Healthcare Compliance Support

Depending on the activity, OSHA, DOT/PHMSA, EPA, DEA, HHS/OCR, state agencies and local authorities may have relevant requirements.

It is the written plan OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030) requires of any employer whose employees have reasonably anticipated contact with blood or other potentially infectious materials on the job. It identifies which jobs and tasks involve exposure and explains how the employer protects workers and handles an exposure incident. The plan must be available to employees and reviewed and updated at least once a year, and whenever tasks or positions change.

Regulated medical waste is a hazardous material when it is shipped (Division 6.2, UN3291; 49 CFR 173.134). Anyone who prepares it for transport, such as packaging, marking, labeling or signing shipping papers, is a hazmat employee. Training must cover general awareness, function-specific duties, safety and security awareness, plus in-depth security training where a security plan is required. It must be completed within 90 days of hire or a job change, repeated at least every three years, and documented in records kept while the employee does hazmat work and for 90 days after (49 CFR 172.704).

No. Pharmaceutical waste may be controlled or non-controlled, hazardous or non-hazardous, and usually follows a different disposal path from regulated medical waste. Pharmaceuticals that are hazardous waste are managed under EPA's rule for healthcare facilities (40 CFR Part 266, Subpart P), and since August 21, 2019 every healthcare facility in every state is banned from pouring or flushing them down a drain (40 CFR 266.505).

OSHA requires sharps containers that can be closed, resist punctures, do not leak on the sides or bottom, and are labeled or color-coded. They must be easy to reach, placed as close as practical to where sharps are used, kept upright, replaced routinely and never allowed to overfill. Close them before moving them so nothing can spill (29 CFR 1910.1030(d)(4)(iii)). State rules and your waste provider's instructions cover storage and pickup preparation.

Yes, when discarded materials contain protected health information (PHI). Covered entities must have safeguards that protect PHI through disposal, including policies for the final disposal of electronic PHI (45 CFR 164.530(c) and 164.310(d)). HHS guidance gives shredding, burning, pulping or pulverizing paper as examples, so the PHI cannot be read or reconstructed, and clearing, purging or destroying electronic media. PHI may not go into a publicly accessible dumpster until it has been destroyed this way. A disposal vendor that handles PHI for you is a business associate and needs a business associate agreement.

Relevant records may include policies, plans, training records, manifests, shipping documents, certificates, incident records, vendor records and inspection documentation.

It depends on the record. Some federal examples: OSHA bloodborne-pathogens training records, 3 years (29 CFR 1910.1030(h)(2)); employee exposure medical records, length of employment plus 30 years (29 CFR 1910.1030(h)(1)); DOT hazmat training records, while the employee does hazmat work plus 90 days (49 CFR 172.704(d)); HIPAA policies, procedures and required documentation, 6 years from creation or last effective date (45 CFR 164.316(b)(2)); DEA controlled-substance records, at least 2 years (21 CFR 1304.04); dental amalgam separator records, 3 years (40 CFR 441.50). Patient medical-record retention is set by state law, not HIPAA. State rules, contracts and facility policy can require longer periods.

Controlled substances fall under DEA rules. A DEA registrant can dispose of controlled-substance inventory by sending it to a reverse distributor, returning it to the supplier or manufacturer, destroying it on site, or (for practitioners) asking the local DEA Special Agent in Charge for help (21 CFR 1317.05). Any destruction must make the drug non-retrievable (21 CFR 1317.90), and on-site destruction is recorded on DEA Form 41 with two employee witnesses (21 CFR 1304.21(e)). Non-controlled pharmaceuticals are not regulated by DEA, but some are EPA hazardous waste and others may fall under state rules.

A provider can supply services, documentation and resources within its scope, but the healthcare organization remains responsible for understanding and meeting the requirements applicable to its operations.

Review service scope, licenses, insurance, waste responsibility, packaging support, transportation practices, documentation, training resources, escalation procedures and written agreement terms.

No. It is a general educational resource. Requirements vary, and organizations should consult applicable agencies and qualified legal, safety or environmental professionals when appropriate.