Question 1

How often do we need to run a HIPAA risk assessment?

Accepted Answer

HHS does not prescribe a one-size-fits-all schedule for a HIPAA risk analysis. Treat it as an ongoing process: complete a thorough assessment, then revisit it when systems, vendors, workflows, threats, or incidents change. Many practices set a documented annual review as a practical rhythm, but the right cadence depends on your environment and risk—not an annual checkbox.

Question 2

What is a Business Associate Agreement (BAA)?

Accepted Answer

A Business Associate Agreement (BAA) is a written contract or other arrangement between a covered entity and a business associate that handles PHI for it. It sets permitted uses and disclosures, requires appropriate safeguards, and addresses reporting, subcontractors, and other HIPAA responsibilities. Before a vendor creates, receives, maintains, or transmits PHI for your practice, confirm the relationship and agreement with your privacy lead or counsel.

Question 3

What triggers a HIPAA breach notification, and when is it due?

Accepted Answer

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the practice can show a low probability that the PHI was compromised or an exception applies. Start an incident assessment promptly, document the facts and risk analysis, and involve your privacy lead or counsel. If notification is required, individual notice must be provided without unreasonable delay and no later than 60 days after discovery; a business associate must notify the covered entity without unreasonable delay and no later than 60 days.

Question 4

How often should our workforce receive HIPAA training?

Accepted Answer

HIPAA training should be provided to workforce members as required for their roles and within a reasonable period after joining, then refreshed when policies, functions, or risks materially change. Keep a clear record of what was covered and who completed it, and use incidents or assessment findings to target refreshers. HIPAA does not turn every practice into an annual-training checkbox; choose a cadence that keeps people competent and supports your documented risk-management program.

Question 5

What should we do after a suspected HIPAA incident?

Accepted Answer

If you suspect an incident, pause further disclosure or access when safe, preserve relevant logs and evidence, and notify the person who owns your incident-response process. Record what happened, who may be affected, what PHI was involved, and the safeguards in place, then complete a documented breach assessment. Rookscript can help organize coverage and incident-response work, but notification decisions should be made with your privacy lead or qualified counsel.

Question 6

Do OSHA bloodborne-pathogen rules apply to a small practice?

Accepted Answer

Often, yes. OSHA’s Bloodborne Pathogens standard applies to employers with workers who have reasonably anticipated occupational exposure to blood or other potentially infectious materials, regardless of practice size. Federal OSHA exempts physicians’ and dentists’ offices from certain injury-log requirements, but that does not remove the other applicable bloodborne-pathogen duties; state-plan rules may differ.

Question 7

How often is bloodborne-pathogen training required?

Accepted Answer

Provide bloodborne-pathogen training when an employee is first assigned work with occupational exposure and at least annually thereafter, within one year of the previous training. Add focused training when a task, procedure, or exposure changes. Training should be understandable for the workforce and cover the practice’s controls, Exposure Control Plan, protective measures, and post-exposure steps.

Question 8

How often should we update our Exposure Control Plan?

Accepted Answer

Maintain a written Exposure Control Plan and review it at least annually. Update it sooner when tasks, procedures, job classifications, or technology change in ways that affect occupational exposure, and document the annual consideration of safer medical devices. Keep the current plan accessible to employees and make sure it matches what the practice actually does.

Question 9

What does OSHA Hazard Communication require in a medical practice?

Accepted Answer

If employees may be exposed to hazardous chemicals, OSHA’s Hazard Communication Standard generally calls for a written program, workplace labels, accessible Safety Data Sheets, and training they can understand. Train workers at initial assignment and when a new chemical hazard is introduced, and keep labels and SDSs current as products change. Start with a current chemical inventory, then confirm any product-specific or state-plan requirements with your safety lead.

Question 10

Do we need a sharps-injury log or other OSHA recordkeeping?

Accepted Answer

Under federal OSHA, a practice that is required to keep an OSHA injury-and-illness log must also maintain a confidential sharps injury log for percutaneous injuries from contaminated sharps. Federal OSHA exempts physicians’ and dentists’ offices from those injury-log requirements, so many small practices do not keep the federal sharps log; state-plan or other rules can vary. Regardless, promptly follow your exposure-response process and keep the medical and incident records the applicable rules require.