4.3 EPA, OSHA, HIPAA, FDA, and USP Standards

NRC medical-use rules and DOT shipping (Sections 4.1–4.2) do not cover every Domain II question. Patients still bleed, chemicals still splash, records still identify people, and radiopharmaceuticals are still drugs prepared under pharmacy-quality expectations. Technologists also work under EPA, OSHA, HIPAA, FDA, and USP frameworks—implemented through hospital SOPs and accreditation.

EPA — Environmental Waste and Releases

The Environmental Protection Agency (EPA) addresses environmental protection for radioactive material pathways that leave simple “inside the hot lab” control:

• Waste leaving institutional control must use authorized routes (licensed burial, approved incineration, permitted effluent)—not improvisation.
• Air and water effluents (stacks, sewers) face concentration and dose criteria tied to environmental goals and NRC license conditions.
• “Dilute and dump” without calculation and documentation fails both NRC and environmental expectations.

For NMTs: respect decay-in-storage vs brokered waste, never bypass xenon/iodine trap systems, and escalate unusual environmental releases to the RSO. You need not recite every EPA numeric table, but you must know who owns the problem when waste or effluent leaves incorrectly.

OSHA — Worker Safety Beyond Badges

OSHA protects employees from workplace hazards beyond pure radiation dosimetry:

Bloodborne pathogen programs include an exposure control plan, standard precautions, hepatitis B vaccination offers, post-exposure evaluation, and training. A needlestick after blood labeling is an OSHA exposure incident (and infection-control event)—not only a radiation survey issue, even if the blood was radioactive.

PPE is task-based: gloves for every unsealed manipulation; gown when splash is likely; eye protection when drawing/spiking under pressure. Syringe shields cut dose; gloves address contamination and biohazard. SDS access is expected; “we only worry about millicuries” fails after a reagent injury.

HIPAA — Privacy and Security

HIPAA Privacy and Security Rules govern protected health information (PHI) in nuclear medicine:

• Names, MRNs, birth dates on requisitions and dose labels
• Images, reports, and worksheets
• Hallway conversations and visible workstation screens
• Schedules left on public counters

Privacy Rule: use/disclose only the minimum necessary PHI for treatment, payment, operations, or other permitted purposes; verify identity before releasing results.
Security Rule: protect electronic PHI with access controls, unique logins, workstation policies, and safeguards against lost media or unlocked PACS stations.

Classic failures: posting a patient’s diagnosis on social media; elevator therapy gossip; emailing identifiable images to a personal account; leaving a WD printout on a public printer. Radiation safety culture and privacy culture are parallel duties.

FDA — Drugs, Devices, and Product Quality

The FDA regulates radiopharmaceuticals as drugs (and many related devices):

• Commercial diagnostic and therapeutic RPs are approved products with labeled indications, activity ranges, and handling.
• Investigational agents require IND/protocol pathways—do not freestyle unapproved mixtures.
• PET drugs and institutional production carry manufacturing quality expectations: identity, purity, sterility, documentation.
• Ancillary drugs (e.g., pharmacologic stress agents) remain FDA-regulated medications.
• Imaging equipment may fall under device rules and manufacturer QC expectations.

FDA does not replace NRC licensing, but perfect wipe logs do not excuse an expired, misbranded, or improperly compounded product.

USP <797> and USP <825>

USP <797> sets sterile compounding standards to protect patients from microbial contamination, endotoxins, and dosing errors (hygiene, engineering controls, beyond-use dating, aseptic technique).

USP <825> covers radiopharmaceuticals—preparation, compounding, dispensing, and repackaging, recognizing shielding, dose calibrators, and decay time pressure:

<825> is RP-focused; <797> is the broader sterile backbone. Sites map both into nuclear pharmacy SOPs. Kit reconstitution, dilutions, and blood labeling are compounding-adjacent work—not “just injecting.”

Institutional SOPs and Accreditation

Regulations state what must be achieved; SOPs state how this hospital does it—spills, WD checks, package receipt, generators, pregnancy screening, PPE, HIPAA workstations, waste. Inspectors (NRC/agreement state, pharmacy boards, The Joint Commission, ACR/IAC where applicable) test whether practice matches procedure.

Expect documented competencies, annual radiation safety training, therapy timeouts, multi-channel incident reporting (radiation, medication, HIPAA, sharps), and equipment QC aligned with accrediting checklists. When habit conflicts with SOP or license conditions, written procedure wins until formally revised.

One Scenario, Many Agencies

Preparing a Tc-99m labeled blood product engages:

• NRC/license: possession, surveys, waste, personnel dose
• USP <825>/<797>: aseptic labeling and documentation
• FDA: component/product quality expectations
• OSHA: bloodborne PPE and sharps
• HIPAA: identifiers on labels and worksheets
• EPA/NRC waste rules: contaminated blood waste disposition
• SOP/accreditation: the checklist you sign

Exam Hooks

• Needlestick during RBC labeling → OSHA bloodborne (+ radiation survey if activity present).
• PHI on an unlocked public workstation → HIPAA.
• Expired compounded sterile RP administered → USP/FDA quality issue.
• Unauthorized sewer disposal of concentrated long-lived waste → EPA/NRC environmental violation.
• Skipping the hospital therapy checklist that implements the WD → SOP failure that can become a medical event.