What does ISO 15189 require?

ISO 15189:2022 sets requirements for the quality and competence of a medical laboratory. The standard has eight chapters: the first three are introductory, and the five after them contain the requirements. The laboratory must show that it meets those requirements, and the RvA checks this during the assessment. For the main outline of the standard, start with what ISO 15189 is.

The chapter structure follows that of ISO/IEC 17025:2017. The requirements themselves differ, because ISO 15189 puts the patient at the centre. You can see this in the comparison with ISO 17025. You buy the full text from the publisher. The ISO page about the standard gives the title and scope.

Rule of thumb: ISO 15189 covers the whole path of the patient, from request to advice. Chapters 4 to 6 cover who and what you need. Chapters 7 and 8 cover how you do the work and how you monitor it.

General requirements (chapter 4)

This chapter covers the basics: the laboratory must exist legally, work impartially and handle patient information confidentially. It also sets out that your tests must be reliable for the patient and the requesting doctor.

A practical example: an independent lab that also works for an equipment supplier must show that this commercial link does not affect the results. You record this in an impartiality assessment with a risk list.

What the assessor wants to see: an overview of the legal entity, a confidentiality policy and an impartiality analysis that you update regularly.

Structure and resources (chapters 5 and 6)

Chapter 5 covers structure: who has overall responsibility, how tasks are divided and how the organisation is set up. Chapter 6 covers resources: staff, facilities, equipment, reagents and the information you need.

For staff, the standard expects you to record for each role which training, experience and authorisation are needed. An analyst who introduces a new method must first demonstrate that method. See the page on training and competence for a worked example.

For equipment, you keep a register: which device, which calibration, which maintenance, and what you do when a calibration is overdue.

What the assessor wants to see: an organisation chart with authorities, a staff register with training records and a calibration overview per device.

Processes (chapter 7)

Chapter 7 is the largest chapter. It describes the whole process in three phases: pre-analysis, analysis and post-analysis. Pre-analysis covers everything before the measurement: the request, the collection, the transport and the receipt. Post-analysis covers everything after: the review, the result, the advice and the storage of samples.

Most errors occur in the pre- and post-analysis phases, not in the device. A sample from the wrong patient or a critical result that reaches the doctor too late are classic examples. That is why the standard pays a lot of attention to identification and communication.

Critical results and metrological traceability also belong here. The assessor often follows one sample through the whole process.

What the assessor wants to see: a process description for each phase, an identification procedure and records for a few random samples.

Management system (chapter 8)

Chapter 8 makes sure the laboratory monitors itself. It covers document control, recording complaints and deviations, internal audits, management reviews and improvement.

A management review is the moment when the management looks back at the system. Which non-conformities were there? Which improvements were made? What needs to change? Read more about the management review and the internal audit.

For non-conformities, you use a cause analysis. The root cause analysis and the CAPA approach fit well here.

What the assessor wants to see: an up-to-date document register, a log of non-conformities with cause and measure, and the report of the most recent management review.

Common mistakes with the requirements

Putting everything in one manual. An assessor looks for the requirement. Make a cross-reference table from chapter to document, so they know quickly where it is.

Copying requirements without understanding them. A procedure you copy from another lab often does not fit your equipment and your patients. Describe what you actually do.

Not linking risks to processes. A risk register that stands apart from the processes is seen as a formality during the assessment. Connect each risk to a process step and a measure.

How do you read a requirement in practice?

A requirement in the standard is briefly worded. That is deliberate: the laboratory must decide for itself how to meet it. To make a requirement workable, translate it into three questions. What must happen? Who does it? How do you show that it happens?

Take the requirement on sample identification. What must happen: every sample can be traced to one patient. Who does it: the person who takes the sample and the person who receives it in the lab. How do you show it: a record with the identification details and the timestamp, plus a sample of the checks.

With those three questions, you turn an abstract requirement into a list of actions and evidence. You use that list later in the manual and when you prepare for the assessment.

Which requirements always apply and which depend on your situation?

Not every part of the standard applies in the same way to every laboratory. A lab without POCT does not need POCT procedures, and a lab without in-house tests has less documentation. This shows up in the scope of your accreditation.

Some requirements always apply, though: impartiality, staff, document control, non-conformities and internal audits. These form the foundation. Build that first, and then add the parts that relate to your activities.

If you are unsure whether a requirement applies, record it in your scope analysis and document the decision. A justified exclusion can be defended. A silent omission cannot.

How these requirements relate to the rest of the section

The requirements are in the standard; how you put them into practice is covered on the other pages. Start with the difference from ISO 17025 if you are still choosing which standard fits. Read the transition to 2022 if you want to know what changed compared with the 2012 version.