A medical courier in Texas is required by law to complete five certifications: HIPAA, Texas State Medical Privacy Laws (HB 300), and three OSHA certifications covering Bloodborne Pathogens, Personal Protective Equipment, and Hazard Communication. Each certification is mandated by a specific federal or state regulation, and none of them are optional recommendations left to individual company discretion.
Certification Requirements Summary
| Certification | Mandatory When | Regulation |
|---|---|---|
| HIPAA | Whenever a courier handles Protected Health Information on behalf of a healthcare provider or Business Associate | 45 CFR § 164.530(b) requires that “a covered entity must train all workforce members on the policies and procedures with respect to protected health information.” A related requirement appears at 45 CFR § 164.308(a)(5), the Security Rule’s security awareness and training standard. |
| Texas State Medical Privacy Laws (HB 300) | Whenever a courier in Texas handles Protected Health Information, regardless of federal HIPAA status | Texas Health and Safety Code § 181.101 requires that “a covered entity shall provide a training program… to each employee of the covered entity who has access to protected health information,” completed within 90 days of hire and repeated at least every two years. |
| OSHA Bloodborne Pathogens (BBP) | Whenever a courier has occupational exposure to blood or other potentially infectious materials | 29 CFR § 1910.1030(g)(2) requires that “the employer shall provide training… at the time of initial assignment… and at least annually thereafter.” |
| OSHA Personal Protective Equipment (PPE) | Whenever a courier is required to use protective equipment such as gloves | 29 CFR § 1910.132(f)(1) requires that “the employer shall provide training to each employee who is required by this section to use PPE,” covering when PPE is necessary and how to use it correctly. |
| OSHA Hazard Communication (HazCom) | Whenever a courier transports or handles hazardous chemicals | 29 CFR § 1910.1200(h)(1) requires that “employers shall provide employees with effective information and training on hazardous chemicals in their work area at the time of their initial assignment,” and whenever a new chemical hazard is introduced. |
HIPAA Certification
HIPAA certification confirms that a courier has been trained on the Privacy Rule, Security Rule, and Breach Notification Rule as they apply to handling Protected Health Information during pickup, transport, and delivery. This requirement applies to a courier acting as a HIPAA Business Associate on behalf of a covered healthcare provider, and it applies regardless of the size of the courier operation.
Texas State Medical Privacy Laws Certification
Texas Health and Safety Code Chapter 181, known as HB 300, extends privacy obligations beyond the federal HIPAA baseline by defining a covered entity broadly enough to include any individual or organization that assembles, collects, analyzes, uses, evaluates, stores, or transmits Protected Health Information in Texas. Certification in this area should also address the other Texas statutes that apply alongside HB 300, including the Texas Identity Theft Enforcement and Protection Act, the Texas Data Privacy and Security Act, the Texas Responsible AI Governance Act, SB 1188, and the Texas Medical Practice Act.
OSHA Bloodborne Pathogens Certification
Bloodborne Pathogens certification is required for a courier who handles blood or blood samples, covering Universal Precautions, exposure control procedures, and the steps to take following an exposure incident. This certification must be completed before an employee begins work involving exposure risk and repeated annually.
OSHA Personal Protective Equipment Certification
Personal Protective Equipment certification covers when PPE such as disposable gloves is necessary, how to properly put on, adjust, and remove it, and its limitations and proper disposal. An employee must be able to demonstrate an understanding of this training before being permitted to perform work requiring PPE.
OSHA Hazard Communication Certification
Hazard Communication certification covers chemical labeling, Safety Data Sheets, and how to recognize and respond to hazardous chemicals present in a courier’s work area. Training is required at the time of initial assignment and whenever a new chemical hazard not previously covered is introduced into the work area.
These five certifications address separate legal requirements and separate risks: HIPAA and Texas state privacy law govern how a courier handles Protected Health Information, while the three OSHA certifications govern the physical safety risks of transporting blood, chemicals, and other hazardous materials. A courier missing any one of these certifications has not met a specific, individually enforceable legal obligation, regardless of whether the remaining four have been completed.