Compliance in Campus Testing: A Governance Playbook

by Stephanie August 17, 2026

Compliance in campus testing means one thing above all else: making sure every test result can survive an audit. That requires four non-negotiables working together — proper lab certification, unbroken chain-of-custody, privacy protections that hold up under HIPAA, FERPA, and ADA scrutiny, and clear ownership of who is accountable when something goes wrong.

Get any one of these wrong and the whole program becomes a liability instead of a safeguard. A test result without documented chain-of-custody is worthless in a disciplinary hearing. A lab without CLIA certification can’t legally return clinical results to an individual. A privacy breach involving test data can trigger FERPA and HIPAA exposure simultaneously. Compliance officers don’t need to master laboratory science, but they do need to know exactly what “audit-ready” looks like across each of these areas.

The essential elements break down as follows:

Certification and validation — labs and kits carry the right accreditation (CLIA, CAP) for the type of testing performed
Chain-of-custody and documentation — every specimen has a traceable, tamper-evident record from collection to result
Privacy and accommodations — HIPAA, FERPA, and ADA obligations are met and documented, not assumed
Governance and roles — a named owner exists for every stage of the testing process, with escalation paths defined in advance

Organizations like the National College Testing Association set the professional baseline for proctored academic testing, but medical and specimen-based testing on campus requires a separate, stricter layer of controls. Understanding where those two worlds diverge, and where they overlap, is the real job of campus compliance work.

Key Takeaways

Compliance in campus testing succeeds when certification, chain-of-custody, privacy protections, and clear role ownership operate as one integrated system, not four separate checklists.

Point	Details
Match testing model to regulatory lane	Diagnostic testing needs CLIA-certified labs; surveillance testing has more flexibility but still needs documentation.
Assign named owners, not departments	Unit-based ownership with documented delegation reduces the bystander risk that sinks most programs.
Build immutable audit trails	Digital chain-of-custody logs should be tamper-resistant, not just complete.
Convenience drives voluntary participation	Programs modeled on IGI FAST show convenience matters more than incentives for uptake.
Countrywidetesting supports certified workflows	Countrywidetesting offers CLIA-capable lab testing services and documentation-ready kits for institutions building compliant testing programs.

The Role of Compliance in Campus Testing: Who Owns What
Regulatory Requirements: CLIA, CAP, and CMS Guidance
Policy Governance: SOPs, Escalation, and Board Reporting
Operational Controls That Keep Testing Defensible
Choosing and Managing Labs and Test-Kit Vendors
Privacy, ADA Accommodations, and Where Legal Risk Lives
Choosing Between Surveillance and Diagnostic Testing Models
Auditing the Program and Responding When Something Breaks
What UC Berkeley’s IGI FAST Program Got Right
Your Audit-Ready Compliance Checklist
A Compliance Lead’s Perspective
Certified Testing Support for Campus Compliance Programs
Sources

The Role of Compliance in Campus Testing: Who Owns What

A testing program fails less often because of bad policy than because of unclear ownership. When three departments each assume “someone else” is watching the chain-of-custody logs, nobody is. Legal experts have flagged this pattern, sometimes called institutional bystander-ism, as one of the most common risk factors in university testing programs, and it’s almost always a structural problem rather than a personnel one.

The fix is role separation with teeth. A central compliance office sets policy, runs audits, and reports to leadership. Unit-based owners, whether that’s student health, athletics, HR, or a dedicated testing center, execute the day-to-day work and retain the evidence. The board and general counsel provide oversight on mandates, disciplinary consequences, and anything that could carry legal exposure. University compliance frameworks built this way formalize accountability specifically to reduce the cross-departmental gaps where problems hide.

Role	Primary Duties	Escalation Point	Artifacts Retained
Central compliance office	Policy design, program audits, regulatory reporting	Reports to provost/board	Audit logs, policy versions, incident reports
Unit-based owner (e.g., student health, athletics)	Daily test administration, specimen handling, staff supervision	Escalates to compliance office	Chain-of-custody records, training logs
General counsel	Legal review of mandates, disciplinary policy, breach response	Escalates to board	Legal opinions, breach notifications
Board/oversight committee	Strategic approval, risk acceptance, budget authorization	Final internal escalation	Meeting minutes, risk assessments
Testing vendor/lab	Sample processing, results reporting, SLA compliance	Escalates to unit owner	Certification proof, turnaround reports

Delegation only works if it’s written down. Best practice includes naming a backup owner for every role, documenting delegation in writing whenever a primary owner changes (a new athletics director, a semester turnover in the testing center), and requiring sign-off when responsibilities transfer mid-year.

Name a primary and backup owner for every testing function, not just the primary
Require written sign-off whenever ownership transfers between staff or terms
Review the roles table annually, not just when an incident forces the question
Keep escalation contact information current in a shared, version-controlled document

Pro Tip: Build a one-page delegation log that updates every time a role changes hands, especially around athletics season transitions or semester breaks. This single document is often the first thing an auditor asks for, and the easiest thing to lose track of.

Regulatory Requirements: CLIA, CAP, and CMS Guidance

The single biggest compliance mistake in campus testing is treating all testing as if it needs the same regulatory lane. It doesn’t. Diagnostic testing, meaning any test where an individual receives their own personal result, generally requires a CLIA-certified laboratory. Surveillance testing, which tracks population-level trends without returning individual results, can sometimes operate under different rules.

Systemwide guidance from the University of California system makes this distinction explicit: campuses running diagnostic testing must either hold CLIA certification themselves or maintain fast referral access to a CLIA-certified lab with 24 hour turnaround. Non-CLIA research labs can run surveillance testing without returning patient-specific results, unless CMS grants special enforcement discretion for a particular scenario. That discretion is not automatic, and it’s not permanent. Any campus relying on it needs a documented plan for what happens when that flexibility ends.

Before returning any individual result, a program needs:

A named laboratory director accountable for test accuracy and reporting
Documented standard operating procedures covering the full testing workflow
A validation plan proving the assay performs as claimed for its intended use
A clear line back to a CLIA-certified facility if in-house capacity is exceeded

Quick regulatory glossary:

CLIA (Clinical Laboratory Improvement Amendments): federal certification standard for labs that test human specimens and return individual results
CAP (College of American Pathologists): accreditation body with standards often exceeding baseline CLIA requirements
CMS (Centers for Medicare & Medicaid Services): federal agency administering CLIA and issuing enforcement discretion guidance
CDC (Centers for Disease Control and Prevention): source of public health testing guidance that campuses often layer on top of CLIA baseline requirements

Confusing surveillance testing with diagnostic testing is how programs end up promising results they aren’t legally certified to deliver.

Policy Governance: SOPs, Escalation, and Board Reporting

A testing program without a written policy stack is a program running on institutional memory, and institutional memory leaves with the people who have it. The core documents compliance needs in place before testing begins:

A policy statement defining the program’s purpose, scope, and legal basis
Standard operating procedures for specimen handling, from collection through disposal
Data privacy rules specifying who can access results and under what conditions
Vendor SLAs defining turnaround time, error rates, and audit access
A disciplinary and escalation pathway for positive results, refusals, or procedural failures

Governance only works with a reporting rhythm attached to it. Monthly reporting typically covers operational metrics: turnaround time, participation rates, and incident counts. Quarterly reporting to the board or a risk committee should cover trend analysis and any policy changes. Ad hoc reporting triggers immediately after any breach, positive result dispute, or regulatory inquiry.

Every SOP should include these headings at minimum:

Identity verification procedure
Specimen collection and labeling protocol
Chain-of-custody transfer log
Laboratory accessioning process
Result reporting and notification procedure
Data retention and disposal schedule

Pro Tip: Run a tabletop exercise twice a year simulating a positive result dispute or a data breach, and loop in legal counsel before the exercise, not after. Counsel spots gaps in escalation timing that operational staff often miss entirely.

Operational Controls That Keep Testing Defensible

Every strong testing program comes down to the same operational sequence, executed the same way every time. Deviation is where defensibility breaks down.

Verify the individual’s identity before specimen collection begins
Label the specimen immediately, with the individual present to confirm accuracy
Store the specimen in tamper-evident packaging from the moment of collection
Transport under documented custody, with a signature at every handoff
Confirm lab accessioning matches the collection record exactly
Verify results against the chain-of-custody log before release

Academic testing centers already apply a version of this discipline. Positive identification, continuous monitoring during test administration, and accurate timing are baseline expectations under NCTA standards, and models like ASU’s testing services show how proctoring controls translate into practice. But NCTA’s standards were built for proctored academic exams, not specimen-based medical testing. Medical specimen chains of custody demand an additional layer: restricted-access storage, tamper-evident seals, and sometimes video monitoring, because the evidentiary bar is closer to forensic standards than classroom proctoring.

Control area	Academic testing (NCTA baseline)	Specimen-based testing (medical baseline)
Identity verification	Photo ID check	Photo ID check plus signed collection form
Monitoring	Proctor observation	Tamper-evident packaging, restricted access
Documentation	Test session log	Full chain-of-custody transfer log
Storage	Not applicable	Locked, access-logged storage

Staff administering or proctoring tests need documented training before they touch a specimen or run a session, and that training record needs retention on the same schedule as the testing records themselves. A QA sampling plan, reviewing a fixed percentage of chain-of-custody files each month for gaps, catches drift before an external auditor finds it first.

Verify staff training completion before granting testing-room or specimen access
Retain training records for the same period as the underlying test results
Audit a sample of chain-of-custody files monthly, not just annually
Log every specimen handoff with a timestamp and a name, not an initial

Pro Tip: Digital chain-of-custody logs should be immutable, meaning no one can quietly edit a timestamp after the fact. Evidence that isn’t tamper-resistant is not audit-ready evidence, no matter how complete it looks on the surface.

Choosing and Managing Labs and Test-Kit Vendors

Vendor selection is a compliance decision, not just a procurement one. Every lab or supplier on a campus testing program should be evaluated against the same core template before a contract gets signed.

Fields that matter most:

Certification status — CLIA number, CAP accreditation if applicable, and confirmation both are current
Turnaround time — contracted SLA, not a marketing claim, ideally with a written 24 hour standard for anything requiring individual results
Sample handling — documented procedures matching the campus’s own chain-of-custody requirements
Data security — encryption standards, access controls, and breach notification timelines
Business associate agreements — required wherever HIPAA-covered data is shared with a vendor

Evaluation criterion	Campus lab (in-house)	Commercial CLIA lab
Certification maintenance	Ongoing internal cost	Vendor’s responsibility
Turnaround control	Direct control	Governed by SLA
Surge capacity	Limited by staffing	Typically higher, contract dependent
Data security oversight	Internal IT policy	Vendor security audit required

Contracts should require turnaround time guarantees with financial or service remedies attached, chain-of-custody attestations delivered with every batch of results, and audit access, meaning compliance can request and review the vendor’s own logs on demand, not just their summary reports.

In-house campus labs make sense when volume is predictable and staffing is stable. Commercial CLIA labs make more sense during surge periods, such as the start of a semester or a public health event, when demand can spike well beyond what a small in-house team can absorb. Build the surge plan into the vendor contract before you need it, not during the crisis.

Pro Tip: Ask any prospective lab vendor for their most recent CLIA survey results, not just their certificate number. A certificate confirms they’re registered; survey results tell you how they actually performed against inspectors.

Privacy, ADA Accommodations, and Where Legal Risk Lives

HIPAA and FERPA overlap in confusing ways on campus, and getting the distinction wrong is one of the fastest routes to legal exposure. HIPAA generally governs health information created or maintained by a covered entity, such as a campus health clinic providing clinical care. FERPA governs education records maintained by the institution. A drug test administered through student health services may fall under HIPAA; the same test result, once it becomes part of a disciplinary record maintained by the registrar or dean of students, may shift into FERPA territory. Programs that don’t map this transition in writing tend to discover the gap only after a records request forces the question. A closer look at how HIPAA compares to other privacy frameworks is worth reviewing for any institution handling health data across multiple systems.

ADA accommodations add another layer. Testing centers already build accessibility into academic proctoring, and accreditation standards require documented, uniform accommodation policies precisely so accommodations don’t turn into discrimination claims. The same rigor applies to medical testing: if one examinee gets extended time or an alternative collection method, the criteria for that accommodation need to be documented and applied consistently, not decided case by case in the moment.

Public health reporting obligations can trigger notification duties independent of internal policy
Any new testing mandate or disciplinary consequence should go through legal review before rollout
Accommodation requests need a documented, repeatable approval process, not ad hoc judgment calls
Data-sharing agreements with outside labs need a HIPAA business associate agreement where covered data is involved

Formalizing accountability and documenting accommodation criteria in advance is what separates a defensible program from one that only looks compliant until the first challenge arrives.

Legal counsel should review any testing mandate before it’s announced, not after students start asking questions.

Choosing Between Surveillance and Diagnostic Testing Models

Surveillance testing and diagnostic testing solve different problems, and conflating them is where programs get into trouble. Surveillance testing works at the population level. It’s designed to spot trends, not diagnose individuals, and it often doesn’t require returning a personal result to each participant. Diagnostic testing is clinically ordered, tied to an individual’s own care or compliance requirement, and it does require a CLIA-certified lab.

Voluntary and mandatory programs carry different documentation burdens. A voluntary program needs clear informed consent and transparent communication about what happens to the data. A mandatory program needs a documented disciplinary policy, a defined appeals process, and legal sign-off before it launches, because mandates invite legal challenge in a way voluntary programs rarely do.

Decide whether the goal is population-level trend detection or individual clinical results
Match the testing model (surveillance vs. diagnostic) to that goal, not the other way around
Build consent and communication materials appropriate to voluntary or mandatory status
Confirm lab certification matches the model chosen before the first specimen is collected

Participation strategy matters as much as the legal design. The levers that move uptake:

Convenience: shorter lines, flexible hours, and multiple collection sites drive participation more than incentives do
Incentive structure: modest rewards can help, but they rarely outperform simple convenience
Communication tone: framing testing as protective rather than punitive improves voluntary uptake

Auditing the Program and Responding When Something Breaks

An audit-ready program can produce evidence on demand, not scramble to reconstruct it after a regulator or reporter asks a question. The checklist compliance should be able to satisfy at any time includes proof of current certification, complete chain-of-custody logs, staff training records, signed business associate agreements, and vendor SLA performance reports.

Ongoing monitoring should track turnaround time, positive rate trends, participation levels, and any backlog in processing, reviewed on a fixed sampling schedule rather than only when a problem surfaces.

When an incident does happen, the sequence matters:

Contain the issue immediately, whether that’s a data exposure or a chain-of-custody break
Notify internally per the escalation pathway, and notify public health authorities if required
Run confirmatory testing where a disputed result is involved
Track remediation to completion, not just to the point of an initial fix
Hold an after-action review and update the SOP that failed

Sample a fixed percentage of chain-of-custody files monthly for QA review
Document every incident regardless of severity, so patterns become visible over time
Treat every after-action review as a required SOP update, not an optional exercise

Pro Tip: Track incidents in the same log every time, even the minor ones. A pattern of small chain-of-custody gaps is a much stronger predictor of a future major failure than any single serious incident.

What UC Berkeley’s IGI FAST Program Got Right

The IGI FAST program at UC Berkeley ran as a voluntary saliva surveillance effort, and it offers one of the clearest operational lessons in campus testing: convenience decides participation more than almost anything else. A participation survey found most respondents indicated willingness to take part in a similarly convenient surveillance model, even though the testing was structured as research rather than clinical care.

What made it work operationally was that the program maintained privacy handling consistent with HIPAA standards despite its research classification, and it built a clear handoff plan: once the assay was validated for clinical use, responsibility for sample collection and reporting shifted to actual clinical services rather than staying embedded in the research infrastructure.

Convenience wasn’t a nice-to-have in the IGI FAST model. It was the single most critical determinant of whether students chose to participate at all.

Three lessons compliance officers can lift directly from this model:

Make testing genuinely convenient before considering incentives or mandates
Communicate clearly whether a program is research, surveillance, or diagnostic, and don’t blur that line
Build the handoff plan to clinical services before validation happens, not after

Your Audit-Ready Compliance Checklist

Building this checklist into your program documentation this week closes most of the gaps that show up in an external review.

Confirm current CLIA and/or CAP certification for every lab in the testing chain
Verify chain-of-custody logs exist for every specimen collected in the past year
Confirm training records are current for every staff member administering tests
Verify signed business associate agreements exist wherever HIPAA data is shared externally
Confirm reporting templates exist for internal, board, and public health notifications

Identity verification procedure
Specimen collection and labeling protocol
Transport and chain-of-custody transfer log
Lab accessioning process
Result reporting and notification procedure
Data retention and disposal schedule

A downloadable version of this framework can be adapted to fit your institution’s own governance structure, whether that’s a centralized compliance office or a more distributed, unit-owner model.

Point	Details
Certification comes first	Confirm CLIA/CAP status before any lab or vendor touches a specimen.
Documentation is the defense	Chain-of-custody logs must be complete and tamper-evident to survive an audit.
Convenience drives participation	Programs like IGI FAST show convenience outweighs incentives in voluntary testing.

A Compliance Lead’s Perspective

Most testing programs don’t fail because of a single bad policy. They fail because delegation was informal, and nobody could point to a document proving who owned what when an auditor asked. Tabletop exercises expose that gap faster than any policy review ever will, because they force the question “who handles this right now” before a real incident forces it.

Pro Tip: Run a 30-day evidence-collection sprint: pull every training record, certification, and chain-of-custody log you currently have, and see what’s actually missing. Most administrators are surprised by the gap between what they assumed existed and what they can actually produce.

Certified Testing Support for Campus Compliance Programs

Building a defensible testing program gets considerably easier when your lab and kit sources already carry the certifications your compliance framework requires. Countrywidetesting works with CLIA-capable laboratory testing services and supplies test kits designed with documentation and chain-of-custody support built in, so your team spends less time chasing certification paperwork after the fact and more time running the program itself.

This article is published by Countrywidetesting, and every institution’s compliance obligations differ depending on jurisdiction, testing model, and existing policy. Consult legal counsel before implementing any new testing mandate or disciplinary consequence tied to results. For institutions evaluating lab partners or bulk kit orders, from confirmation testing options to broader panel screening, reviewing lab testing services is a practical next step toward closing the certification and documentation gaps this article covers.

Sources

Before finalizing any testing policy, review these authoritative sources directly rather than relying on secondhand summaries:

Loop in legal counsel early. Every source above establishes a baseline, but your specific mandate, jurisdiction, and disciplinary consequences still need a legal review before rollout.

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.