Pharmacist test-and-treat marketing: CLIA waiver, prescribing scope and honest result claims

A pharmacy that tests patients at the counter and, where the law allows, treats them in the same visit is offering two services that rest on two separate permissions. The test rests on a federal laboratory certificate. The treatment rests on the pharmacist’s prescribing authority under state law. Marketing for these services goes wrong when a web page, a window sign or an ad promises more than either permission covers. This guide reads both from the side of the people who write the service pages, run the ads and answer the phones.

Several related topics have their own guides and are not repeated here. Loyalty rewards, copay waivers, refill reminders and pharmacy ads on Google and Meta are covered in independent pharmacy marketing, and staffing, wait time and price claims for walk-in clinics inside stores in retail health clinic marketing. Seasonal vaccine events are covered in flu shot clinic marketing, and tests sold online with a mailed kit or a draw site in direct-to-consumer lab testing marketing. Pharmacist blood thinner services under collaborative practice agreements are covered in anticoagulation clinic marketing.

Two permissions, two kinds of claims

Under 42 CFR 493.2, a laboratory is a facility that examines materials derived from the human body to provide information for the diagnosis, prevention or treatment of disease or the assessment of health. A pharmacy that runs a rapid swab or a fingerstick test on site is performing laboratory testing in that sense, and the CLIA rules in part 493 apply to it. The CMS CLIA page states the purpose plainly: quality standards so that patient test results are accurate, reliable and timely.

Prescribing is a different question. Federal laboratory rules say nothing about whether a pharmacist may write a prescription after a positive result. That depends on your state’s pharmacy practice act and board rules, which decide whether pharmacists may prescribe at all, for which conditions, under what agreement or protocol, and for which patients. Those rules are set state by state, and they change.

Keep the two apart in your marketing. Testing claims should match your CLIA certificate and the tests on it. Treatment claims should match what your state allows your pharmacists to do, and what your own protocol says they will do. A page headed test and treat implies both, so it needs to be true on both counts for every location where the page appears.

The certificate of waiver, read from the marketing side

Under 42 CFR 493.2, a certificate of waiver is issued to a laboratory to perform only the waived tests listed at 493.15(c). Section 493.15(b) describes waived tests as simple examinations and procedures that are cleared by FDA for home use, use methods so simple and accurate that erroneous results are negligible, or pose no reasonable risk of harm if performed incorrectly. Section 493.15(e) requires a waived laboratory to follow the manufacturer’s instructions for performing the test. Each of these rules has a marketing consequence.

• Only advertise tests your certificate covers. Section 493.39(a) requires a waived laboratory to notify HHS before performing and reporting results for any test not listed under 493.15 for which it does not hold the right certificate. A new test page should wait until your pharmacist in charge confirms the test is waived and your certificate covers it.
• Check the categorization of each test. The FDA CLIA Categorizations page says tests waived by regulation or cleared or approved for home use are categorized as waived, and that test systems that have not been categorized default to high complexity until they are. The FDA keeps a searchable database of categorizations, linked from the CMS CLIA page.
• Describe the method the way the manufacturer does. Because 493.15(e) ties the test to the manufacturer’s instructions, a page that promises a sample type, a timing or a use the instructions do not support is describing a test you should not be running that way.
• Give each location its own facts. Section 493.35(a) requires a separate application for each laboratory location, with an exception in 493.35(b)(1) for testing that moves from site to site, such as health fairs or other temporary testing locations, which may be covered under the certificate of the primary site. A location page that lists testing should reflect the certificate that covers that location.
• Update the certificate when the brand changes. Section 493.39(b) requires notice within 30 days of a change in ownership, name, location or director. A rebrand, a move or a sale is a marketing project and a CLIA filing at the same time.
• Track the expiry date. Section 493.37(e) says a certificate of waiver is valid for no more than 2 years, and 493.37(f) asks for the renewal application not less than 9 months nor more than 1 year before expiry. The CMS Apply for a CLIA Certificate page says all certificate types are effective for two years and allow waived testing.

The CMS page adds one point that matters for who you name on the site. A laboratory with a certificate of waiver must have a laboratory director, and CMS says there are no federal education or experience qualifications for that role. If you mention a director on your website, describe their role accurately and do not suggest qualifications they do not hold.

What CLIA-waived does and does not mean

Waived is a test complexity category. The FDA CLIA Waiver by Application page explains that FDA categorizes tests as waived, moderate complexity or high complexity, and that a manufacturer of a test first categorized as moderate complexity may ask FDA to categorize it as waived. A waived categorization lets a laboratory with a certificate of waiver run the test. It is not an endorsement of your pharmacy, your staff or your results.

Watch wording that turns a category into a quality promise. Phrases such as government certified testing, lab-quality results or the same test your doctor uses are claims about accuracy and equivalence, and they need support for the specific test and setting. A plain description is safer and more useful: a CLIA-waived rapid test, performed by our pharmacy team under our CLIA certificate of waiver, following the manufacturer’s instructions.

Do not call a test FDA approved or FDA cleared unless you have confirmed that status for the specific test, and say which one. If you are unsure, describe what the test detects and how it is performed instead.

Prescribing after the test: say what happens next

Patients reading a test-and-treat page want to know one thing: if the test is positive, will they leave with treatment? The honest answer depends on state law, your protocol and the patient. Your page should say so in plain words.

• Name the conditions your pharmacists can assess and treat at each location, and only those your state allows and your protocol covers.
• Say who may not be eligible under your protocol, such as patients below an age set by your state or protocol, or patients with symptoms your protocol sends elsewhere, and what you will do for them instead.
• Explain what happens with a negative result, and when you will refer the patient to their own clinician, an urgent care center or emergency care.
• If a prescription is possible, say that the pharmacist decides after the assessment, not before.
• If your state does not allow pharmacist prescribing for a condition, offer testing only and say that results go to the patient and, with their permission, to their clinician.

Avoid headlines such as skip the doctor, no doctor needed or get treated today unless they are true for every location, condition and patient the ad reaches. Where a page serves more than one location or state, the eligibility rules belong on the page itself, not in a footnote.

Result, wait and price claims

Section 5 of the FTC Act, 15 U.S.C. 45, prohibits deceptive acts or practices, and Section 12, 15 U.S.C. 52, prohibits false advertisements for devices and services, among other things. The FTC Health Products Compliance Guidance lists diagnostic tests among the health-related products it covers, and says advertisers are responsible for implied claims as well as express ones and need competent and reliable scientific evidence for health claims.

For pharmacy testing, the claims to check first are about speed, accuracy and what a result means.

• Results in minutes. If the manufacturer’s instructions give a read time, that is the test time, not the visit time. A visit includes intake, the assessment, the test and any prescribing decision. Say results in about the read time of the test, and give a separate, honest estimate for the visit.
• Walk in, no wait. Only if your staffing supports it at every hour you advertise. Say when testing is offered, and whether a pharmacist who can assess and prescribe is on duty during those hours.
• Accuracy. Do not publish accuracy figures unless you can support them for the specific test as you run it. If you cannot support a number, leave it out, and explain in plain words what a negative result can and cannot tell the patient, as the test’s instructions describe it.
• Prices. Separate the test fee, the assessment fee and the medication cost, and say whether insurance applies to each. One price that quietly excludes the medication or the assessment leaves a false net impression.

If you take self-pay patients, our guide to good faith estimates for self-pay patients covers the federal estimate rules that may apply to your pricing.

Using test records for outreach: HIPAA

If your pharmacy is a HIPAA covered entity, its test records are protected health information. Under 45 CFR 164.501, marketing means a communication about a product or service that encourages recipients to purchase or use it. The same definition sets out what is not marketing: communications about a drug currently being prescribed for the individual, and communications for treatment or to describe a health-related product or service the covered entity itself provides, as long as no third party whose product or service is described pays the pharmacy for making the communication.

Under 45 CFR 164.508(a)(3), a covered entity must obtain the individual’s authorization for any use or disclosure of protected health information for marketing, except for a face-to-face communication or a promotional gift of nominal value. If a third party pays for the marketing, the authorization must say so.

In practice, a message to a patient about their own care, or about a testing service your pharmacy provides, can fall outside the marketing definition. A message paid for by a test or drug manufacturer, or a list of patients who tested positive passed to anyone for their promotions, needs a closer look and may need an authorization. Our guide to HIPAA marketing rules walks through the definition and the exceptions in detail.

Keep test types and results away from advertising platforms. A booking page for a specific test, or a thank-you page after a test appointment, can reveal what someone came in for if tracking tags send that page address to an ad network.

Illustration: a test-and-treat page and a reminder message

Illustration: a pharmacy with two locations in different states plans one web page headed rapid strep testing and treatment, results in minutes, no appointment. Read against the rules above, the page has three problems. The treatment promise holds only if both states allow pharmacist prescribing for that condition and the protocol covers the patient. Results in minutes describes the test read time, not the visit. And the no appointment promise only works if a pharmacist who can assess is on duty at every hour the page implies. The rewrite gives each location its own page with the conditions treated there, the hours a pharmacist is available for assessment, separate test and visit times, and what happens for patients who are not eligible.

Illustration: the same pharmacy wants to send a message to patients who had a positive flu test last season, offering this year’s testing service. Because the message describes a service the pharmacy itself provides and nobody pays the pharmacy to send it, it may fall outside the HIPAA marketing definition in 164.501. If a manufacturer offered to fund the campaign, the payment would change that analysis, and authorization under 164.508(a)(3) would come into play. Either way, the message should not mention the earlier result in a channel where others may see it.

Checklist

• Your CLIA certificate type, number, locations and expiry date are on file, and each tested location is covered.
• Every test named on the site is waived, is on your certificate, and is described the way the manufacturer’s instructions describe it.
• Name, ownership, location and director changes are reported within 30 days under 493.39(b), and the website changes at the same time.
• Each location page names only the conditions your state allows and your protocol covers for pharmacist treatment there.
• Eligibility limits, referral paths and what happens with a negative result are on the page, not hidden.
• Read time and visit time are stated separately, and no accuracy figure appears without support for the specific test.
• Test, assessment and medication prices are shown separately, with insurance status for each.
• No FDA approved or FDA cleared claim appears without confirmation for the specific test.
• Patient outreach using test records has been checked against 164.501 and 164.508, especially anything a third party pays for.
• Tracking tags on test booking and confirmation pages have been reviewed.

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices and health businesses. For a pharmacy offering testing and test-and-treat services, we can build location pages that list only the tests and conditions each location offers, keep eligibility, hours and price breakdowns in one place so ads and pages stay in sync, and set up booking and inquiry intake that keeps test types out of ad platform tracking. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We do not sell lead lists and we do not pay for referrals. For the wider rules, see our healthcare marketing rules hub.

Sources

• 42 CFR part 493: Laboratory Requirements (sections 493.2, 493.15, 493.17, 493.35, 493.37, 493.39)
• CMS: Clinical Laboratory Improvement Amendments (CLIA) (page last modified October 7, 2026)
• CMS: Apply for a CLIA Certificate (page last modified September 9, 2026)
• FDA: CLIA Categorizations (content current as of July 17, 2023)
• FDA: CLIA Waiver by Application (content current as of February 29, 2024)
• FDA: CLIA test categorization database
• 15 U.S.C. 45: Unfair methods of competition and unfair or deceptive acts or practices
• 15 U.S.C. 52: Dissemination of false advertisements
• FTC: Health Products Compliance Guidance
• 45 CFR 164.501: Definitions (marketing)
• 45 CFR 164.508: Uses and disclosures for which an authorization is required

More in Facilities, care services and pharmacy