Compliance & Safety

HIPAA (Health Insurance Portability and Accountability Act, 1996) establishes federal standards for protecting patient health information. The Privacy Rule protects any "individually identifiable health information" — called Protected Health Information (PHI) — in any format: electronic, paper, or oral.

The 18 HIPAA identifiers define what constitutes PHI. If any of these elements could be used alone or in combination to identify a patient, the information is PHI:

HIPAA applies to Covered Entities (hospitals, clinics, labs, health plans, health clearinghouses) and their Business Associates (vendors, IT companies, billing services that access PHI on behalf of covered entities).

HIPAA enforcement has progressively strengthened. The Office for Civil Rights (OCR) at HHS investigates complaints and can impose civil and criminal penalties:

Criminal penalties: Wrongful disclosure of PHI for personal gain or malicious harm: up to 10 years in prison and $250,000 in fines.

Real-world examples for phlebotomists:

• Texting a patient's test result to a physician on an unsecured personal cell phone = HIPAA violation
• Discussing a patient's diagnosis in a hospital elevator = HIPAA violation
• Looking up the records of a celebrity patient "out of curiosity" = HIPAA violation and grounds for termination
• Leaving a patient's requisition face-up at the nurse's station where other patients can see it = HIPAA violation

Patients have legally defined rights under HIPAA that affect how you interact with them:

• Right to access their records: Patients can request copies of their medical records and lab results. You should direct requests to your medical records department.
• Right to an accounting of disclosures: Patients can ask who their PHI was shared with outside treatment, payment, and operations.
• Right to request restrictions: Patients can ask to restrict certain uses of their PHI — though covered entities aren't always required to agree.
• Right to privacy: Patients can request private accommodations — e.g., requesting that their roommate not overhear their blood draw conversation.
• Right to request corrections: Patients can request amendments to their health records if they believe information is inaccurate.

Minimum necessary rule: HIPAA requires that PHI access and use be limited to the minimum necessary to accomplish the task. As a phlebotomist, you access the patient's name, DOB, MRN, and test orders. You do NOT need to access their billing records, their psychiatric history, or their HIV status to draw blood — accessing that information would violate the minimum necessary rule.

Scope of practice defines the procedures, processes, and actions that a healthcare professional is legally permitted to perform based on their specific license, certification, and training. For phlebotomists, scope is defined by state law, employer policy, and national certification standards.

Within phlebotomy scope (may perform):

• Venipuncture (routine and difficult — escalate after 2 attempts)
• Capillary/fingerstick and heelstick (neonatal) collection
• Urine specimen collection instructions and reception
• Blood culture collection using aseptic technique
• Specimen labeling, processing, and transport
• Point-of-care testing (if specifically trained and certified per facility policy)
• Specimen rejection (if criteria are not met)
• Patient identification and consent confirmation

Outside phlebotomy scope (do not perform without additional credentials):

• Interpreting laboratory results or explaining what a result means diagnostically
• Administering medications or IV solutions
• Performing arterial blood gas collection (ABG) — requires specialized training, usually RN or respiratory therapist
• Diagnosing or assessing clinical conditions
• Accessing patient records beyond what is needed for the draw
• Performing therapeutic phlebotomy without additional certification

Healthcare ethics is guided by four foundational principles, articulated by Beauchamp and Childress in Principles of Biomedical Ethics. These apply directly to phlebotomy practice:

1. Autonomy — Respect for the Patient's Right to Self-Determination
Every competent adult patient has the right to accept or refuse medical treatment, including specimen collection. If a patient refuses a blood draw, you must honor that refusal. Document it, notify the care team, and do not attempt to coerce or guilt the patient into agreeing. Informed consent for phlebotomy is typically implied (the patient extending their arm) but explicit for specialized collections like blood cultures from central lines or bone marrow aspirates.

2. Beneficence — Act in the Patient's Best Interest
Beyond just collecting blood, beneficence means noticing when a patient appears distressed beyond normal draw anxiety, ensuring the patient is positioned safely, and completing the collection in a way that minimizes discomfort. It also means recommending a colleague attempt when you've reached your skill limit on a difficult draw.

3. Non-Maleficence — Do No Harm
This is the oldest principle in medicine. In phlebotomy: use safety-engineered needles to prevent needlestick injury to yourself and others. Do not attempt multiple unsuccessful draws on a pediatric patient without escalating. Do not use a small-gauge needle at high pressure on a fragile elderly vein just to avoid getting a supervisor. The principle extends to the laboratory: if your improperly collected specimen produces an erroneous result, you have caused harm even if you didn't intend to.

4. Justice — Equitable Treatment of All Patients
Every patient receives the same quality and standard of care regardless of age, race, ethnicity, gender, sexual orientation, religion, insurance status, legal status, or diagnosis. A patient with HIV, a patient who is incarcerated, a patient with known drug use, or a patient who is uninsured all receive the same professional, respectful, technically precise care.

Documenting refusal: When a patient refuses a specimen collection, the standard documentation should include: date and time, patient name and ID, specific test(s) refused, patient's stated reason (if given), your response, and the name of the nurse or physician notified. Most EHR systems have a specific field for "patient refusal."

When a patient is confused or unable to consent: Cognitively impaired patients, unconscious patients, and pediatric patients have surrogates (legal guardians, healthcare proxies) who make decisions for them. You cannot collect from a patient who actively resists, even if the test is medically necessary — this crosses into battery (unlawful touching). Notify the care team and escalate.

When ethics and orders conflict: If a physician orders a test and the patient has a documented DNR (Do Not Resuscitate) or POLST (Physician Orders for Life-Sustaining Treatment), the DNR does not prohibit routine blood draws — it specifies what resuscitation measures to take if the patient codes. However, if the patient has an advance directive that specifically limits diagnostic testing, that must be honored.

Mandatory reporting: In Arizona, healthcare workers are mandatory reporters of suspected child abuse, elder abuse, and certain communicable diseases. If you observe signs of abuse during a draw (unexplained bruising inconsistent with the patient's age and condition), you are legally required to report this to your supervisor and the care team.

Quality control (QC) is the ongoing process of verifying that laboratory testing is performing within defined accuracy limits. Every testing procedure — even waived point-of-care tests — has QC requirements.

Why QC matters for phlebotomists: Phlebotomists operating glucometers, iStat analyzers, rapid flu tests, or other POC devices must run QC specimens (known-value controls) before patient testing and document results. If QC fails, patient testing must stop until the problem is identified and corrected.

Types of QC:

• Internal QC: Running control specimens (manufactured with known concentrations) — Low, Normal, and High values — to verify the assay is performing correctly across its reportable range
• External QC (Proficiency Testing): Receiving unknown specimens from a PT provider (CAP, CLIA), testing them, and reporting results — the PT organization then evaluates whether the results were acceptably accurate
• Delta checks: Comparison of a patient's current result to their previous result — a large unexpected change triggers a review to rule out specimen mislabeling or collection error

A phlebotomist's supply tray should be organized, complete, and ready before entering a patient's room:

Blood collection tubes have color-coded stoppers that indicate the additive inside. Knowing tube colors is essential for daily work:

In a phlebotomy context, biohazards are biological materials capable of causing disease. Blood and other potentially infectious materials (OPIM) are the primary concern under OSHA's Bloodborne Pathogens Standard.

Bloodborne pathogens of concern:

• HIV (Human Immunodeficiency Virus): Risk per needlestick from HIV+ source: ~0.3%. Risk from mucous membrane exposure: ~0.09%. Prophylaxis (PEP — post-exposure prophylaxis) must begin within 72 hours of exposure and is highly effective when started promptly.
• Hepatitis B (HBV): Risk per needlestick from HBV+ source: 6–30% (much higher than HIV). The vaccine-preventable nature makes this uniquely preventable. The 3-dose Hepatitis B vaccine series achieves protective antibody levels (anti-HBs ≥ 10 mIU/mL) in 90% of healthy adults.
• Hepatitis C (HCV): Risk per needlestick from HCV+ source: ~1.8%. No vaccine available. Direct-acting antiviral treatment (Harvoni, Epclusa) achieves 95%+ cure rates, but post-exposure prophylaxis with antivirals is not routinely recommended — monitor for seroconversion.

OPIM beyond blood: Semen, vaginal secretions, cerebrospinal fluid (CSF), synovial fluid, pleural fluid, pericardial fluid, peritoneal fluid, amniotic fluid, saliva in dental procedures, any body fluid visibly contaminated with blood, and unfixed human tissue are all regulated under OSHA's BBP Standard.

Sharps injuries are the most significant occupational hazard for phlebotomists. Safe disposal is non-negotiable and legally required.

Proper sharps disposal sequence:

1. Immediately after removing the needle from the patient (or before if using a safety device), activate the needle's safety mechanism — typically a push-button or slide shield
2. Drop the activated needle/assembly directly into the sharps container — do not carry it to the container; have the container within arm's reach
3. NEVER recap a needle two-handed after use — if one-handed recapping is absolutely necessary (extremely rare), use a scoop technique with one hand only
4. NEVER break, clip, or bend needles manually
5. NEVER overfill sharps containers (above the fill line)
6. NEVER reach into a sharps container to retrieve something

Container requirements: FDA-cleared sharps containers must be: closable, puncture-resistant, leakproof on sides and bottom, and labeled with the biohazard symbol. They must be disposed of as regulated medical waste through a licensed medical waste contractor.

Healthcare facilities generate multiple categories of regulated biohazardous waste, each with specific disposal requirements:

Biohazard labeling: The orange or orange-red biohazard symbol must be displayed on: all containers for regulated medical waste, all specimen containers transported between facilities, refrigerators and freezers storing blood or OPIM, and the specimen transport coolers used by phlebotomists in home health settings.

OSHA's Bloodborne Pathogens Standard requires every healthcare employer with employees at risk for occupational exposure to develop, implement, and annually update a written Exposure Control Plan (ECP).

What the ECP must contain:

• Exposure determination: A list of ALL job classifications where exposure to blood or OPIM is possible — without regard to PPE use (gloves don't change the risk determination)
• Implementation schedule: How and when OSHA requirements will be met (Hepatitis B vaccine timing, training schedule, etc.)
• Procedures for evaluating exposure incidents: Step-by-step process for what happens after a needlestick or blood exposure
• Sharps injury log: Record of all percutaneous injuries from contaminated sharps (maintained confidentially, reviewed annually to identify trends and improve device selection)
• Annual review documentation: Signed evidence that the plan was reviewed and updated annually, including documentation that frontline workers were consulted on safety device selection

As a phlebotomist, you should know: where your facility's ECP is located (typically on the employee intranet, in the lab manual, or with employee health), and what to do immediately if an exposure occurs. Not knowing is not an acceptable answer during a regulatory inspection.

Immediate response after a needlestick or blood/body fluid exposure can significantly reduce the risk of infection. The timeline matters enormously — especially for HIV post-exposure prophylaxis (PEP).

Immediate first aid (within minutes):

• Percutaneous injury (needlestick, cut): Remove gloves, wash vigorously with soap and water for ≥15 seconds. Do not squeeze or milk the wound. Do not apply antiseptics to the wound — this increases tissue damage without reducing infection risk.
• Mucous membrane/eye splash: Flush with copious amounts of water or saline for ≥15 minutes at an eyewash station. If contact lenses are worn, flush before and after removing them.
• Skin exposure (non-intact skin): Wash with soap and water for ≥15 seconds.

Reporting and medical evaluation (within hours):

1. Report to supervisor immediately — do not delay reporting to "see if symptoms develop"
2. Report to employee health or the emergency department if employee health is not available
3. Provide information about the source patient (if known) so the source can be tested for HIV, HBV, and HCV (with patient consent or under state emergency testing laws)
4. Your baseline blood is drawn to document your pre-exposure status
5. HIV PEP decision: If source is HIV+ or high-risk unknown, PEP should begin within 2 hours (absolutely within 72 hours). After 72 hours, PEP is not effective.

Standard precautions (formerly called "universal precautions") apply to every patient, every encounter, every time — regardless of known diagnosis. The fundamental assumption is that all blood, body fluids, secretions, excretions (except sweat), non-intact skin, and mucous membranes may contain infectious agents.

Standard precautions require:

• Hand hygiene before and after every patient encounter (even if gloves were worn)
• Gloves for any contact with blood, body fluids, mucous membranes, or non-intact skin
• Mask + eye protection or face shield when splashes or sprays of blood/body fluids are anticipated
• Gown when clothing contact with blood or body fluids is anticipated
• Safe injection practices — one needle per patient, no reuse
• Respiratory hygiene/cough etiquette — applies to patients and healthcare workers alike
• Safe sharps handling — no two-handed recap, immediate disposal

Standard precautions are non-negotiable. You wear gloves for every blood draw. Not because you assume every patient has HIV — because you operate in an environment where infectious materials are present and a patient's full infection status may be unknown.

Contact precautions are added ABOVE standard precautions when a patient has a known or suspected organism spread by direct or indirect contact.

Common indications:

• MRSA (Methicillin-resistant Staphylococcus aureus) — colonization or active infection
• VRE (Vancomycin-resistant Enterococcus)
• C. difficile (C. diff) — requires special consideration: alcohol-based hand rub does NOT kill C. diff spores — must use soap and water
• Wound infections with draining secretions
• Scabies, lice

Required PPE for contact precautions: Gown and gloves before entering the room. Remove gown and gloves inside the room before exiting. Perform hand hygiene immediately after removing PPE at the doorway.

Equipment precautions: Phlebotomy supplies entering a contact precaution room should be single-use or must be disinfected before returning to your supply cart. Leave your tray outside the room if possible and bring only what you need.

Droplet precautions — for organisms transmitted by large respiratory droplets (travel <3 feet, settle quickly):

• Indications: Influenza, COVID-19 (plus airborne), pertussis, mumps, rubella, RSV, meningococcal meningitis
• Required: Surgical mask before entering room (within 3 feet of patient)
• Patient transport: Patient wears mask when being transported

Airborne precautions — for organisms transmitted by small particles that remain suspended in air for long distances and times:

• Indications: Tuberculosis (TB), measles (rubeola), varicella (chickenpox), disseminated zoster, COVID-19 (per current guidance)
• Required: N95 respirator (fit-tested) before entering the room; AIIR (Airborne Infection Isolation Room) — negative pressure room
• N95 vs surgical mask: N95 filters ≥95% of airborne particles. Surgical masks are not adequate for airborne precautions — they are fluid-resistant but not particulate-filtering.

Protective environment (PE) — for severely immunocompromised patients (hematology/oncology transplant units):

• HEPA-filtered air, positive pressure rooms (prevents outside air from entering)
• Phlebotomists entering PE rooms must follow strict protocols — no artificial nails, fresh gloves, sometimes gown/mask requirements

Gloves are the most commonly used PPE in phlebotomy and the first line of defense against bloodborne pathogen exposure through skin contact.

Glove materials:

• Nitrile (preferred): Latex-free, excellent chemical resistance, good tactile sensitivity, durable. Standard choice in most healthcare settings due to latex allergy concerns.
• Latex: Natural rubber. Good elasticity and tactile feel — but increasingly avoided due to latex allergy prevalence (1–6% of healthcare workers have latex sensitization). Never use on a patient with a known latex allergy.
• Vinyl: Least protective — lower puncture resistance, looser fit, more likely to tear. Acceptable for non-invasive tasks but not ideal for venipuncture.

Glove use rules:

• New gloves for every patient — gloves are single-use, not changed between draws on the same patient if truly continuous contact
• Change gloves if a tear or puncture occurs mid-procedure
• Do NOT wash and reuse gloves — washing degrades the material and creates microperforations
• Gloves do not eliminate exposure risk — they reduce it. A needlestick through a glove delivers approximately 50% less blood volume than direct skin contact, but infectious inoculum can still be transmitted
• After removal: peel off turning inside-out to contain contamination, dispose in biohazard trash if visibly contaminated

Eye protection (safety goggles, face shield, or safety glasses with side shields): Required when splashing of blood or body fluids to the eyes, nose, or mouth is anticipated. In phlebotomy, this is most relevant during:

• Blood culture collection (bottle puncture can spray)
• Arterial line access (arterial pressure means rapid blood flow)
• Patients who are combative or agitated (increased movement = increased splash risk)
• Any procedure where tube might be under pressure

Gowns: Fluid-resistant gowns protect clothing from contamination. Required for contact precaution patients and any situation where clothing contamination is anticipated. Non-sterile disposable gowns are standard for phlebotomy. Remove by rolling outside (contaminated surface) inward. Do not shake off the gown — this disperses contamination.

Donning (putting on) order: Gown → Mask/Respirator → Goggles/Face Shield → Gloves

Doffing (removing) order: Gloves → Goggles/Face Shield → Gown → Mask/Respirator — Hand hygiene between each step

Hand hygiene is the single most important intervention for preventing healthcare-associated infections (HAIs). The evidence is unambiguous and has been known since Ignaz Semmelweis demonstrated in 1847 that physician handwashing between autopsy work and delivering babies reduced maternal mortality from 10–35% to under 2%. Today, HAIs affect approximately 1.7 million patients annually in the U.S. and contribute to 99,000 deaths per year — most of which are preventable.

For phlebotomists specifically, hand hygiene is critical because you are a mobile healthcare worker touching dozens of patients, their equipment, and shared surfaces in a single shift. Your hands are the vector through which hospital-acquired pathogens (MRSA, C. diff, Klebsiella, CRE) travel from room to room.

The WHO (World Health Organization) 5 Moments of Hand Hygiene defines the specific points in patient care requiring hand hygiene:

In practice for phlebotomy: You should perform hand hygiene a minimum of twice per patient encounter — before touching the patient (Moment 1) and after removing your gloves and leaving the room/completing the encounter (Moments 3+4). During the encounter, if you touch a non-sterile surface and then need to touch the venipuncture site, perform hand hygiene or change gloves.

Alcohol-Based Hand Rub (ABHR — hand sanitizer): Preferred method for most hand hygiene in healthcare when hands are not visibly soiled. ABHR is more effective than soap and water against most pathogens, faster to use, less irritating to skin, and does not require a sink.

Soap and water required (ABHR is NOT sufficient) for:

• Visible soil, blood, or body fluids on hands — ABHR cannot effectively penetrate visible organic material
• Clostridium difficile (C. diff): C. diff forms heat- and alcohol-resistant spores that are NOT killed by ABHR. Soap and water physically removes spores from the hands. This is why C. diff contact precaution rooms require soap and water at exit.
• Norovirus outbreaks: Similar to C. diff — soap and water is more effective at removing norovirus from hands
• Before eating and after using the restroom

Proper ABHR technique:

1. Apply 3–5 mL to palm of one hand
2. Rub hands together — cover all surfaces including fingernails, thumb webs, between fingers, and wrists
3. Continue rubbing until hands are dry (~20–30 seconds)
4. Do NOT wipe or rinse — the active alcohol contact time is necessary

Proper soap and water technique: Wet hands → apply soap → scrub all surfaces vigorously for at least 15 seconds → rinse under running water → dry with single-use paper towel → turn off faucet with the paper towel (not clean hands).

Understanding how infections spread allows phlebotomists to actively interrupt transmission. The Chain of Infection has 6 links — removing any link breaks the chain:

Blood cultures are among the most clinically important specimens phlebotomists collect — and the ones most vulnerable to false positives from contamination. A contaminated blood culture (skin flora like coagulase-negative Staph, Bacillus, Propionibacterium introduced during collection) leads to days of unnecessary antibiotic treatment, extended hospitalization, and significant cost.

Blood culture contamination rates: National benchmark is <3%. Rates above 3% indicate a site preparation problem. At 10%+, the clinical value of blood cultures is severely compromised.

Aseptic technique for blood cultures:

1. Perform hand hygiene
2. Apply tourniquet, identify and palpate target vein — mark with gloved finger tip if needed
3. Remove tourniquet after site identified
4. Cleanse skin:
   • 70% isopropyl alcohol wipe — 30-second friction scrub, allow to dry
   • Then: 1–2% chlorhexidine gluconate (preferred) OR povidone-iodine — 30-second friction scrub, allow to dry completely (30–60 seconds for chlorhexidine; 60–90 seconds for povidone-iodine)
5. Do not re-palpate the cleaned site after disinfection (or if you must, use a sterile gloved finger)
6. Clean bottle tops with 70% isopropyl alcohol, allow to dry
7. Perform venipuncture without touching the clean site
8. Collect aerobic bottle first (fill to volume mark, typically 8–10 mL each), then anaerobic bottle

Accurate documentation is both a professional and legal obligation. In the lab and in patient care, "if it wasn't documented, it didn't happen" is the governing principle.

What phlebotomists must document:

• Collection time: The exact time the specimen was collected — not the time you entered the room, not the time you labeled it. The timestamp on a specimen drives timed test interpretation, therapeutic drug level validity, and turnaround time compliance metrics.
• Collector identification: Your full name or employee ID must be on every specimen. This is both an accountability measure and a requirement for tracing errors.
• Collection site: When the antecubital vein is not used, document the alternative site. When a patient has a restriction (AV fistula, lymphedema), document the restriction and why the alternative was chosen.
• Difficulties: Document the number of attempts, any patient complications (hematoma, syncope), any patient refusals, and any specimen quality issues (hemolysis, lipemia, icterus) you noted.
• QC results: If you perform POC testing, QC results must be logged with the time, your ID, the control lot number, and the result (pass/fail).

Correction of errors in paper records: Draw a single line through the error, write your initials and date, and write the correct information. NEVER use white-out or obliterate an entry — this creates a legal problem (alteration of medical records). In EHR systems, use the amendment/addendum function rather than deleting entries.

Healthcare organizations use incident reporting (also called event reporting or occurrence reporting) to track adverse events, near-misses, and sentinel events. Participating in this system is a professional and ethical obligation.

What to report:

• Needlestick injuries and blood/body fluid exposures
• Specimen mislabeling — even near-misses that were caught before the specimen was analyzed
• Patient falls or adverse events during draws (syncope, patient hitting floor)
• Specimen collected from the wrong patient (even if caught before processing)
• Incorrect tube collected, tube collected in wrong order, inadequate volume
• Equipment failure or malfunction
• Any situation where patient safety was or could have been compromised

Near-miss reporting culture: Organizations with strong safety cultures actively encourage near-miss reporting. A near-miss is a potential error that was caught before it reached the patient — these are the most valuable safety learning opportunities. Reporting a near-miss is not self-incrimination; it is professional accountability.

Do Not Resuscitate (DNR) orders and POLST (Physician Orders for Life-Sustaining Treatment) are legal documents that specify what life-sustaining interventions a patient does or does not want. Understanding their scope prevents both under-treatment and over-treatment.

What a DNR means:

• If the patient's heart stops (cardiac arrest) or they stop breathing, do not perform CPR, defibrillation, or intubation
• It does NOT mean: stop all treatment, stop drawing blood, stop giving medications for comfort, or provide less thorough care
• A patient with a DNR still needs their morning labs drawn, their IV access maintained, and their pain managed

POLST differences: POLST is broader than DNR — it can also specify whether the patient wants hospitalization, IV hydration, artificial nutrition, and comfort measures. Review the POLST if visible in the chart — it doesn't restrict routine phlebotomy unless explicitly stated.

DNR bands: Many facilities use colored wristbands to indicate DNR status (often purple). Be aware of your facility's band color coding — colors vary by system. A patient with a DNR band gets the same quality draw as any other patient.

If a patient codes during a draw: Even if you know the patient has a DNR, you are not the decision-maker for code response — call the response team immediately and let them manage the situation per the documented orders. Do not attempt to manage a cardiac arrest as a phlebotomist.