Small businesses · Medical clinics
What a medical clinic has to keep up with, and who does it.
The bloodborne pathogens exposure control plan, the HIPAA policies and risk analysis, and the licenses a lab test, a controlled drug or an X-ray machine each bring. Arikano works out which of these are yours, drafts the written programs and keeps the dates. You approve it.
- Rules for every clinic
- 17
- Rules depending on how you work
- 18
- Practices Arikano recommends
- 9
- Documents Arikano drafts
- 12
Review status. Not yet reviewed. No credentialed professional has reviewed the rules on this page so far. Each rule names the regulation it comes from, so you can check it yourself.
Where to start
The heaviest items on a new clinic’s list.
Bloodborne pathogens exposure control plan
Anyone who can reasonably be expected to touch blood or other body fluids at work is covered. The plan names who is exposed, the hepatitis B vaccine offer, the sharps controls and what happens the night somebody gets stuck.
OSHA · 29 CFR 1910.1030(c)(1)
Medical waste handled under your state’s rules
Used sharps and blood-soaked waste are regulated by your state, which decides whether a practice needs a permit or registration, who may haul the waste away and what records you keep. Florida, for example, requires a permit of anyone who produces biomedical waste but excuses a practice producing less than 25 pounds in each 30 days from registration and the fee.
State law · State medical or biomedical waste law (varies by state; e.g. Fla. Stat. §381.0098(4)(a))
Safer needles and sharps evaluated this year
Every year, as part of reviewing your bloodborne pathogens plan, you write down which safer needles and sharps you considered and which you adopted, and you ask the front-line staff who use them — not only managers — and record that you asked.
OSHA · 29 CFR 1910.1030(c)(1)(iv)(B) and (c)(1)(v)
For every clinic
What applies from day one.
Each rule with the regulation it comes from, and how often Arikano checks it again. Items marked “Arikano guidance, not a law” are practices Arikano recommends, not rules. The few that wait until you have employees say so.
Workers’ compensation coverage in force
If someone gets hurt on the clock this is what pays their medical bills and their wages. Going without it where your state requires it is not a fine — in most states it is a criminal offense and you become personally liable for the claim.
Once you have employees
State unemployment insurance account registered
The account your state unemployment contributions are paid into — every state runs a program and every covered employer registers with it, usually with the labor or workforce department rather than the revenue one. It is worth getting right early for a reason that is not obvious: your contribution rate is experience-rated, so the claims filed against this account in your first years set what you pay for years afterwards. Register before your first payroll. The wage base and the new-employer rate are set by your state and change, so take both from the state.
State income tax withholding account registered
The account you withhold your employees’ state income tax into and remit from. You register with your state’s revenue department, usually online and usually free, and you need your EIN in hand to do it. Register before your first payroll, not after: the penalty is normally for remitting late, and you cannot remit to an account that does not exist. A few states have no wage income tax and therefore no withholding account — if yours is one of them, waive this and keep the state unemployment insurance account, which every state has.
Bloodborne pathogens exposure control plan
Anyone who can reasonably be expected to touch blood or other body fluids at work is covered. The plan names who is exposed, the hepatitis B vaccine offer, the sharps controls and what happens the night somebody gets stuck.
Fatality and severe-injury reporting procedure
A death is eight hours. An in-patient hospitalization, an amputation or the loss of an eye is twenty-four. That clock runs whether or not you are exempt from keeping the 300 log, and whether or not anyone in the office knows the number to call.
Certificate of occupancy for the premises
If you are taking a space that staff or customers will use, the building official signs off that it may be occupied for what you intend to do in it — and a new certificate is normally required when the USE changes, even if nothing is built. That is the one that catches people: a unit that was a shop is not automatically an approved kitchen, a gym or a clinic, and the landlord’s existing certificate does not transfer to your use. Find out before you sign, because the work it takes to pass is the tenant’s problem and the rent starts either way. If you work from home or out of a vehicle, waive this one.
Local business license or business tax registration
Your city or county almost certainly wants its own registration on top of anything the state issued, and the two are unconnected — a perfectly formed LLC with every state account open can still be trading unlawfully in its own city. Check the city AND the county, because plenty of businesses owe both, and check the zoning at the same time: a license is routinely refused on the ground that the use is not allowed at that address, which is a much cheaper thing to discover before you sign a lease. Record the expiry printed on the license; the renewal interval and the fee are set locally and vary between neighboring towns.
Form I-9 on file for every employee
Section 1 within the first day of work, section 2 within three business days, and the file kept for three years after hire or one year after they leave — whichever is later. An audit counts forms, not intentions.
Once you have employees
PPE assessment and program
Before you hand out gloves and glasses the rule wants you to have walked the work, written down what can hurt someone, and signed and dated the assessment. The certificate is the part that gets cited, not the gear — and it is the proof an inspector or a client asks for.
Sales and use tax permit, or a note that you owe none
If you sell anything your state taxes you register for a permit before the first sale, not before the first return — collecting tax without one is its own offense in several states, and so is failing to collect. What counts as taxable is set state by state and is not obvious: almost every state with a sales tax taxes goods, a good many tax some services, and a few tax neither because they have no sales tax at all. This is a question a founder cannot answer from first principles, so look it up once with your state’s revenue department and record either the permit or the answer that you owe none.
Medical waste handled under your state’s rules
Used sharps and blood-soaked waste are regulated by your state, which decides whether a practice needs a permit or registration, who may haul the waste away and what records you keep. Florida, for example, requires a permit of anyone who produces biomedical waste but excuses a practice producing less than 25 pounds in each 30 days from registration and the fee.
Safer needles and sharps evaluated this year
Every year, as part of reviewing your bloodborne pathogens plan, you write down which safer needles and sharps you considered and which you adopted, and you ask the front-line staff who use them — not only managers — and record that you asked.
Once you have employees
Background screening for direct-care staff
Every state screens people who work unsupervised with patients, but which registries, which offenses and how often are all state law — and getting it wrong costs the license, not just a fine.
Infection prevention and control program
Hand hygiene, PPE, cleaning between patients, and who you tell when a reportable illness turns up. Staff who move between patients are the route an outbreak takes.
TB screening for staff at hire
CDC recommends that every health care worker has baseline TB screening when hired — a risk assessment and a blood test or skin test — and, after that, no routine yearly test unless there is a known exposure. That is guidance, not federal law: your state’s licensing rules decide what is required of you, and many require it. In California it is part of the aerosol transmissible diseases rule.
Once you have employees
CPR and first aid certification current
Care staff are often alone with the patient. Certification cards run two years and the lapse is invisible until the day it matters.
OIG exclusion screening of staff and vendors
If anyone on your payroll is on the federal exclusion list, every federal dollar that touched their work is repayable, plus a penalty per item. The list changes monthly, which is why the check is monthly.
Annual safety refresher
Everyone should be retrained at least once a year; the training records prove it.
New-hire safety orientation
Everyone new should learn the hazards, the exits and who to tell before their first day of work, and anyone who checks your program asks whether they did.
Employer Identification Number on file
Your business tax ID. You cannot run payroll, open a business account or file a return without it, and it is free from the IRS.
General liability policy in force
No statute makes you carry this — your landlord, your hiring clients and most contracts do. One trip-and-fall claim against an uninsured business is the whole business.
Fire safety / emergency action plan
Where the exits are, who counts heads, who calls it in. Extinguishers on the wall are enough to trigger it. At ten employees or fewer OSHA lets you brief everyone out loud instead of writing it down — keep it on paper anyway, because the written version is the one an inspector, an insurer or a client asks to see.
Professional liability (malpractice) cover
A general liability policy will not answer a claim about clinical judgment — a missed medication, a wrong assessment. Payers and facilities usually require this in the contract.
OSHA "It’s the Law" poster displayed
Federal law says the poster has to hang where your crew actually sees it — a break room wall, not a binder. It is free from OSHA and it is the cheapest citation you will ever avoid.
Depending on how you work
Arikano asks before it adds these.
Each question is asked the way Arikano asks it when you start. A yes adds the rules under it; a no keeps them off your list. It also asks 11 less common questions that rarely apply to medical clinics and practices.
Do you hold anyone’s medical or patient information — treatment, diagnoses, or insurance claims?If yes: 5 rules
HIPAA security risk analysis
The first thing OCR asks for after a breach, and the thing almost nobody has. It is a written, dated assessment of where patient information lives and what could reach it — and it has to be revisited, not framed.
HIPAA policies and procedures in writing
Who may look at a record, how it is stored and sent, what happens in the first 24 hours of a breach. The rule requires it written down and kept for six years from the last date it was in effect.
Business associate agreements on file for every vendor
Before a billing company, records system, IT firm or any other vendor handles your patients’ information, you need its written promise to protect it — a business associate agreement. A list of every such vendor, with the signed agreement for each, is how you show you know who they are. Arikano does not sign these agreements, so patient information stays out of it.
Breach log kept, and small breaches reported each year
Every privacy incident is logged and judged against the four-factor test. The people affected by a breach are told within 60 days of its discovery. Breaches of fewer than 500 people are reported to HHS once a year, within 60 days after the year ends, so the log is what that report is built from. It holds counts and kinds of information, never patients’ names.
HIPAA workforce training current
Everyone who can see patient information has to be trained on your own policies — new starters as part of onboarding, everyone else whenever the policies change.
Do you run any tests on patients here — even a finger-stick glucose, a urine dipstick, a strep or pregnancy test?If yes: 1 rule
CLIA certificate current for the tests you run
Testing a patient sample to diagnose, prevent or treat a condition, or to assess someone’s health, makes you a laboratory under federal law, and a laboratory needs a CLIA certificate that covers the kind of tests it runs — even a finger-stick glucose or a rapid strep test needs at least a certificate of waiver — unless your state runs its own approved program. A certificate of waiver is needed for each location, lasts no more than 2 years, and its renewal application goes in 9 to 12 months before it expires.
Does anyone here prescribe, give, dispense or keep controlled drugs — pain medicines, sedatives, stimulants, testosterone?If yes: 1 rule
DEA registration current for each location
Only a DEA-registered practitioner may prescribe controlled drugs, and giving or dispensing them takes a registration granted before you start. Each place where you keep, give or dispense them needs its own. A practitioner or clinic registration runs 3 years after the first period, and you can apply to renew in the 60 days before it expires.
Do you have an X-ray machine — medical, dental or bone density — on site?If yes: 1 rule
X-ray machines registered with the state
X-ray machines are registered with your state’s radiation control program. In Texas no one may use or own a source of radiation without a license, registration or exemption from the state; in Florida the registration is renewed every year. What your state asks for, and how often it inspects, is its own rule.
Do you use anything that arrives with a safety data sheet — solvents, fuels, adhesives, strong cleaners?If yes: 2 rules
Hazard Communication program
If anything you use arrives with a safety data sheet, you owe a written program: the chemical list, the sheets on hand, the labels and who was trained. It is OSHA’s most-cited standard almost every year, and the first written program an inspector, an insurer or a client asks to see.
Hazard Communication training current
The program is half of it. Everyone working around those chemicals has to be trained before they start and again whenever a new hazard walks in the door.
Does anyone wear a respirator — including a disposable N95 you tell them to wear?If yes: 2 rules
Respiratory protection program
The moment you require a respirator — including a disposable N95 you tell someone to wear — you owe a written program, a medical evaluation for each wearer and a fit test. Voluntary N95 use is lighter, but it still owes them Appendix D.
Respirator fit tests current
A respirator that does not seal to that particular face does nothing. The fit test is per person, per make and model, and it is due again every twelve months.
Do you hold a federal contract, sub on one, or bid for federal work?If yes: 3 rules
SAM.gov registration active
This is the one to never let lapse. An expired registration does not just stop you bidding — the government cannot pay you on the contracts you already have, and contractors normally find out when an invoice bounces. It renews every year and the renewal is easy to miss, so put the expiry on the calendar and give it an owner by name.
Unique Entity Identifier (UEI) on file
The twelve-character identifier SAM.gov issues for your business — this is the federal one. It replaced the DUNS Number for federal use in April 2022, so if a form or a prime is still asking you for a DUNS to identify you to the government, the UEI is what they actually need. You get it with your SAM registration; keep it where whoever fills in bid forms can find it.
CAGE code on file
The Commercial and Government Entity code the Defense Logistics Agency assigns to your business — it comes with your SAM registration and goes on contracts, invoices and DoD paperwork. It carries its own expiry date, so record the date printed on yours rather than assuming it runs with the SAM renewal.
Do you bring in subs or 1099 crews to do any part of the work?If yes: 1 practice
Subcontractor management program
Clients hold you responsible for the subs you bring; they want to see how you qualify and oversee them.
Does anyone drive for work — a company truck, a van, or their own car between job sites?If yes: 1 practice
Commercial auto cover for business driving
A personal policy excludes business use, so the claim from a crash between job sites can be denied outright. This is a contract and prudence question, not a federal one — the DOT minimums are a separate row and only bite on commercial vehicles.
Did you set up an LLC, corporation or partnership with your state, rather than working under your own name?If yes: 3 rules
Formation document filed with the state
The filing that brings the company into existence — articles of organization for an LLC, articles or a certificate of incorporation for a corporation, a certificate of limited partnership for an LP. Until it is accepted there is no company: no liability shield, no business bank account, and nothing for the IRS to issue an EIN to. Keep the stamped copy the state sends back, because your bank, your insurer and every state tax account will ask for it. The fee and the processing time are set by your state and change, so take both from your own Secretary of State rather than from anybody’s summary.
State entity registration current (periodic report filed)
The filing that keeps your LLC or corporation alive with the state. Miss it long enough and the state administratively dissolves the entity: the company stops existing, your liability shield goes with it, and reinstatement costs more than the filing ever did. How often it is due varies by state — annual in most, biennial in several, and some states key it to your formation anniversary rather than a common date — so look up your own state’s interval and put the date it gives you on the record.
Registered agent on file with the state
The person or company at a real street address in your state who is legally allowed to accept a lawsuit on your behalf. If the address on file is a former accountant or an office you moved out of, you can be sued and lose by default without ever hearing about it — and a state that cannot reach your agent can dissolve the entity on that ground alone. Check it every time you move, and whenever the agent changes.
By state
What changes in Texas, Florida, California, New York and Georgia.
Rules a state adds on top of the list above, for medical clinics and practices. Arikano adds the ones for your state once you tell it where you work.
Texas
Arikano has no rules written only for medical clinics and practices in Texas yet. Everything listed above still applies there.
Florida
Arikano has no rules written only for medical clinics and practices in Florida yet. Everything listed above still applies there.
California
Injury and illness prevention program (California)
California requires every employer to keep a written Injury and Illness Prevention Program: who is responsible for safety, how hazards are found and fixed, how injuries are looked into and how people are trained. With fewer than 10 employees you may give the general safe-work instructions out loud, but the program itself is written — and it is the first thing a Cal/OSHA inspector, a hiring client or a platform review asks to see.
Heat illness prevention plan (California)
California wants this one in writing, in English and in the language most of your crew speaks, kept at the worksite where an inspector can ask for it: water, shade, what happens when it gets hot, what you do when somebody goes down, and how new people are brought up to the heat. It can live inside your injury and illness prevention program or stand alone. It reaches every outdoor place of employment in the state, so if nobody on your payroll ever works outdoors, waive it — but waive it deliberately.
Cal/OSHA serious injury reporting procedure (California)
California is tighter than the federal clock and this is where people get caught. Any serious injury or illness, or a death, is reported to Cal/OSHA immediately — meaning as soon as practically possible and in no event more than eight hours after you knew or would have known. Federal OSHA allows twenty-four hours for a hospitalization; California does not. Exigent circumstances you can demonstrate stretch it, and no further than twenty-four hours. Whoever answers the phone at 6am needs to know the number and the deadline.
Workplace violence prevention plan (California)
Since July 2024 almost every California employer owes a written workplace violence prevention plan and a violent incident log alongside it. The plan names who runs it, how employees help build it, how incidents get reported and investigated, and what you did about the hazards you found. Healthcare covered by the Cal/OSHA healthcare violence standard is out, and so is a site with fewer than ten people at any one time that the public cannot walk into — but only if that site is already compliant with its injury and illness prevention program.
Aerosol transmissible diseases procedures (California)
California’s standard covers clinics, medical offices, home health care and hospices. A practice that screens and refers people with airborne infections — rather than treating them — keeps written procedures for infection control, source control, screening and referral, and exposure incidents, trains staff at hire and every year, and reviews the procedures every year. A practice that treats those patients needs a full ATD plan instead. Some dental offices and specialty practices are outside it if they meet every listed condition.
Once you have employees
Workplace violence prevention training current (California)
The plan is half of it. Everyone gets trained when the plan is first written and again every year after: what the plan says, how to report an incident without it coming back on them, the hazards specific to their own job, and a live chance to ask questions of somebody who actually knows the plan. New hazards or a changed plan trigger training again.
New York
Arikano has no rules written only for medical clinics and practices in New York yet. Everything listed above still applies there.
Georgia
Arikano has no rules written only for medical clinics and practices in Georgia yet. Everything listed above still applies there.
What Arikano drafts
The documents, drafted for your clinic.
Each is drafted with your company’s name and details and waits for your approval. Nothing counts as done until you approve it.
Hazard Communication (HazCom)
If the answer is yes to: Do you use anything that arrives with a safety data sheet — solvents, fuels, adhesives, strong cleaners?
Injury & Illness Prevention Program (IIPP)
In California
Bloodborne Pathogens Exposure Control Plan
For every clinic
Aerosol Transmissible Diseases Procedures (California)
In California
HIPAA Policies & Procedures
If the answer is yes to: Do you hold anyone’s medical or patient information — treatment, diagnoses, or insurance claims?
Respiratory Protection Program
If the answer is yes to: Does anyone wear a respirator — including a disposable N95 you tell them to wear?
PPE Assessment & Program
For every clinic
Business Associate Inventory
Covers: Business associate agreements on file for every vendor
If the answer is yes to: Do you hold anyone’s medical or patient information — treatment, diagnoses, or insurance claims?
HIPAA Breach Log
Covers: Breach log kept, and small breaches reported each year
If the answer is yes to: Do you hold anyone’s medical or patient information — treatment, diagnoses, or insurance claims?
Infection Prevention & Control Program
For every clinic
Fire Safety / Extinguisher Program
Covers: Fire safety / emergency action plan
For every clinic
Subcontractor Management
If the answer is yes to: Do you bring in subs or 1099 crews to do any part of the work?
Questions
Asked about medical clinics and practices.
What does a clinic have to keep up with?
17 rules apply to every clinic, starting with these: Bloodborne pathogens exposure control plan; Medical waste handled under your state’s rules; Safer needles and sharps evaluated this year. Arikano also recommends 7 practices for every clinic; those are its own guidance, not a law, and the page marks them that way. Another 18 rules and 2 practices Arikano recommends depend on how you work. Arikano asks first, with questions like “Do you hold anyone’s medical or patient information — treatment, diagnoses, or insurance claims?”, and adds them only when the answer is yes.
Which documents does Arikano draft for a clinic?
For every clinic: Bloodborne Pathogens Exposure Control Plan, PPE Assessment & Program, Infection Prevention & Control Program and Fire Safety / Extinguisher Program. 8 more depend on your state or on how you answer Arikano’s questions: Hazard Communication (HazCom), Injury & Illness Prevention Program (IIPP), Aerosol Transmissible Diseases Procedures (California), and 5 more. Each one is drafted with your company’s details and waits for your approval before it counts.
Has a professional reviewed these rules?
Not yet. None of the rules on this page has been reviewed by a credentialed professional so far. Each rule is listed with the regulation it comes from, so you can check it yourself. The practices Arikano recommends are marked as its own guidance, not a law.
Small businesses
Other lines of work.
- Restaurants25 rules · 7 documents Arikano drafts
- Hair and nail salons24 rules · 8 documents Arikano drafts
- Tattoo and piercing studios25 rules · 8 documents Arikano drafts
- Home health agencies46 rules · 13 documents Arikano drafts
- Cleaning and janitorial services36 rules · 18 documents Arikano drafts
- Staffing agencies35 rules · 18 documents Arikano drafts
- Auto repair shops30 rules · 8 documents Arikano drafts
- Manufacturers and machine shops50 rules · 19 documents Arikano drafts
Arikano does your compliance work. You approve it.
Start with your own clinic: what applies to you, what is missing, and the first drafts.