Compliance in Healthcare
Corporate Compliance

Nurse Staffing as National Performance Goal 12

Executive Oversight, Patient Safety, and Compliance Risk in 2026

Written by: Stacey Atkins, PhD, MSW, LMSW, CPC, CIGE 

Abstract 

Effective January 1, 2026, the Joint Commission elevated nurse staffing to National Performance Goal (NPG) 12, establishing staffing adequacy as a measurable accreditation and patient safety requirement. This article provides an executive- and auditor-facing analysis of NPG 12, examining regulatory intent, alignment with CMS Conditions of Participation, leadership accountability, and compliance risk. Practical guidance is offered to assist governing boards, executive leaders, and compliance professionals in operationalizing staffing oversight within enterprise risk, quality, and accreditation frameworks.

Introduction

Healthcare organizations entering 2026 face intensified scrutiny related to workforce adequacy, patient safety, and leadership accountability. Persistent staffing shortages, clinician burnout, and adverse patient outcomes have driven regulators and accrediting bodies to elevate staffing oversight as a core compliance priority. The Joint Commission’s designation of nurse staffing as National Performance Goal 12 represents a formal shift from treating staffing as an operational concern to recognizing it as a governance and accreditation imperative.

This shift requires healthcare leaders to reevaluate staffing policies, oversight structures, and performance measurement methodologies to ensure alignment with accreditation standards and federal regulatory expectations.

Regulatory Evolution and Rationale for NPG 12

Historically, nurse staffing requirements were embedded across leadership, human resources, and patient care standards and often evaluated indirectly through quality outcomes or adverse event investigations. However, evidence consistently demonstrates a direct relationship between inadequate nurse staffing and increased mortality, preventable harm, staff turnover, and regulatory findings.

By establishing staffing as NPG 12, the Joint Commission underscores the necessity of proactive oversight, data-driven decision-making, and executive accountability in maintaining safe staffing levels.

Scope and Applicability of NPG 12

NPG 12 applies broadly across hospital settings and clinical departments. Requirements extend beyond bedside nursing to include interdisciplinary clinical support essential to patient care. Key expectations include 24/7 registered nurse coverage, designated nurse executive oversight, and staffing models responsive to patient acuity, complexity, and care demands.

Organizations must demonstrate that staffing decisions are grounded in clinical need rather than solely financial or administrative considerations.

Executive and Governing Body Accountability

A defining feature of NPG 12 is its explicit emphasis on leadership oversight. Executive leaders and governing boards are expected to actively monitor staffing metrics, understand staffing-related risks, and ensure appropriate resource allocation. Surveyors may evaluate whether leadership receives regular staffing reports, responds to trends, and integrates staffing considerations into strategic planning.

Failure to demonstrate leadership engagement may result in accreditation findings related to leadership and governance standards, even in the absence of sentinel events.

Ethical and Professional Practice Implications

Beyond regulatory compliance, NPG 12 reinforces ethical obligations embedded in nursing professional standards and organizational duty of care. Chronic understaffing places nurses in ethically untenable positions, increasing moral distress and undermining professional judgment. Accrediting bodies increasingly assess whether organizations acknowledge and mitigate moral injury and burnout as patient safety risks.

Labor, Workforce, and Employment Law Intersections

NPG 12 intersects with labor law, whistleblower protections, and occupational safety standards. Inadequate staffing has been cited in retaliation claims, union grievances, and OSHA-related complaints alleging unsafe working conditions. Documentation demonstrating proactive staffing oversight may mitigate regulatory and legal exposure.

Alignment with CMS Conditions of Participation

NPG 12 closely aligns with CMS Conditions of Participation related to nursing services, patient rights, and quality assessment and performance improvement. Deficiencies may result in immediate jeopardy findings, amplifying compliance risk when accreditation and CMS enforcement converge.

Data-Driven Staffing Models and Performance Metrics

Compliance with NPG 12 requires data-driven staffing methodologies beyond static ratios. Surveyors may assess acuity-based tools, staffing variance analysis, and correlations between staffing levels and quality indicators. Organizations must demonstrate how staffing data informs corrective actions and continuous improvement.

Compliance with NPG 12 requires data-driven staffing methodologies beyond static nurse-to-patient ratios. Consistent with NPG.12.06.01 EPs 1–4, surveyors assess whether staffing adequacy is evaluated when undesirable patterns, trends, or variations in quality or safety are identified and whether findings are escalated through performance improvement and governance structures.

Real-world, setting-specific examples

Critical Access and Rural Hospitals:

A rural critical access hospital identified repeated patient flow delays and increased transfer times during seasonal surges. Although staffing numbers met minimum coverage requirements, leadership incorporated staffing effectiveness indicators into QAPI reviews, revealing gaps in skill mix during high-acuity presentations.

Corrective actions included cross-training nursing staff and implementing an escalation protocol requiring nurse executive review when acuity thresholds were exceeded. Findings and actions were documented and reported to governance, consistent with NPG.12.06.01 EP 3–4.

Psychiatric and Behavioral Health Settings:

In an inpatient psychiatric unit, analysis of restraint and seclusion events revealed correlations with staffing shortages during overnight shifts. Leadership included staffing adequacy in the root cause analysis, adjusted staffing models to ensure appropriate competency and coverage, and monitored outcomes through ongoing performance improvement activities. Annual staffing analysis results were provided to the patient safety program and governing body, aligning with NPG.12.06.01 EP 1–2.

Emergency and Mixed-Acuity Rural Facilities:

A rural emergency department experiencing increased left-without-being-seen rates evaluated staffing data alongside throughput and acuity metrics. Leadership implemented targeted staffing adjustments during peak hours and tracked improvements through QAPI dashboards. Staffing analyses and corrective actions were formally reviewed by executive leadership and incorporated into governance reports, demonstrating compliance with NPG.12.06.01 EP requirements.

These examples illustrate that staffing data must be actively analyzed, escalated, and integrated into performance improvement activities. Surveyors may evaluate whether leaders can articulate how staffing analyses influence corrective actions and how results are communicated to the hospital wide patient safety program and governing body.

Documentation, Evidence, and Surveyor Expectations

Surveyors may request evidence of leadership review, board discussion, action plans, and integration of staffing metrics into QAPI activities. Absence of such documentation may result in findings even when staffing ratios appear acceptable.

Compliance, Legal, and Operational Risk

Inadequate staffing presents compounded risk across accreditation, regulatory, legal, and operational domains. NPG 12 codifies staffing adequacy as an enterprise compliance risk requiring sustained mitigation strategies.

Survey Readiness and Best Practices

Survey readiness under NPG 12 requires staffing-focused mock surveys, compliance dashboards, and leadership preparedness to articulate how staffing decisions support patient safety and quality outcomes.

Conclusion

The elevation of nurse staffing to National Performance Goal 12 reflects a deliberate regulatory shift toward recognizing workforce adequacy as a foundational patient safety requirement rather than an operational afterthought. By formally linking staffing oversight to accreditation, performance improvement, and governance accountability, the Joint Commission has clarified expectations that safe staffing is inseparable from leadership responsibility and organizational culture.

Healthcare organizations entering 2026 must demonstrate that staffing adequacy is actively monitored, analyzed, and escalated through established quality and compliance structures. Static staffing policies and retrospective justification are no longer sufficient. Instead, leaders are expected to use data-driven methodologies, integrate staffing considerations into QAPI activities, and ensure governing bodies receive meaningful, actionable information related to staffing risk and performance.

Organizations that proactively embed staffing oversight into enterprise risk management, accreditation readiness, and strategic planning will be best positioned to mitigate regulatory exposure, support workforce sustainability, and achieve measurable improvements in patient safety outcomes. In this evolving regulatory environment, effective nurse staffing oversight is not only a compliance obligation—it is a defining indicator of organizational resilience, leadership effectiveness, and commitment to high-quality care in 2026 and beyond.

Appendix A: NPG 12 Compliance Crosswalk (Effective January 2026)

The following table maps National Performance Goal 12 Elements of Performance to corresponding sections of this article using Joint Commission survey-oriented language to support accreditation readiness.

NPG / EP

Joint Commission Expectation

Article Section(s)

Survey-Ready Language

NPG 12.01.01

Leadership ensures adequate number and mix of qualified staff based on patient needs.

Leadership ensures adequate number and mix of qualified staff based on patient needs.

Staffing decisions are based on patient acuity, complexity, and clinical demand rather than solely financial considerations.

NPG 12.02.01 EP 1–2

Nurse executive directs staffing plans and participates in governance decision-making.

Nurse executive directs staffing plans and participates in governance decision-making.

The nurse executive maintains authority and accountability for nursing staffing models in collaboration with senior leadership.

NPG 12.02.01 EP 4–5

Registered nursing oversight is available 24/7.

Registered nursing oversight is available 24/7.

Registered nursing services are available 24 hours per day, seven days per week, consistent with deemed-status requirements.

NPG 12.04.01

Staff practice within scope of licensure and competency requirements.

Staff practice within scope of licensure and competency requirements.

Staffing adequacy includes verification of licensure, scope of practice, supervision, and competency.

NPG 12.05.01

Staff receive education, training, and competency evaluation

Ethical and Professional Practice Implications

Workforce education and competency are treated as patient safety safeguards.

NPG 12.06.01 EP 1–4

Staffing is evaluated during QAPI and reported to leadership and governance.

Data-Driven Staffing Models; Documentation and Surveyor Expectations

Staffing adequacy is incorporated into performance improvement analyses and reported to executive leadership and governing bodies.


About the Author - Dr. Stacey R. Atkins, PhD, MSW, LMSW, CPC, CIGE

Dr. Atkins is a Compliance Specialist working as a team member in the Education Department of the American Institute of Healthcare Compliance. Her career spans leadership roles with the Office of the State Inspector General, Department of Behavioral Health and Developmental Services, and HRSA, among others.

References:

  • American Institute of Healthcare Compliance. (2026). January 2026 compliance newsletter.
  • The Joint Commission. (2025). National performance goals effective January 1, 2026: Hospital program.
  • Centers for Medicare & Medicaid Services. (2025). Medicare conditions of participation.

Copyright © 2026 American Institute of Healthcare Compliance All Rights Reserved

Share 0
Post 0
Share 0
Read More
Burnout, Boundaries, and Compliance
Leadership

Burnout – A Threat to Our Health Care System?

Written by: AIHC Blogger




The coronavirus disease 2019 (COVID-19) pandemic has generated a substantial increase in the workload of health care professionals leading to physical and mental distress among professionals resulting in an increase in burnout.


Burnout is defined as a work-related syndrome that affects normal life. It is caused by a prolonged response to chronic interpersonal stressors at work. According to an article in the National Library of Medicine entitled “Job Burnout,” burnout is a prolonged response to chronic emotional and interpersonal stressors on the job and is defined by the three dimensions of exhaustion, cynicism, and inefficacy.


A Vicious Cycle - The health care professionals experiencing burnout have a higher tendency to step aside which increases the loss of educated professionals, continuing the cycle of burnout within the profession.


The pandemic exacerbated many of the drivers of physician burnout. Due to COVID-related stress, 1 in 5 physicians intend to leave their current practice within 2 years.


This situation, if not addressed correctly and urgently, is likely to represent a threat to the health care system.


Shortages and maldistribution of health care workers, particularly of certain types of providers such as primary care providers, dentists, psychiatrists, and behavioral health providers, were a major concern even before the pandemic. This pandemic has exacerbated stressors in a health care system in which physician burnout, a response to workplace stress, is already epidemic, as cited by a JAMA article published back in 2018.


According to a recent study in Mayo Clinic Proceedings, burnout rate among physicians in the United States (U.S.) spiked dramatically during the first two years of the COVID-19 pandemic. According to the American Medical Association (AMA), researchers found that 2020 marked the end of a six-year period of decline in the overall rate of work-induced burnout among physicians. However, by the end of 2021, the physician burnout rate spiked to a new height that was greater than previously monitored by researchers, which happens to be after 21 months of the COVID-19 pandemic.


“The new physician burnout research builds on landmark studies conducted at regular intervals between 2011 and 2021 by researchers from the AMA, Mayo Clinic and Stanford Medicine. Together, these studies found the overall prevalence of burnout among U.S. physicians was 62.8% in 2021 compared with 38.2% in 2020, 43.9% in 2017, 54.4% in 2014, and 45.5% in 2011. Each study consistently demonstrated that the overall prevalence of occupational burnout among physicians were higher relative to the U.S. workforce.” 


According to the study published in JAMA Health Forum, Tracking Turnover Among Health Care Workers During the COVID-19 Pandemic, “Employment turnover among nearly all segments of the health care workforce has not yet fully recovered from the COVID-19 pandemic, with turnover rates among long-term care workers and physicians worsening over time.. . . An estimated 1.5 million health care workers lost employment in April 2020 as clinics temporarily closed and hospitals postponed surgeries and other procedures in an effort to limit the spread of the SARS-CoV-2 virus, the study says.”


The complexities of achieving and maintaining a compliant health care organization increases stress and burnout rates among health care administrators. One of the roles of the health care administrator is executive problem-solver. As caregivers burn out, the stress on administration increases.


Reducing burnout and improving a sense of feeling valued may allow health care organizations to better maintain their workforces post pandemic.


Resources

Read More
General Compliance

What Can Be Done to Address Elderly Addiction? 

Written by: Tasnova Malek, MD




This article outlines the serious problem of substance abuse and addiction among our elderly. It addresses many reasons an aging population may turn to alcohol and other substances to cope with the multitude of changes involved in getting older. With opioid pain management and the resulting opioid crisis, this subject is important to consider and we are reminded it is important to not only consider the physical health of our elderly population but also their mental health. This article was submitted courtesy of Dr. Malek for educational purpose only and should not be considered consulting or legal advice.



Aging leads to a multitude of changes each person must negotiate. It brings physiological, social, and psychological changes that can lead to the misuse of alcohol or other substances in an attempt to cope. The misuse can lead to delayed diagnosis— and help for the senior.


According to the Administration for Community Living, there were approximately 54 million people aged 65+ in 2019. Of seniors 60 years and older, about 17% live with some form of substance abuse, according to an article published by Michigan State University Extension. Although, alcohol misuse is the most common substance being abused by seniors. This is concerning to the medical community because studies designed to understand how alcohol and drugs impact an aging brain are few and far between.


What is known is that the aging brain is more sensitive to the introduction of chemicals as it struggles to break down and absorb alcohol or drugs. Alcohol metabolizes slower, which allows it to accumulate in the blood quicker, leading to intoxication without someone checking on the senior's consumption.


Memory issues (like forgetting to take or doubling up on medication) may lead to unintentional misuse, while other seniors use meds to cope with loss, declining health, grief, or changes to their living situations, among other issues. In addition, drug use/misuse may impair a senior’s coordination, reaction time, or judgment, aggravating an already risky situation. Some factors that put older adults at risk for substance abuse include:

  • A previous/current mental illness
  • Social isolation
  • Financial concerns due to income changes
  • Resistance to coping with a new living environment

How to Spot Addiction in the Elderly


Health issues are a natural part of the aging process. So, it can be challenging to know if memory issues, reduced focus and low energy are by-products of getting older or symptoms of an undiagnosed substance abuse issue. Consider these warning signs:

  • Sleeping or eating habits that change
  • Moodiness and irritability
  • Erratic behavior
  • Poor hygiene
  • Unexplained bruising

Types of Substance Abuse in the Elderly


Alcohol

Alcohol abuse is the most common type of substance abuse in those over 65 years old, with 10% of seniors reporting that they binge drink, which is defined as five or more drinks on the same occasion for men, and four or more drinks on the same occasion for women.


Prescription Medicine

Because chronic health issues tend to be part of the aging process, older adults are more often prescribed potentially addictive medicines compared to other age groups. And misuse of prescription meds may exacerbate existing mental health conditions.


Opioid Pain Medicines

Persistent pain is typically another challenging condition of growing old. In fact, opioid prescriptions for pain management in older adults increased ninefold from 1995 to 2010.


Illicit Drugs

These may include the use of cocaine, or heroin, among others.


What Can Be Done to Address Elderly Addiction?


Recent data highlights the essential need to screen middle-aged as well as older adults on a regular basis. But it must include health care providers' and administrators’ efforts to develop the tools needed to work with older adults facing a debilitating addiction.


Health care professionals often mistakenly confuse substance abuse symptoms with other conditions that happen as a part of the aging process. As such, research is required to create screening methods that help detect substance abuse in older adults, which often work best with the application of coexisting medical and psychiatric conditions.


The most effective treatment and support for older adults with substance addictive issues are to leverage and coordinate the varying types of services by medical personnel (primary care physicians and addiction specialists, etc.) and community advocacy groups that support the senior community.


How to Treat Substance Use in Older Adults


There are a variety of behavioral therapies and medications that have been successful in treating substance use disorders in older adults. As noted above, there is limited research regarding the most effective model of care, although data suggest that older patients tend to have better outcomes the longer they receive the required care.


The ideal model for addressing elderly addiction includes the following –

  • Regular diagnosis
  • The management of current chronic medical conditions
  • Re-building a network of support professionals
  • Improved medical service access
  • Enhanced case management capabilities
  • Evidence-based training strategies for professionals working with seniors

The Bottom Line


There are many therapies and medications that can be used to successfully treat substance use disorders, in which many seniors respond favorably. It is never too late to choose to quit abusing any kind of substance, which, in time, will improve the future of one’s health and quality of life.

 

Additional Resources:

_________________________________________________________

Tasnova Malek, MD, graduated from Bangladesh Medical College and practiced as a primary care physician for six years in Bangladesh. After moving to the USA, she worked at Emory University Hospital in Pulmonary and Critical Care Medicine and Hospital medicine research. During COVID-19, she worked as a crisis counselor on the Florida Corona Virus Emergency Response Team. Currently, she is working in the National Suicidal Prevention Center and works reviewing articles for Sunshine Behavioral Health. In addition, she has extensive research experience in medicine and psychiatry in the USA.
Read More
HIPAA Compliance
HIPAA

Allowing Workforce Members to Access Their Own Medical Records?

Written by: J. David Sims, CHITSP, CHMSP, Board Member of AIHC

J.David Sims is a Managing Partner at Security First IT, LLC; Speaker & HIPAA Instructor; Help Me with HIPAA Podcast Host; Contributor with the Federal HICP 405(d) Task Group & HIC-TCR Task Group; Founder & CEO of HIPAA for MSPs




The Health Insurance Portability & Accountability Act (HIPAA) has provisions to protect the contents of medical records. At a recent AIHC HIPAA training event, this topic came up. We would like to share some resources to the question that was asked. The information contained in this article is not consulting or legal advice and is provided for educational purposes only.


We have a problem with certain members of our workforce accessing their own medical records. These are people with fairly high levels of security and can access most records. I am a Certified HIPAA Compliance Officer (CHCO) through the AIHC organization and a compliance specialist. Our compliance committee wants the “industry standard” of this statement and evidence that this is industry standard. Do you have an idea of where I should look or any additional resource I can use to support that an employee should not access his/her own records? We want to institute a policy prohibiting this behavior.


Response

This is one of those areas that you won't find specifically mentioned (as HIPAA can't address every possible scenario). Therefore, we must look at what HIPAA does say and how does that fit into this scenario.


First, there should be a proper process for any patient (employee or otherwise) to request their medical records and have them presented within 30-days of request. Allowing employees to bypass this process could cause some issues. For example:

  • Do you have a current policy regarding restriction of access according to the employee’s work-related duties? Is accessing his/her own records outside of this policy? It most likely should be.
  • Will bypassing this process bypass documentation of the request, documentation of the records retrieval and documentation of the record controls?
  • Will they have access to notes that a "regular" patient would not and should not have access to?

Keep in mind that when I say documentation, I mean proof of the proper action that can stand up to an audit or investigation. So, if an entity is planning to allow this action, there should be a documented policy and procedure of how this will be handled.


Now, although it is possible that an employee can access and review their own medical records, let's look at two specific parts of HIPAA to see if this action will pass.

For uses of protected health information, the covered entity’s policies and procedures must identify the persons or classes of persons within the covered entity who need access to the information to carry out their job duties, the categories or types of protected health information needed, and conditions appropriate to such access.

  • I've underlined what I believe to be a key in this sentence. Would it be part of the employee's job duties to access their own records?

Let's assume the answer is "yes." Here's what else is given in this guidance: Where the entire medical record is necessary, the covered entity’s policies and procedures must state so explicitly and include a justification.


Another portion of the text identifies "non-routine disclosures or requests." I think a case could be made that an employee accessing their own records would be a non-routine disclosure. Here's what they say about this: “For non-routine disclosures and requests, covered entities must develop reasonable criteria for determining and limiting the disclosure or request to only the minimum amount of protected health information necessary to accomplish the purpose of a non-routine disclosure or request. Non-routine disclosures and requests must be reviewed on an individual basis in accordance with these criteria and limited accordingly.”


So, if your practice can make a case for this type of access, there must be a review of this activity every single time. I don't know about you, but it seems following the normal patient record request would be less strain on the practice at this point. But let's keep going.


We can wrap up with the Minimum Necessary Requirements portion. However, it is obvious that any PHI access has to be for the purposes of a job function or role. I do not see any way to interpret employee access to their own medical records as part of their job or role. But maybe some Covered Entities can make that case.

  • Next, let's look at Uses and Disclosures: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html

There are 3 distinct areas in which the use or disclosure of PHI is permitted... for treatment... for payment... for healthcare operations or “TPO” as we call it. If to this point a Covered Entity (CE) has determined that it is ok for an employee to access their own medical records, let's then pass this through the test of TPO.


The employee can access the PHI if the employee is involved in their own treatment. It would be unusual and rare that an employee is allowed to treat themselves and realize that Medicare and other insurances will not reimburse a provider when treating him/herself or a family member – so these circumstances cannot be billed. Aside from HIPAA, there can be other liabilities, risks, and legal problems if this is allowed.


The employee can access the PHI if the employee is involved in the payment activities. Allowing an employee to manage their own payments, adjustments, eligibility, coverage, claims, bills, justification of charges, utilization review, collections, etc., would likely not be recommended by most lawyers or accountants... not to mention insurers. In fact, it creates a “nightmare” from a compliance standpoint.


The employee can access the PHI if the employee is involved in Health Care Operations. “Health care operations” are certain administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business and to support the core functions of treatment and payment. These activities, which are limited to the activities listed in the definition of “health care operations” at 45 CFR 164.501.


Ok, now that we've taken our scenario and passed it through the filter of Minimum Necessary Requirements and TPO, your committee can determine how they would like to proceed with this decision.


Two final things I'll say about it:


First, if they choose to allow the action, I highly recommend a specific policy and procedure for it and a "mini" risk assessment to identify what the risks are to the CIA of the PHI and developing a risk management plan for things that are identified.


Second, this is such a low priority compliance matter that I would not necessarily spend a lot of time on it. I don't see OCR spending resources to investigate an employee accessing their own records, but I certainly can't say it won't happen. With all the activities and actions that carry a much higher likelihood and impact to the patient and the organization, this carries a very low probability of impact. Is the employee going to look at their records and then file a complaint with HHS that their PHI was improperly disclosed? People can be crazy, so maybe... lol.


This is one of those areas where technically you can make a case for or against it. Although, I see the case against it as being stronger. It really would be easier to just follow the same patient record request process for everyone. If you're a patient, you're a patient (even if you're an employee too). OCR investigators have a lot of leeway in their investigations so if this matter were to come up in an investigation, it can really depend on the investigator and whether they want to push this issue or make an example of the organization.


Personally, I just don't like taking the risk of potential issues that my organization can easily avoid. If there is a question of right or wrong, I'm going to lean toward what is easier to prove as being the right thing to do rather than fight like hell to make a case that the wrong thing was right.


Need HIPAA support? Contact J. David Sims, Managing Partner of Security First IT, LLC and Contributor with the Federal HICP 405(d) Task Group & HIC-TCR Task Group.

 

Want more great training information on HIPAA privacy and security compliance? Register for the online HIPAA course today! 


No classes to attend. Course materials are on-demand and available to you for 3 months. Training is for experienced health care consultants, business associates, HIPAA Privacy or Security Officers, IT Consultants, Practice Administrators, Office Managers, Compliance Officer Executives, and Administrators involved in developing and enforcing confidentiality and privacy and security as a Covered Entity or Business Associate.

Read More
General Compliance

Consent and COVID Testing of Employees

Written By: Compliance Blogger




This article addresses COVID testing and consent considerations for:  healthcare organizations, nursing homes and business associates or non-healthcare workplaces. This article is not intended as legal or consulting advice.  Employers are encouraged to collaborate with state, territorial, tribal and local health officials to determine whether and how to implement COVID testing strategies.


SARS-CoV-2 (COVID-19) continues to be a health risk to be mitigated by health care institutions and at the workplace. Employers paying for testing of employees should put procedures in place for rapid notification of results and establish appropriate measures based on testing results, including instructions regarding self-isolation and restrictions on workplace access.


An employer’s testing program (including the implementation of a testing protocol to test employees) may be complex and technical. Certain aspects of the testing program may be more relevant than others to an employee’s decision whether to accept an offered test. Obtain guidance from experts to assist your organization in navigating risk.


Business Associates (non-healthcare organizations)


The Center for Disease Control (CDC) provides guidance for non-healthcare workplaces, which would apply to most business associates who have partnered with a health care institution, such as legal or accounting firms; medical billing companies; IT managed service providers, etc. Workplace-based testing should not be conducted without the employee’s informed consent. Encourage and answer questions during the consent process.


Informed Consent


Informed consent requires disclosure, understanding, and free choice, and is necessary for an employee to act independently and make choices according to their values, goals, and preferences. Consult legal counsel when developing your informed consent form for employees.


To fully support employee decision-making and consent, employers should take the following measures when developing a testing program:

  • Ensure safeguards are in place to protect an employee’s privacy and confidentiality.
  • Provide complete and understandable information about how the employer’s testing program may impact employees’ lives, such as if a positive test result or declination to participate in testing may mean exclusion from work.
  • Explain any parts of the testing program an employee would consider especially important when deciding whether to participate. This involves explaining the key reasons that may guide their decision.
  • Provide information about the testing program in the employee’s preferred language using non-technical terms. Consider obtaining employee input on the readability of the information. Employers can use the CDC tool to create clear messages: https://www.cdc.gov/ccindex/
  • Encourage supervisors and co-workers to avoid pressuring employees to participate in testing.
  • The consent process is active information sharing between an employer or their representative and an employee, in which the employer discloses the information, answers questions to facilitate understanding, and promotes the employee’s free choice.

Disclosures for Non-healthcare Workplace Testing


Individuals tested are required to receive patient fact sheets as part of the test’s emergency use authorization (EUA):

A basic disclosure for COVID-19 should include the following elements to provide information to employees so they understand what is involved when consenting to the test, such as clear information on the manufacturer and name of the test, the type of test, the purpose of the test, the performance specifications of the test, any limitations associated with the test, who will pay for the test, how the test will be performed, how and when they will receive test results, and; how to understand what the results mean, actions associated with negative or positive results, the difference between testing for workplace screening versus for medical diagnosis, who will receive the results, how the results may be used, and any consequences for declining to be tested.


According to the Americans with Disabilities Act (ADA), when employers implement any mandatory testing of employees, it must be “job related and consistent with business necessity.” In the context of the COVID-19 pandemic, the U.S. EEOC notes that testing to determine if an employee has SARS-CoV-2 infection with an “accurate and reliable test” is permissible as a condition to enter the workplace because an employee with the virus will “pose a direct threat to the health of others.” EEOC notes that tests administered by employers which are consistent with current CDC guidance will meet the ADA’s business necessity standard. However, workplace-based testing should not be conducted without the employee’s consent.


Infection Control for Healthcare Facilities


The CDC has made recent changes to infection control guidance for all U.S. settings where healthcare is delivered, including home health. The updated healthcare infection prevention and control (IPC) recommendations as of September 10, 2021 are in response to the COVID-19 vaccination. Consult with legal counsel regarding disclosures and consents appropriate for your organization.


Healthcare Personnel (HCP): HCP refers to all paid and unpaid persons serving in healthcare settings who have the potential for direct or indirect exposure to patients or infectious materials, including body substances (e.g., blood, tissue, and specific body fluids); contaminated medical supplies, devices, and equipment; contaminated environmental surfaces; or contaminated air. HCP include, but are not limited to, emergency medical service personnel, nurses, nursing assistants, home healthcare personnel, physicians, technicians, therapists, phlebotomists, pharmacists, dental healthcare personnel, students and trainees, contractual staff not employed by the healthcare facility, and persons not directly involved in patient care, but who could be exposed to infectious agents that can be transmitted in the healthcare setting (e.g., clerical, dietary, environmental services, laundry, security, engineering and facilities management, administrative, billing, and volunteer personnel).


Healthcare settings refers to places where healthcare is delivered and includes, but is not limited to, acute care facilities, long-term acute-care facilities, inpatient rehabilitation facilities, nursing homes, home healthcare, vehicles where healthcare is delivered (e.g., mobile clinics), and outpatient facilities, such as dialysis centers, physician offices, dental offices, and others.


Source control is the use of respirators, well-fitting facemasks, or well-fitting cloth masks to cover a person’s mouth and nose to prevent spread of respiratory secretions when they are breathing, talking, sneezing, or coughing. Source control devices should not be placed on children under age 2, anyone who cannot wear one safely, such as someone who has a disability or an underlying medical condition that precludes wearing one safely, or anyone who is unconscious, incapacitated, or otherwise unable to remove their source control device without assistance. Face shields alone are not recommended for source control.


IPC Measures


Several of the IPC measures (e.g., use of source control, screening testing) are influenced by levels of SARS-CoV-2 transmission in the community. There are two different indicators in CDC’s COVID-19 Data Tracker which are used to determine the level of SARS-CoV-2 transmission for the county where the healthcare facility is located – Access the COVID Data Tracker:

If the two indicators suggest different transmission levels, the higher level is selected.


Source control and physical distancing (when physical distancing is feasible and will not interfere with provision of care) are recommended for everyone in a healthcare setting. This is particularly important for individuals, regardless of their vaccination status, who live or work in counties with substantial to high community transmission or who have:

  • Not been fully vaccinated; or
  • Suspected or confirmed SARS-CoV-2 infection or other respiratory infection (e.g., those with runny nose, cough, sneeze); or
  • Had close contact (patients and visitors) or a higher-risk exposure (HCP) with someone with SARS-CoV-2 infection for 14 days after their exposure, including those residing or working in areas of a healthcare facility experiencing SARS-CoV-2 transmission (i.e., outbreak); or
  • Moderate to severe immunocompromised; or
  • Otherwise had source control and physical distancing recommended by public health authorities.

Perform SARS-CoV-2 Testing


Anyone with even mild symptoms of COVID-19, regardless of vaccination status, should receive a viral test as soon as possible, according to the CDC recommendation.


Asymptomatic HCP with a higher-risk exposure and patients with close contact with someone with SARS-CoV-2 infection, regardless of vaccination status, should have a series of two viral tests for SARS-CoV-2 infection.

  • In these situations, testing is recommended immediately (but not earlier than 2 days after the exposure) and, if negative, again 5–7 days after the exposure.
  • Note - testing is not recommended for people who have had SARS-CoV-2 infection in the last 90 days if they remain asymptomatic; this is because some people may have detectable virus from their prior infection during this period (additional information is available here). Criteria for use of post-exposure prophylaxis are described elsewhere.

Expanded screening testing of asymptomatic HCP without known exposures was required in nursing homes and could be considered in other settings. It should be conducted as follows:

  • Fully vaccinated HCP may be exempt from expanded screening testing.
  • Guidance for expanded screening testing for nursing homes was described in the Interim Infection Prevention and Control Recommendations to Prevent SARS-CoV-2 Spread in Nursing Homes | CDC but is no longer available.

Performance of pre-procedure or pre-admission viral testing is at the discretion of the facility. The yield of this testing for identifying asymptomatic infection is likely low when performed on vaccinated individuals or those in counties with low or moderate transmission. However, these results might continue to be useful in some situations (e.g., when performing higher risk procedures on unvaccinated people) to inform the type of infection control precautions used (e.g., room assignment/cohorting, or PPE used).


Click Here for more detailed information about infection control guidance.

Read More