Regulatory path, quality system and the honesty charter

In plain English: A blood test can only be sold after regulators review the evidence, and laboratories are inspected. This page lays out each approval step, roughly how long it takes, and ten rules that keep the company honest.

1. Who regulates what

Device pathways. Most clinical chemistry, hematology and immunoassay tests are Class II and reach market through a 510(k), which shows substantial equivalence to a legally marketed predicate. Novel low-to-moderate-risk devices use De Novo (Visby's first over-the-counter PCR, Biolinq's intradermal sensor). Some tests need a full PMA (OPKO's fingerstick PSA in 2019). The FY2027 510(k) user fee is $28,653, or $7,163 for a small business.

CLIA complexity. FDA categorizes each cleared test as waived, moderate or high complexity. Tests FDA has not categorized, including laboratory-developed tests, default to high complexity. Waived tests can run at any site holding a Certificate of Waiver, including pharmacies; 48 states allow pharmacists to perform point-of-care tests.

Getting a waiver. A manufacturer can file a CLIA Waiver by Application after clearance, or a Dual 510(k) and CLIA Waiver by Application in one submission (FDA recommends a pre-submission first). FDA's goals are a waiver decision in 150 days (320 if an advisory panel is needed) and a dual submission in 180 days. In practice, the 62 dual clearances between 2020 and 2026 took a median of 232 calendar days (interquartile range 178 to 357), and they were only 0.29 percent of all clearances. There is no fee for a waiver application; a dual submission pays the 510(k) fee. Dual submissions require studies in which untrained operators at intended-use sites get accurate results.

Laboratory-developed tests after March 31, 2025. A federal court in Texas vacated FDA's 2024 rule that would have brought laboratory-developed tests under device premarket review (American Clinical Laboratory Association v. FDA). FDA did not appeal and on September 19, 2025 published a rule restoring the prior regulation text. Today a test designed and performed within a single CLIA-certified laboratory needs no FDA premarket review; CLIA and state law govern it. Distributing the test, or the instrument, to other sites makes it a device. Legislation could change this again.

2. The phased path

Phase B is the step Theranos abused. Theranos ran laboratory-developed tests in its own lab and used the pharmacies as collection sites, which was legal; it failed because the tests were not validated, the lab failed inspection, and the company told patients and investors things that were false. Thimble's phase B uses the same legal structure with CAP accreditation (inspected every two years), a named and empowered director, published validation, and a hard rule that nothing is marketed beyond its validated performance.

Phase B also produces the asset phase C needs: thousands of paired capillary and venous results, collected under IRB, that show exactly which analytes hold up from capillary blood.

3. Predicates and waiver prospects, module by module

4. Evidence plan

• Analytical: CLSI EP05 (precision), EP06 (linearity), EP07 (interference), EP09 (method comparison against a cleared laboratory analyzer), EP17 (detection limits), EP28 (reference intervals).
• Capillary versus venous: a prospective, multi-site, IRB-approved study of at least 2,000 adults with paired samples, covering trained and minimally trained collectors, extremes of hematocrit, a range of skin tones and ages, and every analyte. Pediatrics later.
• Waiver: untrained operators at three or more intended-use sites, comparison with a reference method, and flex studies (temperature, humidity, short and long fills, timing errors), following FDA's guidance on dual 510(k) and CLIA waiver studies.
• Publication: method-comparison papers submitted to peer-reviewed journals (for example the Journal of Applied Laboratory Medicine) before any marketing claim relies on them.

5. Quality system

• FDA's Quality Management System Regulation, which since February 2, 2026 incorporates ISO 13485:2016 by reference: design controls, risk management (ISO 14971), supplier controls, corrective and preventive action, complaint handling, medical device reporting, unique device identification and IVD labeling.
• Product standards: IEC 61010-1 with -2-101 (IVD equipment) and -2-020 (centrifuges), IEC 61326-2-6 (EMC), IEC 62304 (software life cycle), IEC 62366-1 (usability), ISO 15223-1 (symbols), ISO 23640 and CLSI EP25 (reagent stability).
• Cybersecurity: section 524B of the Federal Food, Drug, and Cosmetic Act applies to connected devices: a software bill of materials, a vulnerability management plan and secure design documentation in every submission.
• Machine learning: a predetermined change control plan, agreed with FDA, for any future update of the hematology classifier.
• Changes after clearance: every design change is assessed under FDA's guidance on when a change needs a new 510(k). Cue Health was shut down after FDA found unauthorized changes to its cleared test; that is the failure mode this rule exists for.
• Post-market surveillance using the fleet: the same cloud QC that locks out drifting analytes also trends complaints and field performance across every site.

6. The laboratory

• Certificate: CLIA certificate of accreditation through CAP, high complexity.
• Laboratory director: a physician board-certified in clinical pathology, or a doctoral scientist with board certification and the required experience directing high-complexity testing; at least 20 hours of continuing education on director responsibilities; on site at least twice a year with at least four months between visits (both added by the rule effective December 28, 2024); no more than five non-waived laboratories per director.
• Testing personnel with high-complexity qualifications.
• Proficiency testing graded against the CLIA acceptance limits that took effect in January 2025.
• CLIA certificate fees range from $223 to $11,801 every two years depending on test volume, plus compliance fees; accreditation fees are separate.

7. Pharmacy and consumer rules

• Certificate of Waiver for each pharmacy (form CMS-116, renewed every two years). In most states the pharmacist can serve as director of a waived site.
• Test-and-treat laws let pharmacists act on waived results in a growing list of states: Iowa (any condition within the pharmacist's standard of care, 2024), Tennessee (influenza and COVID-19), North Carolina (influenza, effective October 2025), West Virginia (influenza, COVID-19, RSV), Oregon (COVID-19), Rhode Island (any CLIA-waived test, 2026), Arkansas (conditions identified by waived tests, 2021), Hawaii (including glucose and HbA1c, 2023), Michigan and New Mexico. Payment-parity laws such as Illinois SB 3268 require insurers to pay pharmacists for covered services.
• Direct-access testing (a consumer orders a test without a physician) is allowed in many states with limits; Arizona's 2015 law, which Theranos lobbied for, is one of the broadest. In other states a physician-ordering partner (telehealth) is the industry norm.
• Privacy: HIPAA for covered entities, plus consumer health-data laws for direct-to-consumer services, such as Washington's My Health My Data Act.
• Advertising: the FTC's truth-in-advertising rules, and no claim beyond the cleared intended use.

8. The honesty charter

Ten commitments, each written against a specific Theranos failure. They go into the company's bylaws and every investor agreement.

9. Regulatory budget (planning estimates)

The business plan's financial model carries these inside its research, clinical and regulatory lines.