Get Practice Insider free
Join independent practice owners reading it every week. Enter your email and the next issue lands in your inbox.
No spam. One email a week. We never sell your address.
Issue 16 · September 2026
The OSHA log a physician office can skip at any headcount, and the plan it cannot
The lead: the OSHA log a physician office can skip, and the plan it cannot
Ask whether a medical office keeps an OSHA injury and illness log and the usual answer is a guess about headcount. Size is one way out. A company that had 10 or fewer employees at all times during the last calendar year is partially exempt. The second way out gets less attention: an establishment in an industry group on OSHA's list does not need to keep OSHA injury and illness records, and that list includes Offices of Physicians, Offices of Dentists, and Offices of Other Health Practitioners. The industry exemption carries no size test, so a physician office with 40 employees can sit outside the log on its classification alone. It has edges. It ends if OSHA, the Bureau of Labor Statistics, or a state agency acting under their authority asks in writing for records, and it never removes the duty to report a work-related fatality, in-patient hospitalization, amputation, or loss of an eye. The exemption also travels further than most offices expect. The bloodborne pathogens standard ties its own sharps injury log to that same recordkeeping rule:
The requirement to establish and maintain a sharps injury log shall apply to any employer who is required to maintain a log of occupational injuries and illnesses under 29 CFR part 1904.
Read the two rules together and an office outside the injury log is outside the federal sharps injury log as well. What the exemption leaves in place is the written Exposure Control Plan, required of each employer having an employee(s) with occupational exposure, meaning reasonably anticipated contact with blood or other potentially infectious materials on the job. The plan must be reviewed and updated at least annually. As part of that annual review, the employer must document consideration and implementation of appropriate commercially available and effective safer medical devices designed to eliminate or minimize occupational exposure. Separately, the employer shall solicit input from non-managerial employees responsible for direct patient care who are potentially exposed to injuries from contaminated sharps, and shall document the solicitation in the Exposure Control Plan. A new date on the cover page shows the plan was opened. It does not show that either of those two things happened.
What to check this week
Open the current Exposure Control Plan and look for three things: a review date inside the last twelve months, a written note of which safer sharps devices were considered at that review and what was decided, and a record of which non-managerial clinical staff were asked for input and when. If either record is missing, add it at the next review, and put the question to the medical assistants, nurses, hygienists, and technicians who actually handle sharps. Before retiring a sharps injury log the office already keeps, confirm how the location is classified, confirm that no written request for records has arrived, and check whether the practice sits in a State-Plan State. State plans run standards that must be at least as effective as the federal ones, and on recordkeeping topics such as industry exemptions, State-Plan State requirements may be more stringent than or supplemental to the Federal requirements. The compliance hub sets OSHA beside the other compliance domains an independent practice manages and shows which of them has a self-check today.
Three things worth knowing
Enrollment: six quiet months can deactivate Medicare billing, and the gap stays unpaid
A clinician who bills Medicare only now and then, or whose Medicare claims pause while a reassignment gets sorted out, sits under a rule few offices read closely. CMS may deactivate the Medicare billing privileges of a provider or supplier that does not submit any Medicare claims for 6 consecutive calendar months. The same section allows deactivation for failing to report an enrollment change on time, and for failing to furnish complete and accurate information within 90 calendar days of receipt of notification from CMS, the path an unanswered revalidation request takes. The revalidation rule itself asks for the application within 60 calendar days of the notice, and noncompliance with enrollment requirements can also ground a revocation under a separate section. Three details make a deactivation expensive. For the reporting, documentation, and compliance grounds, the deactivation can take effect as of the date on which the provider or supplier became non-compliant. Reactivation counts forward from the date the Medicare contractor received the reactivation submission that was processed to approval by the Medicare contractor. And a provider or supplier may not receive payment for services or items furnished while deactivated, with no fallback to the patient: the Medicare beneficiary has no financial responsibility for those otherwise covered services, and amounts already collected from the patient must be refunded. There is one lever. A written deactivation notice allows 15 calendar days from the date of the written notice to submit a rebuttal, and a late or incomplete rebuttal waives the right. In July 2026 CMS proposed letting providers rebut an assigned reactivation effective date as well, and that remains a proposal. List every enrolled clinician who has gone several months without a Medicare claim, and calendar each revalidation notice at its 60 day mark. The PECOS and CAQH guide covers who should own that calendar and how the two enrollment systems fail differently.
Opt-out: the Medicare affidavit renews itself, and the patient contracts do not
A practice leaving Medicare for a cash or membership model signs two kinds of paper: an opt-out affidavit filed with the Medicare contractor, and a private contract with each Medicare patient. They run on different clocks. The opt-out period runs in 2-year blocks from its start date and continues into each successive 2-year period unless the physician or practitioner properly cancels opt-out. The affidavit carries forward without being refiled. The contracts do not. Each one must state the expected or known effective date and the expected or known expiration date of the current 2-year opt-out period, and each must be entered into for each 2-year opt-out period, so a contract signed in the first period does not cover the second. Outside emergency or urgent care, seeing a Medicare patient in a new period without a new contract is a failure to maintain opt-out, and for the remainder of the period the private contracts are void, the opt-out is nullified, claims must be submitted to Medicare though no Medicare payment follows for the rest of the period, and the physician or practitioner may not attempt to once more meet the criteria for properly opting-out until the current 2-year period expires. The rule leaves a way back for a practice that shows good faith efforts to maintain opt-out within 45 days of a notice from the Medicare Administrative Contractor of a violation. Two exit dates matter as well. Cancelling takes written notice not later than 30 days before the end of the current 2-year opt-out period, and early termination is open only to a first-time opt-out, no later than 90 days after the effective date of the initial 2-year period. Find the start date of the current period, count forward in two year steps, and check that every Medicare patient being seen now has a contract dated for the period that is running.
Startup: a urine pregnancy test makes an exam room a laboratory, one location at a time
A new practice planning to run a urine pregnancy test in the exam room is planning to operate a laboratory under federal rules. CLIA defines a laboratory by what it does: a facility for the examination of materials derived from the human body for the purpose of providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings. A laboratory will be cited as out of compliance with section 353 of the Public Health Service Act unless it holds a current certificate for the kind of testing it performs or is CLIA-exempt. An office running only simple tests uses a certificate of waiver, which allows a laboratory to perform only the waived tests on the regulation's list. That list names urine pregnancy tests and blood glucose by glucose monitoring devices cleared by the FDA specifically for home use, and the list printed in the regulation is not the whole current one, since additional tests are added and FDA determines whether tests and test systems meet the criteria to be categorized as waived. Three details catch new and growing practices. A laboratory performing only waived tests must file a separate application for each laboratory location, so a second office needs its own certificate, with narrow exceptions such as mobile testing sites. A waived laboratory must follow manufacturers' instructions for performing the test and agree to announced and unannounced inspections, including on a random basis to determine whether the laboratory is performing tests not listed. And a site that only collects or prepares specimens and ships them elsewhere for testing is not considered a laboratory at all. The CLIA-exempt route depends on the state, since it applies only where a state licensure program has been approved as equal to or more stringent than CLIA. Before opening day, list every in-office test each location plans to run and match that list to the certificate the location will hold. A single test beyond the waived list means that location needs a different certificate.
One for the back pocket
The P in HIPAA stands for portability. The Health Insurance Portability and Accountability Act was approved in August 1996, and its long title says it was passed to improve portability and continuity of health insurance coverage in the group and individual markets, along with other aims. Privacy came in through a deadline. Section 264 had the Secretary of Health and Human Services send privacy recommendations to Congress, then set a condition: if privacy legislation was not enacted by the date 36 months after enactment, the Secretary would issue final privacy regulations not later than 42 months after enactment.
Congress let that date pass. The final Privacy Rule, published in the Federal Register on December 28, 2000, says so in its preamble: Congress did not enact legislation regarding the privacy of individually identifiable health information prior to August 21, 1999, so HHS published proposed standards in November 1999 and then the mandated final regulation. The privacy rules a front desk trains on started life as an agency regulation because a congressional deadline passed without a law.
The same section settled how that regulation would sit next to state law. A regulation issued under it would not override a contrary State law that imposes more stringent requirements, and the current rule keeps that exception: under 45 CFR 160.203, a contrary state law survives when it relates to the privacy of individually identifiable health information and is more stringent than the federal Privacy Rule standard. That is why HIPAA privacy works as a floor rather than a ceiling, and why a privacy policy built only from a federal HIPAA template can still fall short in a state with a stricter medical privacy law. What counts as more stringent is spelled out in 45 CFR 160.202, and whether a particular state law qualifies is a question for counsel.
Putting this issue to work
Compliance programs, enrollment status, and lab certificates are set up once and then quietly go stale. The decision tools on GetPracticeHelp are free, take about two minutes each, and ask for no email address.
Browse the decision tools →On the rules: the partial recordkeeping exemptions by company size and by industry, and the list of partially exempt industries, are 29 CFR 1904.1, 1904.2 and appendix A to subpart B of part 1904; the duty to report fatalities, in-patient hospitalizations, amputations and losses of an eye is 29 CFR 1904.39; State-Plan recordkeeping is 29 CFR 1904.37 and the State-Plan standards criterion is 29 CFR 1902.3(c). The sharps injury log, the Exposure Control Plan, its annual review, the safer device documentation and the non-managerial input requirement are 29 CFR 1910.1030(c)(1) and (h)(5). Medicare deactivation reasons, effective dates, reactivation and the payment prohibition are 42 CFR 424.540; the 60 day revalidation submission is 42 CFR 424.515(a)(2); revocation for noncompliance is 42 CFR 424.535(a)(1); beneficiary liability and refunds are 42 CFR 424.555(b); deactivation rebuttals are 42 CFR 424.546; the reactivation date rebuttal proposal is in the CY 2027 home health proposed rule at 91 FR 41216 (July 6, 2026). The opt-out period, private contract requirements, failure to maintain opt-out, cancellation and early termination are 42 CFR 405.400 through 405.445. The laboratory, certificate of waiver and CLIA-exempt definitions, applicability, the waived test list and the per-location application are 42 CFR 493.2, 493.3, 493.15 and 493.35. Every section was read in the eCFR on September 14, 2026 at the latest issue date for its title, and the Federal Register was searched for later rules on each part; the CY 2027 physician fee schedule proposed rule (91 FR 43842) does not amend the Medicare sections cited here, and the July 2026 CLIA request for information (91 FR 43586) changes no regulation. On the back pocket: the short title, long title, approval date and section 264 are read from the enrolled text of Public Law 104-191; the statement that Congress did not enact privacy legislation before August 21, 1999 is from the preamble of the final Privacy Rule, 65 FR 82462 (December 28, 2000); the state law exception and the definition of more stringent are 45 CFR 160.203 and 160.202, read in the eCFR on September 14, 2026, with the Federal Register searched for later amendments. State plans, state law, payer contracts and accreditation bodies can add requirements on top of every federal rule here. Treat these as the federal floor to check a specific situation against, not as a guarantee about that situation.
Before you act on any rule here: Practice Insider gives general operational guidance on running an independent practice. It is not legal, compliance, tax, or financial advice. Confirm OSHA recordkeeping status, Medicare enrollment or opt-out decisions, and CLIA certificate questions with qualified healthcare counsel, a compliance professional, your Medicare Administrative Contractor, or your state agency before acting. Industry classification, State-Plan requirements, enrollment history and the exact tests a location runs all change the answer, so verify current requirements against your own situation before making a decision.