations, developed under FISMA. Current: Rev. 5, Release 5.2.0.

OSHA General Industry Standards (29 CFR 1910)

US Department of Labor OSHA safety and health standards for general industry workplaces, codified at 29 CFR Part 1910.

OSHA Laboratory Standard (29 CFR 1910.1450)

OSHA standard on occupational exposure to hazardous chemicals in laboratories, requiring a Chemical Hygiene Plan, training and exposure controls.

Outbreak Investigation and Infection Control

Topic entry for outbreak investigation and infection control, pointing to CDC outbreak resources and related OSHA, CMS and state requirements.

Pharmacy Licensing and DEA Registration

State pharmacy board licensure and DEA controlled substance registration under 21 CFR Part 1301 for pharmacies, practitioners and researchers.

PHS Policy and Animal Welfare Act Requirements for Animal Research (IACUC)

Federal oversight of research animal care and use: NIH OLAW administers the PHS Policy and USDA APHIS enforces the Animal Welfare Act.

Professional Liability Insurance Regulation (State Insurance Regulators and NAIC)

U.S. professional liability insurance is regulated by the states; NAIC, governed by the state insurance regulators, publishes model laws.

Public Health Reporting and Surveillance

State-mandated reporting of notifiable diseases by providers and labs to health departments, which share case data with CDC through NNDSS.

Remote Patient Monitoring (RPM)

Federal sources on remote patient monitoring, including HHS telehealth guidance and CMS Medicare physician fee schedule billing rules.

Research Data Management and FAIR Principles

Research data management and sharing practices, including the FAIR principles and the NIH Data Management and Sharing Policy for NIH-funded work.

Resource Conservation and Recovery Act (RCRA) Hazardous Waste Regulations

EPA's hazardous waste program under RCRA, which regulates hazardous waste from generation through transport, treatment, storage and disposal.

Resource Conservation and Recovery Act (RCRA) Hazardous Waste Regulations

US EPA rules under the Resource Conservation and Recovery Act for hazardous waste generation, transportation, treatment, storage and disposal.

SAMHSA Grants: Federal Award Requirements

Requirements for SAMHSA grant recipients under SAMHSA award terms, the HHS Grants Policy Statement, and federal award rules at 2 CFR 200 and 300.

SOC 2 (System and Organization Controls 2)

AICPA examination of service organization controls under the Trust Services Criteria: security, availability, processing integrity, confidentiality, …

Telehealth Policy and Regulation

Federal and state rules for care delivered by telehealth, covering licensure, controlled substance prescribing, privacy and Medicare payment.

Texas Medical Records Privacy Act (Health and Safety Code Chapter 181)

Texas Health and Safety Code Chapter 181, Medical Records Privacy, sets state rules for protected health information held by covered entities.

U.S. Export Controls: EAR and ITAR

U.S. export controls: the EAR, administered by Commerce's Bureau of Industry and Security, and the ITAR, administered by the State Department's DDTC.

U.S. National Pandemic Influenza Strategy and HHS Pandemic Influenza Plan

Federal pandemic influenza planning documents, including the National Strategy for Pandemic Influenza and the HHS Pandemic Influenza Plan, indexed by …

Unique Device Identification (UDI): FDA and EU

Medical device identification rules requiring a UDI on labels, with device data in FDA's GUDID in the US and EUDAMED in the EU.

US Federal Employment Law

Federal workplace laws on wages, leave, discrimination and labor relations, administered by the Department of Labor, the EEOC and the NLRB.

Vendor and Third-Party Risk Management

Index of US federal sources on managing vendor and supply chain security risk, including HIPAA business associate rules and NIST SP 800-161.