HIPAA, PHI, OSHA, CDC, ANSI & Universal Precautions

HIPAA, PHI, OSHA, CDC, ANSI & Universal Precautions

Quick Answer: Contact lens practice is governed by overlapping federal health and safety laws. HIPAA protects patient health information (PHI), including CL records, and requires patient consent, secure storage, access controls, and audit trails. OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030) applies to optical settings and mandates universal precautions — gloves, handwashing, surface/instrument disinfection, sharps disposal, and no mouth pipetting. The CDC issues infection-control guidance for contact lens practice (Acanthamoeba prevention, case replacement every 3 months, infection reporting). ANSI Z80.20 sets parameter tolerances for manufactured contact lenses (base curve, power, diameter, thickness, prism).

HIPAA: Protecting Patient Health Information

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes national standards for the protection of individually identifiable health information, called Protected Health Information (PHI). The HIPAA Privacy Rule (45 C.F.R. Parts 160 and 164) governs uses and disclosures of PHI, while the Security Rule governs electronic PHI (ePHI).

What Is PHI in a Contact Lens Practice?

PHI includes any health information that identifies the patient and relates to their health, care, or payment. In a contact lens practice, PHI explicitly includes:

• Patient demographics (name, address, phone, date of birth)
• Ocular health history and slit-lamp findings
• Contact lens parameters (base curve, power, diameter, modality)
• Fitting records and follow-up notes
• Diagnostic photos and topography maps
• Insurance and billing records
• Signed consent forms

Core HIPAA Obligations

Patient Right to Access Records

Patients have the right to inspect and obtain a copy of their own PHI, including their contact lens Rx and clinical records. The practice may charge a reasonable, cost-based fee for copies but may not withhold records for non-payment. This right overlaps with FCLCA's automatic-Rx requirement — the CL Rx must be provided to the patient regardless of any HIPAA request.

OSHA: Workplace Safety in Optical Settings

The Occupational Safety and Health Administration (OSHA) enforces workplace safety standards. The most relevant OSHA standard for contact lens practice is the Bloodborne Pathogens Standard (29 CFR 1910.1030), which applies to any workplace where employees can reasonably be expected to come into contact with blood or other potentially infectious materials (OPIM).

In an optical setting, OPIM includes tears, conjunctival secretions, and any drainage from an infected eye. While tears alone are not always classified as OPIM, any secretion containing visible blood, or from a patient with a known bloodborne infection, is. Standard contact lens practice treats all patient fluids as potentially infectious.

Exposure Control Plan

Each optical practice must maintain a written Exposure Control Plan that includes:

• A list of job classifications with occupational exposure
• Engineering controls (sharps containers, eye wash stations, automated instrument cleaning)
• Work practice controls (handwashing, no mouth pipetting, no eating in exam rooms)
• Personal protective equipment (PPE): gloves, gowns, face shields for splash-risk procedures
• Hepatitis B vaccination offered to at-risk employees at no cost
• Post-exposure evaluation and follow-up after any needlestick or mucosal exposure
• Recordkeeping of exposure incidents (OSHA 300 log)

Universal Precautions

Universal precautions (also called Standard Precautions) require that staff treat all patients and all body fluids as potentially infectious, regardless of the patient's known diagnosis. The core elements in a contact lens practice are:

1. Handwashing — before and after every patient encounter; soap and water or alcohol-based hand rub
2. Gloves — for any contact with tears, secretions, or mucous membranes; change between patients
3. Surface disinfection — slit-lamp chin rest, forehead rest, trial lenses, trial fitting kits between every patient using an EPA-registered disinfectant
4. Instrument disinfection — applanation tonometer tips, diagnostic lenses (e.g., trial RGP lenses, gonioscopy lenses) — disinfected or replaced between patients per CDC guidance
5. Sharps disposal — immediately into a puncture-resistant, labeled sharps container; never recap needles
6. No mouth pipetting — never use the mouth to draw up solutions or saline; use bulbs or automatic pipettors
7. No food, drink, or cosmetics in exam or lens-handling areas

When a Splash Occurs

If tears or secretions splash into the staff member's eye or onto non-intact skin, the practice must follow its post-exposure protocol: wash the area, document the exposure, and offer medical follow-up including testing for bloodborne pathogens if the source patient is known or consents to testing.

CDC Infection-Control Guidance for Contact Lenses

The Centers for Disease Control and Prevention (CDC) issues infection-control guidance specifically relevant to contact lens practice. Key CDC recommendations include:

• No tap water exposure to contact lenses or cases — Acanthamoeba keratitis is associated with tap water, well water, swimming, and showering in lenses
• Rub and rinse reusable lenses even if the solution bottle says 'no-rub' — the FDA rescinded the no-rub label in 2008
• Replace lens cases every 3 months — cases become contaminated with biofilm
• Never top off solution — discard old solution and refill fresh
• Do not sleep in daily-wear lenses — overnight wear is the largest single risk factor for microbial keratitis
• Report CL-related infections — serious infections (microbial keratitis, Acanthamoeba, Fusarium) should be reported to the FDA MedWatch program and through state surveillance

Acanthamoeba Prevention

Acanthamoeba keratitis is a devastating parasitic infection strongly associated with:

• Exposure to tap water, well water, hot tubs, swimming pools, or shower water while wearing lenses
• Use of non-sterile water (tap, distilled, bottled) to rinse lenses or cases
• Failure to disinfect lenses overnight

Counseling points: never expose lenses or cases to any non-sterile water; remove lenses before swimming or showering (or wear goggles and discard the lenses afterward); use only sterile multipurpose solution or hydrogen peroxide systems for cleaning and storage.

ANSI Z80 Standards: Lens Parameter Tolerances

The American National Standards Institute (ANSI) publishes the Z80 family of ophthalmic standards. ANSI Z80.20 is the standard for contact lenses and sets the parameter tolerances that manufacturers must meet and that prescribers use to evaluate whether a dispensed lens is acceptable.

Key ANSI Z80.20 Tolerances

These abbreviated ANSI Z80.20 values match the verification table in the instrumentation chapter: soft lenses have looser base-curve and power tolerances than RGPs. Always verify the ordered parameters before dispensing.

A lens that falls outside ANSI tolerances is considered out-of-spec and may be returned to the lab for replacement. Prescribers should verify parameters on every dispensed lens — especially RGP and custom soft designs — using a radiuscope, lensometer, and thickness gauge.

Exam Pearls

• HIPAA = privacy of PHI; OSHA = workplace safety; CDC = infection control; FDA = device regulation; FTC = consumer protection; ANSI = parameter tolerances
• Universal precautions: treat all patients and fluids as potentially infectious
• No mouth pipetting — a classic exam point
• CDC: never expose lenses to tap water (Acanthamoeba); replace cases every 3 months
• ANSI Z80.20 is the contact lens parameter tolerance standard
• Hepatitis B vaccination must be offered to at-risk staff at no cost under OSHA's Bloodborne Pathogens Standard