Writing an Exposure Control Plan: Meeting OSHA’s Bloodborne Pathogen Standard

Healthcare facilities, and other qualifying facilities in other industries, must abide by OSHA’s Bloodborne Pathogen Standard. This Standard seeks to protect workers from occupational hazards that result from being exposed to potentially infectious pathogens. The Standard was set forth in 1991 andincludes 7 key components, one of which specifically outlines the requirement to create and maintain an Exposure Control Plan (ECP).

The Standard’s requirements do not have clear specifications or directions. The plan is known as a “performance standard”, meaning there is a goal set forth but there is flexibility in how individual facilities achieve that goal.

The Standard applies to more than just the hospital, dental, or medical fields. OSHA says “Workers in many occupations, including first responders, housekeeping personnel in some industries, nurses and other healthcare personnel, all may be at risk for exposure to bloodborne pathogens.”

Those liable under the Standard can even include employees of tattoo parlors and sports coaches. “The Standard places requirements on employers whose workers can be reasonably anticipated to contact blood or other potentially infectious materials (OPIM), such as unfixed human tissues and certain body fluids.”

The consequences for violating OSHA’s Bloodborne Standard can be severe depending on the situation. For example, in 2016 OSHA fined USPS $342,000 for willfully violating the Exposure Control Plan requirements, as well as many other violations.

According to OSHA’s Field Operations Manual, violating any part(s) of the Bloodborne Pathogen Standard results in Gravity-Based Penalties (GBP). GBPs are determined by the severity of the violation, with high gravity violations resulting in fines up to $12,471, moderate gravity violations up to $10,689, and low gravity violations up to $5,345.

When determining the amount of the fine, OSHA also considers the size of the employer’s business, the good faith of the employer, and the employer’s history of violations. OSHA fines heavily for willful violations and repeat offenders.

What should my Exposure Control Plan include?

To avoid these fines, you should have a robust Exposure Control Plan. There are four basic rules your Exposure Control Plan needs to include.

They are:

The plan must be specific to your facility
The plan must be updated yearly – or when things change
Updates in technology must be considered
The plan must be accessible to your workers

The plan must be specific to your facility

The plan needs to specifically outline the details of your facility, workers, as well as the technology and equipment used in it. You must also delineate any potential threats, plans to address those threats, and what to do when things go wrong. You will want to be detailed when explaining specific job roles, the risks inherent in those roles, and how you are minimizing those risks.

Remember, the Standard is a Performance Standard. Your focus should be to show that you are acting in good faith by doing all you can to reduce any and all risks to your staff. The more thought-out and detailed your outline is, coupled with how you intend to reduce all identified threats, the closer you are to meeting the objectives of the Standard.

The plan must be updated yearly – or when things change

The plan must be updated yearly, with those updates communicated to staff. If anything in the plan changes, such as new staff, job roles, procedures or technology used, the plan needs to be updated to reflect those changes, even if a full year has not passed.

Updates in technology must be considered

As a part of your annual updates, OSHA requires that you review any technology that has come out since your last annual update. That way, you can assess if a new device or procedure can further limit any risks posed to staff. You need to document what you have reviewed and why you made the decision to either adopt or not adopt new equipment on the market.

OSHA will levy a fine against a facility that ignores new commercially-available devices that are designed to provide extra safety to workers, so do not miss this step or miss documenting it.

Additionally, OSHA requires that feedback from your workers is solicited on any new technology considered, so you will want to ensure you document that as well.

The plan must be accessible to your workers

Regular staff education on the plan’s contents and where the plan is kept is a requirement. The plan is meant to be fully accessible to workers at all times. This helps ensure it is readily available when an accident or incident has occurred.
It pays to be diligent in writing and maintaining your Exposure Control Plan. OSHA’s mission to protect workers may be a costly and time-consuming endeavor for your business, but in the end it will help you avoid fines, unnecessary workplace compensation issues, loss of staff due to temporary injury, and even staff turnover. It truly benefits everyone to be OSHA compliant.

HIPAA Compliance: Regulations on Your Practice

There are many agencies that medical facilities have to answer to. From medical waste handling and disposal regulations to required annual OSHA training, it can be overwhelming to stay on top of all the federal, state, and local laws. HIPAA is yet another body of rules to stay compliant with, and is arguably the most violated regulation in healthcare.

This article will look at the following:

What is HIPAA Title II?
What is Protected Health Information?
HIPAA Requirements: Training, Technology, and Business Associate Agreements
HIPAA and Medical Waste
HIPAA Enforcement

What is HIPAA Title II?

The Health Insurance Portability and Accountability Act, or HIPAA, was signed into law in 1996. In the healthcare industry, it is generally the HIPAA Title II section that outlines the standards medical practices need to follow.

There are 5 specific standards in Title II:

Unique Health Identifiers – This is the unique 10-digit National Provider Identifier, or NPI, that all healthcare providers, health plans, and individuals are required to have.
Transfer of Information Among Health Plans – This requires all healthcare organizations to follow a standardized electronic data interchange when submitting and processing insurance claims.
Security Standards for Health Information – Perhaps the most violated standard, this details what Protected Health Information is and to what extent health agencies are to guard and proactively protect against any “reasonably anticipated threats or hazards to the security or integrity” of that information.
Code Sets – This standard outlines the set of codes that are to be used for encoding data elements. This includes tables of terms, medical concepts, medical diagnosis codes, and medical procedure codes. These Code Sets took effect in 2002 to help simplify the processes and decrease healthcare costs.
Electronic Signature – This specifies standards specifying procedures for the electronic transmission and authentication of signatures.

What is Protected Health Information?

According to the Department of Health & Human Services, Protected Health Information, or PHI, is “information, including demographic data, that relates to:

the individual’s past, present or future physical or mental health or condition,
the provision of health care to the individual, or
the past, present, or future payment for the provision of health care to the individual

Patient Health Records folder with Confidential and HIPAA stamps

The department further defines PHI as “information that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number).”

HIPAA Requirements

Training

HIPAA requires that all employees at a healthcare institution, from medical clinics and hospitals to insurance companies and healthcare clearinghouses, have HIPAA training. This applies to all employees at the facility, so it not only includes doctors and dentists, but receptionists, part-time workers, and temporary employees as well. Anyone at the business dealing with Protected Health Information is required to have the mandatory training.

HIPAA also requires “periodic” refresher trainings. Although the time intervals are ambiguous, the rule of thumb in the industry is to have these refreshers annually.

Technology

Health care facilities and their business associates are required to conduct a risk analysis on their respective systems. The Health and Human Services Department and the Office for Civil Rights, the latter of which enforces HIPAA regulations, jointly created a tool to make that task manageable: called the HIPAA Security Risk Assessment (SRA) Tool.

Although using the HIPAA assessment tool is not required, a thorough and accurate assessment of the safety and potential vulnerabilities of managing Protected Health Information is definitely required.

As noted by an NIST Special Publication, the types of questions to ask in an assessment are:

“Have you identified the electronic PHI (or e-PHI), within your organization? This includes e-PHI that you create, receive, maintain or transmit.
What are the external sources of e-PHI? For example, do vendors or consultants create, receive, maintain or transmit e-PHI?
What are the human, natural, and environmental threats to information systems that contain e-PHI?”

If there is ever a breach to the integrity of an organization’s digital PHI information, be it an outright cyber attack on files or the misplacing of an information storage device, you are required to self-report the breach. This is dictated by the HIPAA Breach Notification Rule, which requires you to self-report the breach to the Health and Human Services Department. There are severe fines involved for violating the breach rule.

Business Associate Agreements

HIPAA requires that any vendors and third party affiliates that interact, or could interact, with Protected Health Information sign a Business Associate Agreement (BAA). Through these contractual agreements, the vendors and third party affiliates make it clear how it is that they follow all HIPAA regulations. These associates are also then expected to have the required HIPAA training.

There are many examples of healthcare facilities being fined for violating this requirement. To name a few:

In 2013, a Raleigh, NC orthopedic clinic was required to pay $750 million for engaging in the services of a third-party provider in absence of a BAA.

In 2018, a Florida contractor physicians group was fined $500,000 for sharing PHI with a vendor in absence of a BAA.

HIPAA And Medical Waste

HIPAA does not clearly outline rules regarding labels on regulated waste. If healthcare employees are trained *** Add link to blog https://blog.onsitewaste.com/medical-waste-or-trash *** on the proper disposal of medical waste including PHI labeling, and a regulated disposal system is in place that sees that waste being disposed of, then there are no extra steps to stay HIPAA compliant.

HIPAA Enforcement

The Office of Civil Rights (OCR) is tasked with enforcing HIPAA legislation in the following ways:

It investigates complaints that are filed with the office.
It conducts compliance reviews.
It performs education and outreach to encourage HIPAA compliance.
It works in conjunction with the Department of Justice when possible HIPAA violations are discovered.

There can be stiff fines for breaking HIPAA regulations. Even if a healthcare facility has been the victim of a data breach, they can be found liable.

A facility can be forced to pay civil money penalties from $100 to $50,000 or more per violation, with a one-calendar year cap of $1,500,000.

A healthcare employee who knowingly discloses PHI can face a criminal penalty of up to $50,000 and up to one-year imprisonment. The penalties increase up to $250,000 and 10 years imprisonment if the crime is found to involve false pretenses and/or the intent to sell the information for monetary gain or to cause malicious harm.

Some real-world violations to note are:

In 2014, the Office of Civil Rights announced an $800,000 HIPAA settlement with Parkview Health Systems after paper medical records for 5,000 to 8,000 patients were dumped in the driveway of a physician’s home.

In 2017, Memorial Hermann Health violated HIPAA regulations by releasing the name of a patient in a press release. The settlement was for $2.4 million.

As it can be seen, staying HIPAA compliant is extremely important, as the consequences for not doing so could be dire, including six figure lawsuits. However, by adhering to the five standards spelled out in Title II, properly managing Protected Health Information, and training your staff, your business can stay HIPAA compliant and avoid the painful pitfalls.

Navigating Recent Regulations in Medical Waste Management: A Guide for Healthcare Providers

Managing Sharps in Healthcare Environments: Strategies for Contamination Mitigation and Waste Management

Choosing the Right Medical Waste Management Partner: Ensuring Safety and Compliance for Healthcare Providers

7 Easy Steps to Comply with OSHA’s Standard for Medical Waste Management

7 Easy Steps to Comply with OSHA’s Standards for Medical-Waste Management

Step 1: Identify the types of medical waste

Step 2: Develop a waste management plan

Step 3: Provide proper containers for waste disposal

Step 4: Train employees on proper waste management

Step 5: Implement infection control measures

Step 6: Dispose of waste according to OSHA standards

Step 7: Monitor and review waste management procedures

Conclusion:

California Medical Waste Disposal Regulations

Writing an Exposure Control Plan: Meeting OSHA’s Bloodborne Pathogen Standard