Employee Handbook Template for Medical Practices [2026]
Every medical practice — from a solo family medicine office to a 50-provider multispecialty group — needs a comprehensive employee handbook. It is the single document that ties together your legal obligations under federal and state employment law, healthcare-specific regulations (HIPAA, OSHA, DEA), and the day-to-day operational policies that keep your practice running. Without one, you are exposed to employment lawsuits, regulatory penalties, and the kind of staff confusion that erodes patient care.
The stakes are high: employment litigation data shows that over 70% of companies face at least one employment-related lawsuit within five years, with average defense costs of $160,000 per case. For medical practices — which face additional layers of HIPAA enforcement (penalties of $100–$50,000 per violation under 45 CFR 160.404), OSHA fines (up to $16,131 per serious violation in 2026), and DEA compliance obligations — the financial and operational risks of operating without a handbook are even greater.
What this template gives you
A complete, 15-section employee handbook framework built specifically for medical practices — with template language, compliance guidance, regulatory references, and an interactive readiness checklist to track your progress.
15
Handbook sections
6
Healthcare-specific
compliance areas
compliance areas
50+
Policy templates
& guidance notes
& guidance notes
2026
Updated for current
federal & state law
federal & state law
GetPracticeHelp.com is an independent comparison platform. Some of the services referenced in this guide are affiliate partners — we may earn a commission if you sign up through our links, at no extra cost to you. Our evaluations are based on publicly available information and verified product details, and affiliate relationships do not influence our rankings or recommendations.
Part 1: Why Every Practice Needs a Handbook
No federal law explicitly requires employers to create an employee handbook. But federal laws including the Fair Labor Standards Act (FLSA), Title VII, FMLA, OSHA, and HIPAA all require you to communicate specific policies and rights to employees. State laws in California, New York, Illinois, Connecticut, and many others go further — mandating written policies for paid sick leave, anti-harassment, lactation accommodations, and more. A handbook is the most efficient vehicle to satisfy all of these requirements in a single, acknowledged document.
For medical practices specifically, the regulatory stakes are unique. HIPAA's Privacy Rule (45 CFR 164.530) requires covered entities to maintain written privacy policies and train all workforce members. OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030) requires a written Exposure Control Plan. The DEA requires documented protocols for controlled substance handling. These are not optional — they are conditions of operating a licensed medical practice.
Legal protection in employment disputes
A signed handbook acknowledgment is your strongest defense in wrongful termination, harassment, and discrimination claims. Courts consistently look for documented policies and proof that employees were informed of expectations. Without a handbook, "I didn't know" becomes a viable defense for the employee.
Regulatory compliance documentation
HIPAA audits, OSHA inspections, and DEA investigations all begin with document requests. A handbook that includes your HIPAA workforce training policy, OSHA Exposure Control Plan summary, and DEA diversion reporting procedures demonstrates compliance before inspectors even walk through the door.
Consistent employee expectations
When 15 employees have 15 different understandings of the PTO policy, call schedule, or dress code, you get conflict. A handbook creates a single source of truth that managers and staff can reference, reducing favoritism claims and supervisor inconsistency.
At-will employment preservation
In 38 states, courts have found that oral promises or handbook language can create an implied employment contract. A properly drafted at-will disclaimer — stating that employment can be terminated by either party at any time, for any lawful reason — is essential to preserve your at-will status and prevent wrongful termination claims.
Critical for medical practices: Unlike general businesses, medical practices must also consider malpractice implications. Staff who mishandle PHI, fail to follow clinical protocols, or improperly manage controlled substances create liability exposure that extends beyond employment law into patient safety, medical board complaints, and even criminal prosecution. Your handbook is the first line of defense.
Part 2: Legal Requirements by Practice Size
Federal employment laws kick in at different employee-count thresholds. Understanding which laws apply to your practice determines which handbook sections are legally required versus merely recommended. Medical practices must also account for healthcare-specific regulations that apply regardless of size.
| Threshold | Federal Laws That Apply | Required Handbook Sections | Key Obligations |
|---|---|---|---|
| 1+ Employees | FLSA, OSHA General Duty Clause, Equal Pay Act, EPPA, IRCA, USERRA, HIPAA (if electronic PHI) | Compensation & payroll, workplace safety, HIPAA privacy & security, employment eligibility | Minimum wage, overtime rules, I-9 verification, workplace hazard-free environment, HIPAA workforce training |
| 15+ Employees | Title VII, ADA, GINA, Pregnant Workers Fairness Act (PWFA) | Equal employment opportunity, ADA accommodations, anti-harassment, anti-discrimination complaint procedures | Protected classes (race, color, religion, sex, national origin, disability, genetic information), reasonable accommodations, pregnancy accommodations |
| 20+ Employees | ADEA, COBRA, OWBPA | Age discrimination policy, COBRA continuation notice, benefits section with COBRA information | Protect employees 40+, offer 18–36 months health continuation coverage for qualifying events |
| 50+ Employees | FMLA, ACA Employer Mandate, EEO-1 Reporting | FMLA leave policy (eligibility, procedures, job protection), ACA-compliant health coverage documentation | 12 weeks unpaid leave for qualifying reasons, offer minimum essential health coverage or pay penalties ($2,900/employee in 2026) |
| 100+ Employees | WARN Act | Mass layoff/plant closing notification procedures | 60-day advance written notice for layoffs of 50+ employees at a single site |
State law adds layers: Many states impose requirements at lower thresholds. California requires paid sick leave for all employers with 1+ employees. New York requires sexual harassment prevention training for all employers. Illinois requires paid leave for all workers. Connecticut requires paid sick leave at 50+ employees. Your handbook must address both federal and state requirements based on where your employees work — not where your practice is headquartered.
For medical practices, the following regulations apply regardless of employee count and must be addressed in your handbook:
- HIPAA Privacy & Security Rules (45 CFR 160–164) — if you transmit any health information electronically
- OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030) — if employees have occupational exposure to blood or OPIM
- OSHA Hazard Communication Standard (29 CFR 1910.1200) — if employees work with hazardous chemicals
- DEA Controlled Substances Act (21 USC 801 et seq.) — if your practice prescribes, administers, or dispenses controlled substances
- EMTALA (42 USC 1395dd) — if you operate or are affiliated with a hospital emergency department
- CLIA (42 CFR 493) — if your practice performs laboratory testing
Part 3: Healthcare-Specific Policies Your Handbook Must Address
This is where medical practice handbooks diverge sharply from generic business handbooks. The following four regulatory areas require dedicated handbook sections with specific policy language, training documentation requirements, and incident response procedures.
HIPAA Privacy & Security
45 CFR 164.530 · 45 CFR 164.308
Every covered entity must designate a Privacy Officer and Security Officer, train all workforce members on PHI handling, implement sanctions for violations, establish complaint procedures, and maintain documentation for six years.
- Workforce training at hire and upon material policy changes
- Minimum necessary standard for PHI access
- Device and media policies (encryption, remote wipe)
- Breach notification procedures (60-day patient notification)
- Sanctions policy for privacy/security violations
- Business Associate Agreement requirements
OSHA Workplace Safety
29 CFR 1910.1030 · 29 CFR 1910.1200
Medical practices must maintain a written Exposure Control Plan, provide annual bloodborne pathogen training, offer Hepatitis B vaccination, maintain sharps injury logs, and implement a Hazard Communication program with Safety Data Sheets.
- Written Exposure Control Plan (14 required elements)
- Annual bloodborne pathogen training for at-risk employees
- Hepatitis B vaccination series offered within 10 days of hire
- Post-exposure evaluation and follow-up procedures
- Sharps Injury Log (OSHA 300A if 11+ employees)
- PPE provision, training, and documentation
- TB screening protocols per CDC guidelines
DEA & Controlled Substances
21 CFR 1301–1321 · 21 USC 801 et seq.
Practices that prescribe, administer, or dispense controlled substances must maintain DEA registration, document inventory procedures, implement diversion prevention protocols, and establish reporting mechanisms for suspected diversion.
- DEA registration and authorized prescriber verification
- Controlled substance inventory and reconciliation procedures
- Prescribing protocols (e-prescribing for Schedule II)
- Diversion prevention and reporting procedures
- PDMP (Prescription Drug Monitoring Program) check requirements
- Secure storage requirements for Schedule I–V substances
Compliance & Ethics
42 USC 1395nn (Stark) · 42 USC 1320a-7b (AKS)
Medical practices must train staff on fraud and abuse prevention, including the Physician Self-Referral Law (Stark), Anti-Kickback Statute, and False Claims Act. Whistleblower protections are required to encourage reporting without retaliation.
- Stark Law awareness (strict liability for physician self-referrals)
- Anti-Kickback Statute compliance (no remuneration for referrals)
- False Claims Act education and qui tam protections
- Whistleblower and non-retaliation protections
- Annual compliance training documentation
- Internal reporting hotline or designated compliance contact
Part 4: Common Handbook Mistakes Medical Practices Make
The difference between a handbook that protects your practice and one that creates liability often comes down to these avoidable errors. Each mistake below has been the basis for enforcement actions, lawsuits, or regulatory citations against medical practices.
Missing or weak at-will disclaimer
Courts in 38 states recognize implied contract exceptions to at-will employment. If your handbook contains language like "employees will only be terminated for cause" or "progressive discipline will be followed," you may have inadvertently created a binding employment contract. Your at-will disclaimer must appear prominently — in the welcome section, the acknowledgment page, and ideally in the header or footer of the handbook.
High risk
No HIPAA sanctions policy
45 CFR 164.530(e) specifically requires covered entities to have and apply "appropriate sanctions against members of its workforce who fail to comply with the privacy policies and procedures." Many practices include HIPAA training language but omit a documented sanctions policy — which is a separately cited requirement during OCR audits and enforcement actions.
High risk
Ignoring state-specific requirements
A practice in California using a generic national handbook template is missing required policies for paid sick leave (Labor Code § 246), sexual harassment prevention training (Gov. Code § 12950.1), lactation accommodation (Labor Code § 1031), and organ donor leave. State requirements apply based on where the employee works — not your practice's home state. Multi-state practices need state-specific addenda.
High risk
Incomplete OSHA Exposure Control Plan
29 CFR 1910.1030(c) requires 14 specific elements in your written Exposure Control Plan, including an exposure determination by job classification, schedule and method of implementation, and procedures for evaluating exposure incidents. Many practices have a generic "safety policy" that doesn't meet the specific regulatory requirements — a finding that triggers OSHA citations of $16,131+ per serious violation.
Moderate risk
No DEA diversion reporting policy
Practices that prescribe or dispense controlled substances often document inventory procedures but fail to establish a clear diversion reporting mechanism. Employees need to know how to report suspected diversion (to whom, through what channel, with what protections). Without this, diversion incidents go unreported until they become criminal matters, exposing the practice to DEA investigation and potential loss of registration.
Moderate risk
Missing acknowledgment signatures
The most comprehensive handbook in the world is useless in court if you can't prove the employee received it. Every employee must sign a receipt acknowledging they received, read, and understood the handbook. For medical practices, maintain separate signed acknowledgments for HIPAA training, OSHA bloodborne pathogen training, and compliance training — these are specifically requested during regulatory audits.
High risk
Part 5: Maintaining Your Handbook
An outdated handbook is worse than no handbook — it gives you a false sense of security while potentially containing policies that conflict with current law. Medical practices face an especially high update cadence because healthcare regulations change frequently through CMS rulemaking, OSHA guidance updates, and state-level legislative activity.
-
Annual comprehensive review (Q1 each year)Review the entire handbook against current federal, state, and local employment law. Check every employee-count threshold (did you cross 15, 20, or 50 employees?). Verify HIPAA policies against any OCR enforcement trends or guidance updates. Confirm OSHA standards and penalties haven't changed. Update compensation, benefits, and PTO figures. Have employment counsel review the final draft before distribution.
-
State law change triggers (ongoing)Monitor your state's legislature for new paid leave mandates, minimum wage increases, anti-harassment training requirements, pay transparency laws, and non-compete restrictions. As of 2026, 18+ states require paid sick leave, and several states have enacted pay transparency laws requiring salary range disclosures in job postings. Add state-specific addenda when new laws take effect.
-
Regulatory update triggers (as issued)OSHA penalty amounts adjust annually for inflation. CMS publishes annual rulemaking that may affect HIPAA or compliance requirements. The DEA periodically issues guidance on controlled substance scheduling changes (e.g., telehealth prescribing rules). Update relevant handbook sections within 60 days of any regulatory change that affects your policies.
-
Incident-driven updates (immediate)If your practice experiences a HIPAA breach, OSHA citation, DEA investigation, employment lawsuit, or compliance audit finding, review and update the relevant handbook sections immediately. Document the policy change, the reason for it, and redistribute the updated section with new acknowledgment signatures.
-
Practice growth triggers (at threshold)When your practice crosses key employee-count thresholds — 15 (Title VII, ADA), 20 (COBRA, ADEA), 50 (FMLA, ACA), or 100 (WARN Act) — you must add the required policy sections before the new obligations take effect. Count all employees including part-time and temporary staff for most threshold calculations.
Version control: Maintain a version log at the front of your handbook showing the revision date and a summary of changes for each update. When distributing updates, use a "change notice" format that highlights what's new — don't make employees re-read the entire document. Collect new acknowledgment signatures for material changes.
Interactive Handbook Readiness Checklist
Use this checklist to track which sections you've included in your employee handbook. Check off each section as you draft it, and expand any section for template language and compliance guidance. The progress bar tracks your completion toward a fully compliant medical practice handbook.
Handbook Completion
0 of 15 sections
Check off sections as you add them to your handbook.
1
Welcome & Practice Overview
Mission statement, practice values, organizational structure, at-will employment statement
Required
Template Language — At-Will Employment Disclaimer
Employment with [Practice Name] is on an "at-will" basis. This means that either the employee or the practice may terminate the employment relationship at any time, with or without cause or notice. No manager, supervisor, or representative of [Practice Name] has the authority to enter into any agreement — written or verbal — that modifies the at-will nature of your employment, except the [Owner/Managing Partner] by written agreement signed by both parties.
Nothing in this handbook creates a contract of employment, express or implied, or a guarantee of employment for any specific duration. The policies, procedures, and benefits described herein may be modified, suspended, or discontinued at any time at the sole discretion of [Practice Name]. This handbook supersedes all previous handbooks and policy statements.
Nothing in this handbook creates a contract of employment, express or implied, or a guarantee of employment for any specific duration. The policies, procedures, and benefits described herein may be modified, suspended, or discontinued at any time at the sole discretion of [Practice Name]. This handbook supersedes all previous handbooks and policy statements.
Key Elements to Include
- Practice mission and values statement aligned with patient care philosophy
- Organizational chart or reporting structure
- Brief history of the practice and service lines
- At-will employment disclaimer (prominently placed — this is your most important legal protection)
- Statement that handbook supersedes all prior versions
- Right to modify handbook at practice's discretion
Legal note: In 38 states, courts have found handbook language can create implied employment contracts. Your at-will disclaimer must be clear, conspicuous, and repeated in the acknowledgment form. Avoid language anywhere in the handbook that implies "permanent" employment or guarantees that discipline will follow specific steps before termination.
2
Employment Policies
Equal opportunity, ADA accommodations, anti-harassment, background checks, immigration compliance
Required
Compliance
Template Language — Equal Employment Opportunity
[Practice Name] is an equal opportunity employer. We do not discriminate in employment decisions on the basis of race, color, religion, sex (including pregnancy, sexual orientation, and gender identity), national origin, age (40 or older), disability, genetic information, military or veteran status, or any other characteristic protected by applicable federal, state, or local law.
This policy applies to all terms and conditions of employment, including but not limited to hiring, placement, promotion, termination, compensation, benefits, training, and disciplinary action. [Add state-specific protected classes as applicable — e.g., marital status, political affiliation, reproductive health decisions.]
This policy applies to all terms and conditions of employment, including but not limited to hiring, placement, promotion, termination, compensation, benefits, training, and disciplinary action. [Add state-specific protected classes as applicable — e.g., marital status, political affiliation, reproductive health decisions.]
Template Language — Anti-Harassment Policy
[Practice Name] strictly prohibits harassment of any kind, including harassment based on any protected characteristic. This includes unwelcome verbal, physical, or visual conduct that creates an intimidating, hostile, or offensive work environment. Sexual harassment — including unwelcome sexual advances, requests for sexual favors, and other verbal or physical conduct of a sexual nature — is expressly prohibited.
Reporting procedure: Any employee who experiences or witnesses harassment must report it immediately to [designated contact — typically Office Manager or external HR resource]. Reports may also be submitted to [alternative contact]. All reports will be investigated promptly and confidentially. No employee will be retaliated against for making a good-faith report.
Reporting procedure: Any employee who experiences or witnesses harassment must report it immediately to [designated contact — typically Office Manager or external HR resource]. Reports may also be submitted to [alternative contact]. All reports will be investigated promptly and confidentially. No employee will be retaliated against for making a good-faith report.
- ADA reasonable accommodation — interactive process for clinical and administrative staff
- Background check policy — pre-employment screening, OIG/SAM exclusion checks, state licensing verification
- Employment eligibility — I-9 verification within 3 business days of hire (IRCA compliance)
- Introductory/probationary period — if applicable (avoid "probationary" language that implies post-probation job security)
- Employment classifications — full-time, part-time, per diem, exempt vs. non-exempt definitions
Healthcare-specific: Medical practices must also check the OIG List of Excluded Individuals/Entities (LEIE) and the System for Award Management (SAM) before hiring any employee who will be involved in federally funded healthcare programs. Employing an excluded individual can result in civil monetary penalties of $100,000 per arrangement under 42 USC 1320a-7a.
3
Compensation & Payroll
Pay schedule, overtime, exempt/non-exempt classification, direct deposit, payroll deductions
Required
Template Language — Overtime Policy
Non-exempt employees will be compensated at one and one-half (1.5) times their regular hourly rate for all hours worked in excess of 40 hours in a single workweek, in accordance with the Fair Labor Standards Act (FLSA) and applicable state law. [California practices: overtime also applies after 8 hours in a single workday and for the first 8 hours on the seventh consecutive workday.]
All overtime must be approved in advance by the employee's direct supervisor or the Office Manager. Working unauthorized overtime may result in disciplinary action; however, all hours worked — whether authorized or not — will be compensated as required by law.
Exempt employees are paid on a salary basis and are not eligible for overtime compensation. Exempt status is determined by job duties, not job title, in accordance with FLSA regulations and DOL guidance.
All overtime must be approved in advance by the employee's direct supervisor or the Office Manager. Working unauthorized overtime may result in disciplinary action; however, all hours worked — whether authorized or not — will be compensated as required by law.
Exempt employees are paid on a salary basis and are not eligible for overtime compensation. Exempt status is determined by job duties, not job title, in accordance with FLSA regulations and DOL guidance.
- Pay periods and pay dates (biweekly, semi-monthly, etc.)
- Timekeeping requirements and procedures for non-exempt staff
- Direct deposit enrollment options
- Payroll deductions (taxes, benefits, garnishments)
- Pay transparency statement (required in CO, CA, NY, WA, and other states)
- On-call compensation (important for clinical practices with call schedules)
Classification warning: Misclassifying non-exempt employees as exempt is one of the most common FLSA violations in medical practices. Clinical staff like medical assistants, phlebotomists, and front-desk coordinators are almost always non-exempt. The DOL salary threshold for exempt status is $58,656/year in 2026. Audit your classifications annually.
4
Benefits Overview
Health insurance, retirement plans, PTO, CME allowance, professional development
Recommended
Key Elements to Include
- Health insurance — eligibility waiting period, plan options, employer contribution, enrollment periods (ACA mandate for 50+ employees)
- Dental and vision — availability and eligibility
- Retirement plan — 401(k) or 403(b) eligibility, employer match, vesting schedule
- PTO / Vacation — accrual rates by tenure, carryover limits, blackout periods, payout at termination
- CME (Continuing Medical Education) allowance — annual dollar amount, eligible expenses, approval process, time off for CME
- Professional licensure support — reimbursement for license renewals, DEA registration fees, board certification
- Life insurance and disability — basic coverage, voluntary supplemental options
- Employee Assistance Program (EAP) — confidential counseling and support services
- Workers' compensation — coverage confirmation and injury reporting procedures
ACA compliance (50+ employees): Applicable Large Employers must offer Minimum Essential Coverage to at least 95% of full-time employees (30+ hours/week) or face employer shared responsibility penalties of $2,900 per full-time employee (2026 amount, minus the first 30 employees). Document your eligibility criteria, waiting periods, and measurement methods clearly in the handbook.
5
Work Schedule & Attendance
Office hours, attendance expectations, call schedules, flexible scheduling, meal and rest breaks
Required
Template Language — Attendance Policy
Regular and punctual attendance is essential to the operation of [Practice Name] and the delivery of quality patient care. Employees are expected to report to work as scheduled and to be ready to begin work at the start of their shift.
Absence notification: Employees who will be absent or late must notify their direct supervisor at least [1 hour/2 hours] before their scheduled start time by [phone call — not text message]. If your absence creates a gap in patient coverage, you are responsible for [arranging coverage/notifying the scheduling coordinator].
Excessive absenteeism — defined as [X unscheduled absences within a rolling 90-day period] — may result in disciplinary action, up to and including termination. This policy does not apply to absences protected by FMLA, ADA, state sick leave laws, or other applicable leave statutes.
Absence notification: Employees who will be absent or late must notify their direct supervisor at least [1 hour/2 hours] before their scheduled start time by [phone call — not text message]. If your absence creates a gap in patient coverage, you are responsible for [arranging coverage/notifying the scheduling coordinator].
Excessive absenteeism — defined as [X unscheduled absences within a rolling 90-day period] — may result in disciplinary action, up to and including termination. This policy does not apply to absences protected by FMLA, ADA, state sick leave laws, or other applicable leave statutes.
- Standard office/clinic hours and shift schedules
- On-call rotation schedules and compensation for clinical staff
- Meal and rest break policies (state law varies — California requires 30-min meal break before 5th hour)
- Inclement weather and emergency closing procedures
- Telehealth/remote work policies (if applicable for administrative staff)
- No-call/no-show policy and consequences (typically immediate grounds for review)
6
HIPAA Privacy & Security
Workforce training, sanctions, device policies, PHI handling, breach notification
Required
Compliance
Template Language — HIPAA Privacy Policy
[Practice Name] is a HIPAA-covered entity and is committed to protecting the privacy and security of all Protected Health Information (PHI) in compliance with the Health Insurance Portability and Accountability Act (HIPAA), the HITECH Act, and all applicable state privacy laws.
Privacy Officer: [Name/Title] serves as the designated Privacy Officer responsible for implementing and overseeing our HIPAA compliance program, as required by 45 CFR 164.530(a).
Security Officer: [Name/Title] serves as the designated Security Officer responsible for electronic PHI (ePHI) security, as required by 45 CFR 164.308(a)(2).
All workforce members — including employees, volunteers, trainees, and contractors under our direct control — must complete HIPAA training within [30 days] of hire and annually thereafter. Additional training is required whenever HIPAA policies are materially changed.
Minimum Necessary Standard: Access to PHI is limited to the minimum amount necessary to perform your job duties. Employees must not access patient records unless there is a legitimate work-related reason to do so. Accessing your own medical records, those of family members, coworkers, or public figures is prohibited and subject to sanctions.
Privacy Officer: [Name/Title] serves as the designated Privacy Officer responsible for implementing and overseeing our HIPAA compliance program, as required by 45 CFR 164.530(a).
Security Officer: [Name/Title] serves as the designated Security Officer responsible for electronic PHI (ePHI) security, as required by 45 CFR 164.308(a)(2).
All workforce members — including employees, volunteers, trainees, and contractors under our direct control — must complete HIPAA training within [30 days] of hire and annually thereafter. Additional training is required whenever HIPAA policies are materially changed.
Minimum Necessary Standard: Access to PHI is limited to the minimum amount necessary to perform your job duties. Employees must not access patient records unless there is a legitimate work-related reason to do so. Accessing your own medical records, those of family members, coworkers, or public figures is prohibited and subject to sanctions.
Template Language — Sanctions for HIPAA Violations
Violations of HIPAA policies will result in disciplinary action, as required by 45 CFR 164.530(e). Sanctions will be applied consistently and may include:
• First offense (minor/inadvertent): Written warning and mandatory retraining
• Second offense or moderate violation: Suspension without pay and formal corrective action plan
• Serious violation (snooping, unauthorized disclosure, failure to report breach): Immediate termination
• Willful or criminal violation: Termination, report to law enforcement, and referral to HHS Office for Civil Rights
Sanctions apply regardless of job title or seniority. Failure to report a known or suspected HIPAA violation is itself a sanctionable offense.
• First offense (minor/inadvertent): Written warning and mandatory retraining
• Second offense or moderate violation: Suspension without pay and formal corrective action plan
• Serious violation (snooping, unauthorized disclosure, failure to report breach): Immediate termination
• Willful or criminal violation: Termination, report to law enforcement, and referral to HHS Office for Civil Rights
Sanctions apply regardless of job title or seniority. Failure to report a known or suspected HIPAA violation is itself a sanctionable offense.
- Device and media policies — encryption requirements for laptops, tablets, smartphones with ePHI access
- Workstation security — screen locks, privacy screens, log-off procedures
- Patient photography — consent requirements, secure storage, social media prohibition
- Fax and email PHI procedures — encrypted email, cover sheet requirements, verification protocols
- Breach notification procedures — internal reporting to Privacy Officer within 24 hours; patient notification within 60 days
- Documentation retention — all HIPAA policies and training records retained for six years per 45 CFR 164.530(j)
Enforcement reality: HIPAA penalties range from $100 to $50,000 per violation (45 CFR 160.404), with an annual maximum of $2,067,813 per violation category. The OCR has collected over $142 million in settlements since 2003. The most common findings in small practice audits: no documented risk analysis, no sanctions policy, and workforce training that isn't documented.
7
OSHA & Workplace Safety
Bloodborne pathogens, hazard communication, PPE, TB screening, injury reporting
Required
Compliance
Template Language — Bloodborne Pathogens Compliance
[Practice Name] maintains a written Exposure Control Plan in compliance with OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030). The full plan is available from [Safety Officer/Office Manager] and is reviewed and updated at least annually.
Exposure determination: The following job classifications involve occupational exposure to blood or other potentially infectious materials (OPIM): [physicians, nurse practitioners, physician assistants, registered nurses, medical assistants, phlebotomists, lab technicians]. [List specific tasks and procedures for each classification.]
Hepatitis B vaccination: The Hepatitis B vaccination series is made available at no cost to all employees with occupational exposure, within 10 working days of initial assignment, as required by 29 CFR 1910.1030(f)(2). Employees who decline must sign a declination form.
Universal/Standard Precautions: All employees with patient contact must treat all human blood and OPIM as if known to be infectious. This applies to every patient encounter, regardless of diagnosis or presumed infection status.
Exposure determination: The following job classifications involve occupational exposure to blood or other potentially infectious materials (OPIM): [physicians, nurse practitioners, physician assistants, registered nurses, medical assistants, phlebotomists, lab technicians]. [List specific tasks and procedures for each classification.]
Hepatitis B vaccination: The Hepatitis B vaccination series is made available at no cost to all employees with occupational exposure, within 10 working days of initial assignment, as required by 29 CFR 1910.1030(f)(2). Employees who decline must sign a declination form.
Universal/Standard Precautions: All employees with patient contact must treat all human blood and OPIM as if known to be infectious. This applies to every patient encounter, regardless of diagnosis or presumed infection status.
- Annual bloodborne pathogens training (within 10 days of hire for at-risk employees, then annually)
- Post-exposure evaluation and follow-up procedures — immediate reporting, confidential medical evaluation, source patient testing
- Sharps Injury Log — documented for each needlestick or sharps injury
- PPE provision — gloves, gowns, face shields, eye protection provided at no cost to employees
- Hazard Communication — written HazCom program, Safety Data Sheets accessible to all employees, labeling of hazardous chemicals
- TB screening — baseline screening at hire, annual risk assessment per CDC guidelines
- OSHA 300/300A Log — required for practices with 11+ employees; posted February 1 – April 30 each year
Penalty context: OSHA's maximum penalty for a serious violation is $16,131 per instance (2026). Willful violations carry penalties up to $161,323. The most frequently cited OSHA standard in healthcare is the Bloodborne Pathogens Standard — specifically missing or outdated Exposure Control Plans and failure to document annual training.
8
Infection Control & Clinical Protocols
Hand hygiene, sharps disposal, exposure incidents, sterilization, environmental cleaning
Required
Compliance
Key Elements to Include
- Hand hygiene protocol — WHO 5 Moments, alcohol-based hand rub availability, soap-and-water requirements for C. diff and norovirus
- Standard Precautions — application to all patients regardless of infection status
- Transmission-Based Precautions — contact, droplet, and airborne isolation procedures
- Sharps disposal — approved containers, fill limits, disposal schedule, never recap needles
- Needlestick/exposure incident protocol — immediate wound care, report to supervisor, post-exposure prophylaxis evaluation, documentation
- Sterilization and disinfection — instrument reprocessing, high-level disinfection, sterilization monitoring (biological indicators)
- Environmental cleaning — daily cleaning schedules, terminal cleaning procedures, approved disinfectants
- Respiratory hygiene/cough etiquette — patient-facing signage and staff expectations
- Staff illness policy — when to stay home, return-to-work criteria for infectious conditions
Clinical relevance: Infection control failures in outpatient settings have led to CMS Conditions of Participation citations, state board investigations, and malpractice claims. CDC's Guide to Infection Prevention for Outpatient Settings provides specific protocols. Your handbook should reference your full Infection Control Plan and identify the staff member responsible for infection prevention oversight.
9
DEA & Controlled Substance Policies
Prescribing protocols, inventory management, diversion prevention, PDMP compliance
Required
Compliance
Template Language — Controlled Substance Policy
[Practice Name] maintains strict compliance with the Controlled Substances Act (21 USC 801 et seq.) and all applicable DEA regulations (21 CFR Parts 1301–1321). Only providers with active, valid DEA registrations may prescribe, administer, or dispense controlled substances.
Prescribing requirements: All Schedule II controlled substance prescriptions must be transmitted electronically via an approved EPCS (Electronic Prescribing for Controlled Substances) system, in compliance with 21 CFR 1311. Providers must check the state Prescription Drug Monitoring Program (PDMP) before prescribing Schedule II–V controlled substances, as required by [state law reference].
Inventory and reconciliation: A perpetual inventory of all controlled substances maintained on-site must be reconciled at least [weekly/monthly]. Discrepancies must be reported immediately to the [Compliance Officer/Managing Physician] and documented. Significant unresolved discrepancies will be reported to the DEA.
Diversion prevention: All employees are responsible for reporting suspected controlled substance diversion — including unusual prescribing patterns, missing medications, unauthorized access to drug storage areas, or signs of impairment in colleagues. Reports should be made to [designated contact] and will be treated confidentially. No employee will be retaliated against for making a good-faith diversion report.
Prescribing requirements: All Schedule II controlled substance prescriptions must be transmitted electronically via an approved EPCS (Electronic Prescribing for Controlled Substances) system, in compliance with 21 CFR 1311. Providers must check the state Prescription Drug Monitoring Program (PDMP) before prescribing Schedule II–V controlled substances, as required by [state law reference].
Inventory and reconciliation: A perpetual inventory of all controlled substances maintained on-site must be reconciled at least [weekly/monthly]. Discrepancies must be reported immediately to the [Compliance Officer/Managing Physician] and documented. Significant unresolved discrepancies will be reported to the DEA.
Diversion prevention: All employees are responsible for reporting suspected controlled substance diversion — including unusual prescribing patterns, missing medications, unauthorized access to drug storage areas, or signs of impairment in colleagues. Reports should be made to [designated contact] and will be treated confidentially. No employee will be retaliated against for making a good-faith diversion report.
- DEA registration display and renewal tracking
- Secure storage — double-lock requirements for Schedule II substances, access log
- Sample medication management — separate from dispensed controlled substances, documentation requirements
- Mid-level provider prescribing authority — scope of practice per state law, supervisory requirements
- Drug destruction procedures — compliant methods for expired or unused controlled substances (DEA Form 41)
- Impaired provider/employee policy — reporting obligations, fitness-for-duty evaluation, state licensing board reporting
DEA enforcement: The DEA can revoke a practice's registration for failure to maintain proper controls. Under 21 CFR 1301.76, registrants must provide effective controls against theft and diversion of controlled substances. The practitioner is responsible for all controlled substances under their registration — including those administered by nurses or medical assistants acting under their authority (21 CFR 1301.12).
10
Technology & Social Media
Acceptable use, personal devices (BYOD), social media, patient photography, password policies
Recommended
Compliance
Template Language — Acceptable Use & BYOD Policy
Practice technology systems — including computers, email, internet, EHR systems, and phone systems — are provided for business use. Limited personal use is permitted provided it does not interfere with job duties, consume excessive bandwidth, or violate any practice policy. [Practice Name] reserves the right to monitor all use of practice-owned technology systems without prior notice.
Personal devices (BYOD): Employees who access practice email, EHR, or any system containing PHI from personal devices must: (a) enable device encryption, (b) use a strong passcode or biometric lock, (c) enable remote wipe capability, and (d) notify the Security Officer immediately if the device is lost or stolen. Personal devices that access PHI are subject to the same HIPAA Security Rule safeguards as practice-owned equipment (45 CFR 164.310).
Social media: Employees must never post, share, or discuss identifiable patient information on any social media platform, including but not limited to Facebook, Instagram, X/Twitter, TikTok, and LinkedIn. Even de-identified patient stories may be identifiable through context and violate HIPAA. Photos or videos taken in clinical areas are prohibited unless authorized by the Privacy Officer for approved purposes with written patient consent.
Personal devices (BYOD): Employees who access practice email, EHR, or any system containing PHI from personal devices must: (a) enable device encryption, (b) use a strong passcode or biometric lock, (c) enable remote wipe capability, and (d) notify the Security Officer immediately if the device is lost or stolen. Personal devices that access PHI are subject to the same HIPAA Security Rule safeguards as practice-owned equipment (45 CFR 164.310).
Social media: Employees must never post, share, or discuss identifiable patient information on any social media platform, including but not limited to Facebook, Instagram, X/Twitter, TikTok, and LinkedIn. Even de-identified patient stories may be identifiable through context and violate HIPAA. Photos or videos taken in clinical areas are prohibited unless authorized by the Privacy Officer for approved purposes with written patient consent.
- Password policy — minimum complexity, rotation schedule, no shared credentials
- Email encryption — required for any message containing PHI
- EHR audit trail awareness — all access to patient records is logged and auditable
- Software installation restrictions — no unauthorized software on practice systems
- Data backup and business continuity — employee responsibilities during system downtime
11
Professional Conduct & Dress Code
Clinical vs. administrative dress, patient interactions, professional behavior standards
Recommended
Key Elements to Include
- Clinical staff dress code — scrubs (color-coded by role if applicable), closed-toe shoes, name badge visible, minimal jewelry (infection control), no artificial nails (CDC recommendation for direct patient care)
- Administrative staff dress code — business casual, professional appearance, name badge required
- Provider dress expectations — lab coats, business professional under scrubs, visible credentials
- Patient interaction standards — introduce by name and role, knock before entering exam rooms, explain procedures, maintain eye contact, active listening
- Professional behavior — respectful communication with colleagues, no gossip about patients or coworkers, professional language in all settings (including break rooms)
- Fragrance policy — limit or prohibit strong fragrances (common in healthcare due to patient sensitivities and allergies)
- Religious and cultural accommodations — reasonable accommodations for religious head coverings, grooming practices, etc. under Title VII and state law
ADA/Title VII intersection: Dress code policies must allow for reasonable accommodations for disabilities and sincerely held religious beliefs. A blanket "no head coverings" policy, for example, would violate Title VII. Draft dress code language that includes a process for requesting accommodations.
12
Disciplinary Process & Termination
Progressive discipline, immediate termination offenses, resignation procedures, exit process
Required
Template Language — Disciplinary Process
[Practice Name] generally follows a progressive discipline process:
• Step 1: Verbal counseling (documented in employee file)
• Step 2: Written warning with corrective action plan
• Step 3: Final written warning or suspension without pay
• Step 4: Termination
Important: This progressive approach is a guideline, not a contractual obligation. [Practice Name] reserves the right to skip any step in the disciplinary process and proceed directly to termination when circumstances warrant, consistent with the at-will nature of employment. The practice determines the appropriate level of discipline at its sole discretion.
Immediate termination offenses may include but are not limited to: HIPAA violations involving unauthorized access or disclosure of PHI, theft, violence or threats of violence, controlled substance diversion, falsification of medical records or time records, patient abuse or neglect, working under the influence of drugs or alcohol, and insubordination that endangers patient safety.
• Step 1: Verbal counseling (documented in employee file)
• Step 2: Written warning with corrective action plan
• Step 3: Final written warning or suspension without pay
• Step 4: Termination
Important: This progressive approach is a guideline, not a contractual obligation. [Practice Name] reserves the right to skip any step in the disciplinary process and proceed directly to termination when circumstances warrant, consistent with the at-will nature of employment. The practice determines the appropriate level of discipline at its sole discretion.
Immediate termination offenses may include but are not limited to: HIPAA violations involving unauthorized access or disclosure of PHI, theft, violence or threats of violence, controlled substance diversion, falsification of medical records or time records, patient abuse or neglect, working under the influence of drugs or alcohol, and insubordination that endangers patient safety.
- Resignation notice requirements — request 2 weeks for administrative, 4 weeks for clinical/providers
- Exit interview process and final paycheck timeline (state law varies — California requires immediate final pay upon termination)
- Return of practice property — keys, badges, devices, scrubs, parking passes
- Access termination — EHR, email, building access revoked upon separation
- COBRA notification — benefits continuation information provided within 14 days (for 20+ employee practices)
- Post-employment obligations — HIPAA confidentiality continues after employment ends
At-will reinforcement: The disciplinary section is where most implied-contract claims originate. Courts have found that mandatory progressive discipline steps can create an implied promise of due process before termination. Always include explicit language that the progressive discipline steps are guidelines that may be bypassed at the practice's discretion, and reaffirm at-will employment status.
13
Leave Policies
FMLA, state paid leave, sick leave, bereavement, jury duty, military leave, voting leave
Required
Compliance
Template Language — FMLA Policy (50+ Employees)
Eligible employees may take up to 12 weeks of unpaid, job-protected leave during a 12-month period under the Family and Medical Leave Act (FMLA) for the following qualifying reasons:
• Birth and care of a newborn child
• Placement of a child for adoption or foster care
• Care for an immediate family member (spouse, child, parent) with a serious health condition
• A serious health condition that prevents the employee from performing essential job functions
• Qualifying exigency arising from a family member's military service
Eligibility: Employees who have worked for [Practice Name] for at least 12 months and at least 1,250 hours during the preceding 12-month period are eligible, provided the practice employs 50 or more employees within 75 miles.
Notice: Employees must provide 30 days' advance notice when the need for leave is foreseeable. Medical certification may be required. Employees on FMLA leave will continue to receive group health insurance coverage on the same terms as active employees.
• Birth and care of a newborn child
• Placement of a child for adoption or foster care
• Care for an immediate family member (spouse, child, parent) with a serious health condition
• A serious health condition that prevents the employee from performing essential job functions
• Qualifying exigency arising from a family member's military service
Eligibility: Employees who have worked for [Practice Name] for at least 12 months and at least 1,250 hours during the preceding 12-month period are eligible, provided the practice employs 50 or more employees within 75 miles.
Notice: Employees must provide 30 days' advance notice when the need for leave is foreseeable. Medical certification may be required. Employees on FMLA leave will continue to receive group health insurance coverage on the same terms as active employees.
- State paid family/medical leave — required in CA, NY, NJ, WA, MA, CT, CO, OR, MD, DE, MN, and others (check your state)
- Paid sick leave — 18+ states require paid sick leave as of 2026; include your state's accrual rate, usage rules, and carryover provisions
- Bereavement leave — recommended 3–5 days for immediate family (Illinois requires bereavement leave under FBLA)
- Jury duty — most states prohibit terminating employees for jury service; some require paid jury duty leave
- Military leave (USERRA) — up to 5 years cumulative; reemployment rights; applies to all employers regardless of size
- Voting leave — many states require time off to vote; policies vary by state
- Domestic violence/sexual assault leave — required in many states for employees seeking protective orders, medical treatment, or relocation
State law complexity: Paid sick leave laws vary dramatically. California requires 40 hours/5 days minimum for all employees. New York requires 40–56 hours depending on employer size. Illinois requires 40 hours of paid leave for any reason. Connecticut requires 40 hours for employers with 50+ employees. Always include your specific state's requirements — do not rely solely on federal minimums.
14
Compliance & Ethics
Fraud/abuse prevention, Stark Law awareness, Anti-Kickback Statute, whistleblower protections
Required
Compliance
Template Language — Compliance Program Overview
[Practice Name] is committed to conducting all business in compliance with applicable federal and state healthcare laws, including the federal False Claims Act (31 USC 3729–3733), the Physician Self-Referral Law (Stark Law, 42 USC 1395nn), and the Anti-Kickback Statute (42 USC 1320a-7b).
Stark Law awareness: The Stark Law is a strict liability statute — meaning a violation can occur regardless of intent. Physicians may not refer Medicare/Medicaid patients for Designated Health Services (DHS) to an entity with which they or their immediate family members have a financial relationship, unless a specific exception applies. DHS includes lab services, imaging, physical therapy, DME, and others. All financial relationships with referring physicians must be documented, at fair market value, and compliant with a Stark exception.
Anti-Kickback Statute: It is illegal to knowingly offer, pay, solicit, or receive any remuneration to induce or reward referrals of items or services payable by federal healthcare programs. This includes cash, gifts, free services, excessive compensation, and below-market-rate leases. AKS violations require proof of intent and carry criminal penalties (up to 10 years imprisonment and $100,000 fine per occurrence).
Whistleblower protections: Employees who report suspected fraud, abuse, or compliance violations in good faith are protected from retaliation under federal and state whistleblower laws, including the False Claims Act's qui tam provisions. Reports may be made to [Compliance Officer], through [anonymous reporting mechanism], or directly to the HHS Office of Inspector General.
Stark Law awareness: The Stark Law is a strict liability statute — meaning a violation can occur regardless of intent. Physicians may not refer Medicare/Medicaid patients for Designated Health Services (DHS) to an entity with which they or their immediate family members have a financial relationship, unless a specific exception applies. DHS includes lab services, imaging, physical therapy, DME, and others. All financial relationships with referring physicians must be documented, at fair market value, and compliant with a Stark exception.
Anti-Kickback Statute: It is illegal to knowingly offer, pay, solicit, or receive any remuneration to induce or reward referrals of items or services payable by federal healthcare programs. This includes cash, gifts, free services, excessive compensation, and below-market-rate leases. AKS violations require proof of intent and carry criminal penalties (up to 10 years imprisonment and $100,000 fine per occurrence).
Whistleblower protections: Employees who report suspected fraud, abuse, or compliance violations in good faith are protected from retaliation under federal and state whistleblower laws, including the False Claims Act's qui tam provisions. Reports may be made to [Compliance Officer], through [anonymous reporting mechanism], or directly to the HHS Office of Inspector General.
- Compliance Officer designation and contact information
- Annual compliance training for all staff — document attendance and content
- Coding and billing accuracy — no upcoding, unbundling, or billing for services not rendered
- Gift and industry interaction policy — limits on pharmaceutical/device company gifts and meals (Open Payments/Sunshine Act)
- Conflict of interest disclosure — annual attestation for physicians and management
- Internal investigation procedures — how reported concerns are investigated and resolved
15
Acknowledgment & Signatures
Receipt acknowledgment, annual review confirmation, at-will reaffirmation, separate compliance acknowledgments
Required
Template Language — Handbook Acknowledgment Form
EMPLOYEE HANDBOOK ACKNOWLEDGMENT
I, _________________________ (print name), acknowledge that I have received a copy of the [Practice Name] Employee Handbook, dated ____________. I understand that:
1. It is my responsibility to read and understand the policies and procedures contained in this handbook.
2. My employment with [Practice Name] is "at will," meaning that either I or the practice may end the employment relationship at any time, with or without cause or notice.
3. This handbook is not a contract of employment, and nothing in it creates any express or implied contractual obligations.
4. [Practice Name] reserves the right to modify, revise, or discontinue any policy in this handbook at any time, with or without notice.
5. If I have questions about any policy, I will contact [Office Manager/HR contact] for clarification.
Employee Signature: _________________________ Date: _____________
Employee Printed Name: _________________________
Witness Signature: _________________________ Date: _____________
I, _________________________ (print name), acknowledge that I have received a copy of the [Practice Name] Employee Handbook, dated ____________. I understand that:
1. It is my responsibility to read and understand the policies and procedures contained in this handbook.
2. My employment with [Practice Name] is "at will," meaning that either I or the practice may end the employment relationship at any time, with or without cause or notice.
3. This handbook is not a contract of employment, and nothing in it creates any express or implied contractual obligations.
4. [Practice Name] reserves the right to modify, revise, or discontinue any policy in this handbook at any time, with or without notice.
5. If I have questions about any policy, I will contact [Office Manager/HR contact] for clarification.
Employee Signature: _________________________ Date: _____________
Employee Printed Name: _________________________
Witness Signature: _________________________ Date: _____________
Additional Required Acknowledgments for Medical Practices
- HIPAA Confidentiality Agreement — separate signed acknowledgment of PHI handling obligations (retained for 6 years per 45 CFR 164.530(j))
- OSHA Bloodborne Pathogen Training Acknowledgment — date of training, trainer name, content summary (retained for duration of employment + 30 years per 29 CFR 1910.1020)
- Controlled Substance Access Agreement — for employees with access to controlled substances, acknowledging diversion prevention responsibilities
- Compliance Training Acknowledgment — annual attestation of fraud/abuse prevention training
- Annual handbook re-acknowledgment — distribute updated handbook sections annually and collect new signatures confirming receipt and understanding
Enforcement essential: During employment litigation, the first document requested is the signed handbook acknowledgment. If an employee refuses to sign, document that the handbook was presented, explain the refusal, and have a witness sign attesting to the employee's receipt. A refusal to sign does not exempt the employee from handbook policies — but you need documentation proving delivery.
Frequently Asked Questions
Is an employee handbook legally required for medical practices?
No federal law requires employers to create an employee handbook. However, federal laws like FMLA, FLSA, Title VII, and OSHA require you to communicate specific policies and employee rights. Many states — including California, New York, Connecticut, and Illinois — mandate written policies for paid sick leave, anti-harassment, and other topics. For medical practices, HIPAA (45 CFR 164.530) requires documented workforce training policies, and OSHA (29 CFR 1910.1030) requires a written exposure control plan. In practice, a handbook is the most efficient way to satisfy all these requirements and creates critical legal protection — over 70% of companies face an employment lawsuit within five years.
What HIPAA policies must be included in a medical practice employee handbook?
Under 45 CFR 164.530, covered entities must include policies for: designating a Privacy Officer and Security Officer, workforce training on PHI handling (required at hire and when policies materially change), sanctions for violations, complaint procedures, breach mitigation, prohibition of retaliation, and safeguards for PHI. Training documentation must be retained for six years. Your handbook should also address the Breach Notification Rule, minimum necessary standards, and device/media policies for any equipment that stores or transmits ePHI.
What OSHA standards apply specifically to medical practices?
Medical practices must comply with OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030), which requires a written Exposure Control Plan, annual training, Hepatitis B vaccination offerings, post-exposure evaluation, and sharps injury logs. The Hazard Communication Standard (29 CFR 1910.1200) requires a written HazCom program and Safety Data Sheets. Practices must also comply with the General Duty Clause, PPE standards, and maintain OSHA 300 logs if they have 11+ employees. Maximum penalty for a serious violation is $16,131 in 2026.
Which federal employment laws apply based on practice size?
Key thresholds: 1+ employees — FLSA, OSHA, Equal Pay Act. 15+ employees — Title VII, ADA, GINA, Pregnant Workers Fairness Act. 20+ employees — ADEA, COBRA. 50+ employees — FMLA, ACA employer mandate. 100+ employees — WARN Act. Medical practices must also comply with HIPAA regardless of size if they transmit health information electronically, and with DEA regulations if they prescribe controlled substances.
How often should a medical practice update its employee handbook?
Best practice is a comprehensive annual review in Q1 each year. Additionally, update immediately when: a new employment law takes effect, your practice crosses an employee-count threshold (15, 20, or 50 employees), you experience a compliance incident, OSHA or CMS issues new guidance, or your practice adds new services. After any update, redistribute revised sections and collect new acknowledgment signatures. Maintain a version log documenting all changes.
What are the most common employee handbook mistakes medical practices make?
The six most common mistakes are: (1) Missing or weak at-will disclaimers — courts in 38 states recognize implied contract exceptions. (2) No HIPAA sanctions policy — 45 CFR 164.530(e) specifically requires documented sanctions. (3) Ignoring state-specific requirements — practices in many states miss mandatory paid sick leave, anti-harassment training, or pay transparency policies. (4) Incomplete OSHA Exposure Control Plans. (5) No DEA diversion reporting policy. (6) Missing acknowledgment signatures — without them, the handbook is nearly useless in court.
Do I need separate handbook sections for clinical and administrative staff?
Yes. Clinical staff require specific policies for OSHA bloodborne pathogen compliance, PPE, sharps handling, TB screening, controlled substance access, and clinical dress codes. Administrative staff need policies for front-desk PHI handling, scheduling confidentiality, and business-casual dress. Both groups need identical HIPAA training, anti-harassment, compensation, benefits, and leave policies. Use a unified handbook with clearly marked role-specific subsections.
HR & Payroll Solutions
Building your team? Get the payroll, benefits, and HR tools that growing practices rely on.
Browse Recommended Partners →