Multi‑site reference laboratories operate as a tightly coupled network, where continuity failure is rarely confined to one bench or one site. The most likely “systemic” failure modes cascade across specimen logistics → accessioning/triage → specialty testing → reporting and client communication, amplified by cross‑border air referral, strict turnaround SLAs, and the need to preserve chain‑of‑custody (toxicology and clinical‑trial flows).
The most “inspection‑persuasive” continuity architecture for reference labs is built around four enforceable design decisions:
- defining Minimum Viable Laboratory (MVL) tiers with pre‑approved triggers;
- a lab‑specific Business Impact Analysis (BIA) that treats logistics, LIS/middleware, referral pathways, and interpretive reporting as critical processes;
- a Test Prioritization Matrix that incorporates clinical criticality, stability window, SLA/penalty exposure, and referral options; and
- an exercised, documented incident command and CAPA loop consistent with ISO 15189’s requirements for continuity planning, downtime plans, quality indicators, internal audits, and corrective action effectiveness.
Cyber disruption is not theoretical: in a major pathology cyber incident, NHS reported that services were fully restored only after months, underscoring that reference‑lab continuity must assume extended outages and manual operations, not just brief IT incidents.
The recommended implementation approach is a phased program over 12 months: complete BIA and MVL design, establish the eight continuity pillars (with SOP packs and fast‑track change control), execute a structured drill calendar (tabletop + functional), stand up dashboards tied to ISO 15189 quality indicators, and formalize mutual aid / send‑out agreements with defined validation and comparability requirements.
Standards and assurance baseline
Continuity as a management system is anchored in International Organization for Standardization ISO 22301, which defines a BCMS framework to plan, implement, operate, monitor, review, maintain, and continually improve documented continuity capability to protect against and recover from disruptive incidents.
Laboratory‑specific continuity obligations are made explicit in ISO 15189:2022, and College of American Pathologist including:
- downtime plans for information systems that affect lab activities,
- continuity and emergency preparedness planning that identifies risks when activities are limited or unavailable, requires coordinated strategies using plans/procedures/technical measures, and requires periodic testing and exercising of response capability
- strong controls for specimen transport, acceptance exceptions, referral laboratories, comparability of results, record traceability, corrective action, and monitoring via quality indicators.
- specimen transport and tracking, chain‑of‑custody
- For operational reality, CAP publications also stress that procedures must remain accessible even during LIS/network downtime.
Operational preparedness in laboratories is addressed by Clinical and Laboratory Standards Institute guidance (eg, CLSI GP36 is the CLSI guideline “Planning for Laboratory Operations During a Disaster.”), which describes all‑hazards planning and sustaining operations through the entire laboratory “path of workflow” (pre‑examination, examination, post‑examination).
Business impact analysis and test prioritization
Definitions that must be used consistently
Reference laboratories frequently mix business continuity terms across IT, operations, and quality. To avoid misalignment, define the following in your BCMS/QMS glossary and enforce them in BIA documentation:
- MTPD / MAO: the time until adverse impacts from not providing a service become unacceptable (terminology varies by region; treat MAO/MTPD consistently).
- RTO: the time within which systems/functions must be recovered after an outage (including assessment, execution, and verification time).
- RPO: the point in time to which data must be restored after an outage to enable operation on resumption.
These terms matter because ISO 15189 requires laboratories to plan downtime operations and also requires traceable amendment of records both are constrained by RTO/RPO decisions.
Tailored BIA approach for multi‑site referral laboratories
A reference lab BIA must treat the laboratory as a network rather than a single facility. ISO 15189 requires that risks across pre‑examination, examination, and post‑examination processes be identified and mitigated, and that the adequacy of sample transportation systems be periodically evaluated both imply a BIA scope that includes collection sites, couriers, hubs, and referral labs.
A practical BIA workflow for your environment is:
- Map critical “end‑to‑end service lines” (eg, microbiology culture + susceptibility + critical calls; histopath tissue workflow + reporting; HLA transplantation support; genomics/trials sample flows; toxicology with chain‑of‑custody).
- Decompose into processes that fail independently: specimen receipt/triage, accessioning, storage and stability preservation, test set‑up, analytic run, result review and release, interpretation and consultation, critical result notification, report amendment, referral shipment, client notification of delays, billing/claims where tied to trial SLAs.
- Identify dependencies per process (people/competence, facilities/utilities, LIS/middleware/interfaces, reagents/consumables, instruments, transport/air lanes, external providers). ISO 15189 explicitly covers externally provided products/services and referral laboratories and requires defined qualification/re‑evaluation criteria.
- Set MAO/MTPD, RTO, RPO by process, not by department. Ensure “short stability window” services (eg, many microbiology critical findings, unstable analytes, urgent transfusion‑support requirements) are modeled with logistics + LIS dependencies, not only bench time.
- Define the “MVL capability” that satisfies medical safety and contractual duties at reduced capacity, explicitly including manual operations and referral rerouting. ISO 15189 requires a coordinated continuity strategy with periodic testing/exercising.
Test prioritization matrix for multi‑discipline reference labs
Service agreements with users (including advising which activities are performed by referral labs), requires risk‑based patient care protections across workflows, and requires procedures for sample acceptance exceptions and result delay notifications. These requirements support an explicit, defensible prioritization matrix rather than ad‑hoc “who shouts loudest” prioritization.
Use a two‑layer design:
Layer A: Categories (policy)
– Critical to immediate clinical decision making (life/organ/limb).
– Time‑sensitive clinical (same day/next day).
– Routine clinical.
– Elective / research / “nice‑to‑have”.
Layer B: Scoring (operational) A suggested scoring model (adapt weights to your risk appetite):
- Clinical criticality: 0–5
- Stability window risk: 0–5 (higher score = more fragile)
- SLA / penalty severity: 0–5
- Referral options strength: 0–5 (higher score = fewer/weak options)
- Public health / outbreak / transfusion dependency: 0–5
- Chain-of-custody / trial compliance complexity: 0–5
Priority score = (2×Clinical) + (2×Stability) + SLA + (2×Referral weakness) + Public health + Compliance complexity.
This formula is a weighted prioritization matrix designed to rank health conditions, projects, or patients based on a combination of clinical severity, operational stability, and external risk factors. It heavily weights clinical severity and referral weaknesses, suggesting a focus on urgent, high-risk, and operationally vulnerable issues.
The table below is an exportable template with example test “clusters” relevant to your environment.
| Test cluster (example grouping) | Clinical criticality (0–5) | Stability window (Short/Med/Long) | SLA / penalty exposure | Referral options (in-network / domestic / international) | Compliance factors (trial/custody) | Default MVL tier | Notes / required comms |
| Transplant crossmatch / urgent HLA support | 5 | Short–Med | High (clinical) | Medium (specialty partners) | High | Tier 1 | Pre-agreed escalation; critical result process |
| Critical microbiology (blood cultures/CSF critical comms) | 5 | Short | High (patient safety) | Medium | Med | Tier 1 | Manual critical call logs if LIS down |
| Molecular urgent infectious disease pathway | 4–5 | Short | Medium–High | Medium | Med | Tier 1 | Alternate method/site decision documented |
| Clinical trials central lab panels | 3–4 | Variable | High (contractual) | High (often international) | High | Tier 1–2 | Document deviations; preserve chain and data integrity |
| Histopath oncology priority cases | 4 | Med | Medium | Medium | Med | Tier 2 | Remote diagnostic workflows must preserve traceability |
| Toxicology with forensic-style custody | 3–4 | Med | Medium | Medium | Very high | Tier 2 | Chain-of-custody controls and restricted access |
| Neurochemistry routine panels | 2–3 | Med | Medium | Strong | Low | Tier 2–3 | Batch and backlog management focus |
| Non-urgent genomics (non-immediate) | 2–3 | Long (often frozen DNA) | Medium–High | Strong (international) | High | Tier 3 | Manage expectations; document delays by impact |
Minimum Viable Laboratory tiers and triggers
The laboratory requires to identify risks associated with emergency situations or conditions when activities are limited/unavailable and to maintain a coordinated continuity strategy, with periodic testing and exercising of capability.
A practical MVL model for multi‑site reference labs uses four tiers. Each tier defines what continues, what pauses, and what “must never be compromised” (identity, traceability, QC release rules, critical communications, confidentiality).
MVL tiers
Tier 0 — Life safety and specimen preservation (network stabilization)
Purpose: prevent patient harm caused by misidentification, stability loss, uncontrolled backlog, or unsafe operations; preserve irreplaceable specimens (tissues, transplant samples, trial samples).
Minimum functions: controlled receipt, traceability logs, cold chain integrity, safe storage, urgent escalation phone tree, courier exception routing, “hold and protect” approach.
Tier 1 — Critical clinical and transfusion‑linked services
Purpose: maintain the highest criticality services (transplant support, critical microbiology calls, urgent molecular, blood bank support interfaces as applicable).
Minimum functions: MVL test menu “critical only,” manual‑capable reporting and critical notifications, pre‑approved referral reroutes.
Tier 2 — High‑volume clinical operations at reduced capacity
Purpose: restore routine throughput with controlled backlogs; expand referral capacity; stabilize staffing and supply chain.
Minimum functions: extended hours if needed, backlog clearance plan, routine client updates, expanded send‑out lanes, formal exception reporting.
Tier 3 — Full service and recovery optimization
Purpose: full assay menu including elective/non‑urgent genomics and broader trial programs; transition from manual workarounds to normal operations; close CAPAs and update risk registers.
Clear activation triggers
Your triggers should be objective, pre‑approved, and aligned to BIA outputs. A defensible trigger set includes:
- Information systems trigger: declare LIS/middleware downtime event when systems prevent traceable accessioning or results reporting; ISO 15189 requires planned downtime processes for such failures.
- Transport trigger: activate controlled receipt / reroute when transport delays threaten “time between collection and receipt” or required temperature intervals; ISO 15189 requires transport instructions addressing time and temperature and periodic evaluation of transport adequacy.
- Patient safety trigger: halt examinations and withhold reports when there is risk of harm to patients (eg, uncontrolled QC, instrument out of limits, stability compromise without acceptable exception handling).
- External provider trigger: activate mutual aid or alternate referral lab when primary provider cannot meet agreed requirements; ISO 15189 requires qualification, performance evaluation, and ensuring externally provided services meet requirements before use.
- Escalation trigger: notify users when results are delayed based on patient impact; this is an explicit ISO 15189 requirement and should be part of MVL tier transitions.
Eight continuity pillars with SOP elements, checklists, and fast‑track change control
The continuity planning requires coordinated strategies combining plans, procedures, and technical measures, plus personnel information/training and periodic exercising. The eight pillars below operationalize that requirement for reference labs.
Specimen logistics and stability preservation
This requires instructions for packaging, appropriate time between collection and receipt, maintaining temperature intervals, and periodic evaluation of transport adequacy; it also requires explicit handling of compromised clinically critical/irreplaceable samples with documented risk consideration and report annotation when accepted.
SOP elements (must exist before an incident): controlled receipt mode; stability‑based triage; cold chain excursion rules; “urgent specimen” labeling/routing; documentation for acceptance exceptions.
Activation checklist (first 60–120 minutes): confirm transport disruption scope; activate alternate courier routes; open controlled receipt; implement stability triage (test now / stabilize & store / redirect / reject); issue client notice for delays.
Alternate testing and multi‑site load balancing
This requires comparability procedures when different methods/equipment are used or testing occurs at different sites, with recording of acceptability, periodic review, and user notification of clinically significant differences.
SOP elements: pre‑validated alternate methods; cross‑site routing maps; bridging/comparability protocol; interpretive consistency rules.
Minimum documentation: route decision record; comparability evidence; updated reference intervals/decision limits if affected; user notification when clinically significant differences exist.
LIS downtime and information continuity
This requires planned downtime processes for information systems failures that affect lab activities. WHO LQMS guidance details essential manual system controls: unique identifiers, standardized requisitions, logs and worksheets, checking processes, confidentiality protection, and data loss protection (backup for electronic, secure storage for paper). Accreditation requirements emphasize that procedures must remain available during LIS/network downtime, so downtime packs must include controlled copies of critical SOPs.
SOP elements: downtime declaration; manual accessioning and labeling controls; downtime worksheets; critical results call logs; result entry controls; reconciliation and amendment practice aligned to ISO 15189 record traceability.
Supply chain resilience
WHO inventory guidance frames uninterrupted availability of reagents and supplies as essential to laboratory operations and recommends establishing minimum stock for an appropriate time period, supported by documented forms/logs, receipt inspections, and expiry controls.
ISO 15189 includes specific expectations for reagent/consumable records (receipt condition, expiry, first use, out‑of‑service dates, acceptance records) and requires procedures to respond to manufacturer recall notices and investigate/report adverse incidents attributed to reagents/consumables.
SOP elements: critical item register; A/B/C criticality classification; dual sourcing; acceptance testing and lot release; recall response workflow; contingency pack‑outs for air referral.
People, competence, and fatigue management
Continuity fails when cross‑trained capability is absent. Accreditation requires competence requirements and authorization of personnel for specific lab activities; continuity plans must also take into account personnel needs and capabilities and require training.
SOP elements: minimum staffing model per MVL tier; cross‑training plan by discipline; on‑call rosters; fatigue controls during surge/outage; delegation-of-authority list.
Quality and patient safety controls under disruption
ISO 15189 requires risk‑based management of nonconforming work, including halting examinations and withholding reports when there is risk of harm to patients, and evaluating clinical significance/impact analysis.
SOP elements: “kill switches” (stop‑testing triggers); QC release rules unchanged; exception acceptance policy for irreplaceable samples; mandatory report comments for compromised samples.
Client communication and command structure
There must be a procedure to notify users when results are delayed, based on patient impact; WHO LQMS emphasizes effective and timely communication, including records for telephone urgent results.
SOP elements: incident command roster; single source of truth updates; standard client notices; escalation for blood bank/hospital critical clients; clinical trial deviation notifications; media/privacy controls when needed.
Compliance and ethics
ISO 15189’s general requirements include impartiality safeguards (not allowing commercial/financial pressures to compromise impartiality) and confidentiality controls for patient information; it also requires disclosure, where appropriate, of incidents that resulted or could have resulted in patient harm and records of mitigations. These requirements become stress‑tested during disruptions and must be wired into incident governance.
Change control form
ISO 15189 requires maintaining management system integrity when changes are planned/implemented and requires recorded decisions/actions on risks. This should include at minimum the following;
| Field | Content to capture (minimum) |
| Emergency change ID | Unique identifier; date/time opened |
| Trigger / incident reference | What happened; MVL tier; affected sites |
| Change description | What will change (method, site, referral lab, reporting pathway, manual process) |
| Patient safety and clinical impact | Explicit statement; “halt/withhold” criteria if triggered |
| Risk assessment summary | Hazards, likelihood, consequence, controls; residual risk; user communication need |
| Validation / bridging required | Comparability plan (split samples), acceptance criteria, documentation |
| Data integrity controls | How traceability is preserved; RPO/RTO assumptions; record amendment plan |
| Approvals | Incident Commander, Quality/Risk Lead, Discipline Lead, Client Impact Lead |
| Communication plan | Who is informed (hospitals/blood bank/trials); timing; templates |
| Effectiveness review | Metrics to check; time window; CAPA if not effective |
Drills, metrics, and CAPA
Business continuity plans to be periodically tested, and response capability exercised where practicable. It also requires corrective action discipline: immediate control, cause analysis, corrective action, effectiveness review, and updating risks/opportunities.
Prioritized drill scenarios with objectives and success criteria
The scenarios below are prioritized for multi‑site referral networks supporting hospitals, blood banks, and trial programs, including international air referral.
| Scenario | Type | Core objective | Success criteria (examples) | Primary evidence |
| LIS/middleware outage (multi‑site) | Functional | Run MVL Tier 0–1 with manual operations | ≥99.5% specimen traceability; zero critical mis-ID; reconciliation completed within defined window | Downtime logs; reconciliation report; amendment traceability |
| Ransomware / cyber isolation | Tabletop + functional (limited) | Prove extended-duration continuity assumptions | MVL tier decisions within 60 min; controlled comms; procedure access maintained | Command log; comms templates; procedure availability evidence |
| International air-lane disruption | Tabletop | Activate alternate referral lanes and pack-outs | Reroute decisions documented; stability preserved; client notices issued | Shipment manifests; temperature logs; client notices |
| Courier network failure + surge backlog | Functional | Maintain controlled receipt and stability triage | ≥95% samples triaged within X minutes; documented accept/reject exceptions | Triage log; rejection log; exception reports |
| HVAC/cold room failure | Functional | Preserve specimen and reagent integrity | Temperature excursion decision tree executed; quarantines documented | Temp records; disposition log; CAPA if needed |
| Critical reagent stockout | Tabletop | Demonstrate A/B/C stock method + substitution | Alternate sourcing triggered; recall/incident response followed | Stock cards; recall response records |
| Single-point instrument failure (specialty) | Functional | Shift work across sites/referral labs | Comparability/bridging initiated; users advised if differences clinically significant | Comparability records; user notices |
| Staff shortage (lab + courier) | Tabletop | Execute staffing MVL model | Coverage meets Tier 1; fatigue controls documented | Rosters; training/authorization evidence |
| Chain-of-custody breach (tox/trial) | Tabletop | Preserve defensibility and patient safety | Immediate containment; custody integrity decision documented | Custody incident report; secure storage proof |
| Result correction surge post-incident | Tabletop | Manage amendments safely | Traceable amendments: users notified; impact assessed | Amendment log; revised report audit trail |
When nonconformities occur, the laboratory must control/correct, address consequences with focus on patient safety escalation, determine causes, assess recurrence risk, implement actions, evaluate effectiveness, update risks/opportunities, and change the management system if needed.
External dependencies, mutual aid
Mutual aid / send‑out agreement
Service agreements with users and requires that, where applicable, the user is advised of specific activities performed by referral laboratories and consultants; it also assigns responsibilities for ensuring results are delivered to the requester unless otherwise specified. It further requires qualification, selection, evaluation, and re‑evaluation of external providers and ensuring externally provided services conform to requirements before use.
A mutual aid / send‑out agreement for reference labs should include:
- Scope: test menu covered, specimen types, volumes, exclusion criteria
- Quality prerequisites: accreditation status, competence evidence, EQA/PT expectations, change notification rules
- Pre‑examination requirements: packaging, time/temperature, accept/reject rules, urgent labels
- Critical results: escalation and turnaround for notifications
- Reporting: units, reference intervals, interpretive comments; requirement to identify examinations performed by the referral laboratory in the report, and manage amendments traceably
- Data exchange: secure transmission, retention, audit trails, confidentiality obligations
- Continuity commitments: what happens if the partner fails (secondary partner, rerouting)
- Liability and dispute resolution; turnaround penalties and force majeure logic
- Chain-of-custody requirements where applicable (tox/trials)
Validation and bridging requirements when shifting sites or referral labs
When continuity triggers re-routing, the “method equivalence” question becomes both clinical and compliance critical. ISO 15189 requires comparability procedures when different methods/equipment are used or examinations are performed at different sites, including documenting acceptability and informing users of clinically significant differences. The documentations for a rerouted/referred test should include:
- Method equivalence assessment: principle, specimen type, analytical range, interferences
- Split-sample comparability study: clinically significant intervals; acceptance criteria; documentation and periodic review
- Reference interval / decision limit impact assessment: update and user notification if affected
- Report transparency: identification of referral lab performing the exam; clear disclaimers where residual risk exists
- Exception governance: fast‑track change control record, including risk decisions and communications
Business continuity in a multi-site reference laboratory is not a separate “BCP folder” on a shared drive, it is a living system that protects patients, clinical decisions, transplant pathways, blood bank support, and clinical trial integrity when conditions are not normal.
The real measure of readiness is simple: Can we preserve identity, stability, traceability, and trusted reporting even when technology, logistics, or capacity fails? If the answer is yes, the laboratory has resilience. If not, continuity must be treated as a priority risk and quality agenda not an administrative requirement.
Continuity is built in advance, proven through drills, refined through CAPA, and sustained through culture. Every disruption is also a learning event an opportunity to strengthen the network, simplify workflows, and make the system safer than it was yesterday.
