The Path to Becoming HIPAA and OSHA Compliant

To become HIPAA and OSHA compliant, first confirm which rules apply to you. Then run a documented HIPAA security risk analysis and an OSHA hazard assessment, fix the highest risks first, capture evidence as part of daily work, and give each program a named owner and a review calendar. The two laws differ, but the discipline is the same.

This guide is for clinic managers, practice administrators and HR or operations leads in health care who own both programs, often without a dedicated compliance team.

Key takeaways

• HIPAA protects health information and is enforced by the HHS Office for Civil Rights. OSHA protects worker safety and is enforced by the Department of Labor.
• Both start with assessment: a Security Rule risk analysis for HIPAA and a hazard assessment for OSHA.
• If it is not documented, both agencies will treat it as not done.
• Named owners and a recurring calendar keep programs from decaying after the first push.

Do HIPAA and OSHA both apply to my organization?

Start by scoping, because mistakes here waste money in both directions. HHS explains that HIPAA's rules cover health plans, health care clearinghouses and health care providers that conduct standard transactions electronically. They also reach business associates, the vendors and partners that perform functions or services on a covered entity's behalf involving protected health information (PHI). If you are in scope, the Privacy, Security and Breach Notification Rules follow.

A point that trips up many HR teams: HHS states plainly that the Privacy Rule "does not protect your employment records, even if the information in those records is health-related." A doctor's note in a personnel file is sensitive and may be protected by other laws such as the ADA, FMLA and state rules, but it is not automatically PHI. A hospital is a covered entity for its patients' records, yet acts as an ordinary employer for its own staff's personnel files.

OSHA applies to most private-sector employers. The real question is which standards your operations trigger. In health care, the usual list includes:

• Bloodborne Pathogens (29 CFR 1910.1030) for anyone with occupational exposure to blood or other potentially infectious materials. OSHA requires a written exposure control plan covering engineering and work practice controls, protective equipment, training, medical surveillance and hepatitis B vaccination.
• Hazard Communication for chemicals such as disinfectants and sterilants: container labels, safety data sheets, employee training and a written program.
• Recordkeeping of work-related injuries and illnesses, which applies to many employers with more than 10 employees.
• General industry rules such as exit routes and electrical safety, plus the General Duty Clause for recognized hazards like workplace violence.

Our explainer on what OSHA compliance involves covers recordkeeping and reporting deadlines in more detail.

What does a HIPAA risk analysis and OSHA hazard assessment involve?

Both ask you to look honestly at where things can go wrong. HHS calls the risk analysis "the first step" and "foundational" to Security Rule compliance, and says the process "should be ongoing."

Element	HIPAA Security Rule risk analysis	OSHA hazard assessment
What you inventory	Where electronic PHI is created, stored, sent and accessed	Tasks, equipment, chemicals and work areas
What you evaluate	Threats, vulnerabilities, likelihood and impact	Hazards, exposure, severity and existing controls
Typical output	Risk register and risk management plan	Hazard list, control plan, PPE and training needs
Enforcing agency	HHS Office for Civil Rights	OSHA (or a state plan)
Refresh trigger	Periodically, and when systems or operations change	When processes, equipment or incidents change

Write both assessments as if an investigator will read them later, because one might. A common mistake is an assessment that flatters the current state. That is worse than none, since it shows you knew the method and avoided the findings.

Which compliance gaps should you fix first?

Fix in risk order, weighing likelihood and severity together. A clinic might find twenty HIPAA gaps and fifteen OSHA gaps. Trying to close all thirty-five at once usually means none get finished.

Typical HIPAA priorities

• Unique user IDs, role-based access and audit logging on systems holding electronic PHI.
• Encryption for laptops, phones and removable media that leave the building.
• Signed business associate agreements with every vendor that handles PHI; see our guide on when you need a business associate agreement.
• A breach response plan that has been tested in a tabletop exercise, not just written.

Typical OSHA priorities

• Engineering controls for the highest-severity exposures. OSHA calls engineering controls "the primary means" of reducing bloodborne exposure, with examples such as needleless and shielded needle devices.
• A current, written exposure control plan and hazard communication program.
• PPE that fits and is actually stocked where the work happens.
• Training with sign-offs and a trigger for new hires and role changes.

When technology is part of the fix, such as a new tablet workflow or internal app, check that the tool itself does not create new PHI exposure.

How do you document compliance without a binder project?

The sustainable approach is to capture evidence as work happens rather than assembling it before an audit. Use this checklist:

• Training completions recorded automatically by your learning system.
• Injury and incident reports filed where and when they happen, feeding the OSHA 300 log.
• Access reviews on a calendar, with results saved.
• Sanction policies applied and recorded consistently.
• Policies versioned with effective dates and approval records.

Organizations that cram documentation before an audit tend to struggle with follow-up questions. Those whose systems produce records as a byproduct find inspections much calmer. Our checklist on how to prepare for an OSHA inspection shows what inspectors usually ask for.

Who should own HIPAA and OSHA compliance?

HHS states that a covered entity "must designate a privacy official," and the Security Rule says a regulated entity "must designate a security official." Our guide to designating a HIPAA privacy and security officer covers how to pick and support them. OSHA does not always name a role, but every safety program needs an equivalent owner. Give each owner a review rhythm and the authority to act:

• Quarterly access reviews and incident trend reviews.
• Annual refresh of the risk analysis and hazard assessment, or sooner after major changes.
• Training cycles tied to hire dates and annual requirements.
• Drills for breach response and emergency action plans.

Report status to leadership on a schedule. Compliance decays by default; the calendar is what holds it in place.

Frequently asked questions

Is HIPAA compliance required for every employer?

No. HIPAA applies to covered entities and their business associates. An employer outside health care is generally not a covered entity, although its group health plan may be subject to HIPAA. HHS says the Privacy Rule does not protect employment records, even health-related ones; those usually fall under laws such as the ADA and FMLA. Confirm your status with counsel if you sponsor a self-insured plan.

How often should a HIPAA risk analysis be updated?

HHS says the risk analysis process should be ongoing, not a one-time project. Many organizations do a full review annually and update it whenever they adopt new systems, change vendors, open locations or have a security incident. Keep each dated version alongside the resulting risk management plan so you can show progress over time.

Can one person handle HIPAA privacy, security and OSHA?

In a small organization, one person can hold several roles if they have the time, training and authority to do each properly. As operations grow, splitting them usually works better, because security officers need technical depth while safety managers need to be on the floor. Whatever the structure, document responsibilities and backups so programs do not stall during absences.

What to do next

1. This week, write a one-page scope statement: covered entity, business associate or neither, and which OSHA standards apply.
2. Schedule the HIPAA risk analysis and the hazard assessment with named owners and deadlines.
3. Build one combined remediation list ranked by risk, and set the review calendar before the first fix is done.
4. Confirm specific obligations with health care counsel or the relevant agency; this article is general information, not legal advice.

Last reviewed: October 2026.

Sources

• Summary of the HIPAA Privacy Rule, U.S. Department of Health and Human Services
• Guidance on Risk Analysis under the HIPAA Security Rule, U.S. Department of Health and Human Services
• Employers and Health Information in the Workplace, U.S. Department of Health and Human Services
• Bloodborne Pathogens, Occupational Safety and Health Administration