Healthcare Onboarding Best Practices for Small Practices
Healthcare onboarding for small practices: HIPAA training, credential verification, OSHA compliance, and a 90-day timeline. No HR department required.
When a medical practice hires a new employee, two clocks start running simultaneously. The first is the standard onboarding clock: get them productive, integrated, and comfortable. The second is the compliance clock, and it has hard deadlines that do not care how busy the practice is or whether there is an HR department to manage them.
At a small medical, dental, or therapy practice, these two clocks are usually managed by one person: the office manager, who is also doing scheduling, billing, patient intake, and answering phones.
The compliance piece is where things break down, not because people are careless, but because the requirements are specific, the documentation expectations are high, and no one ever gave them a clear checklist for healthcare specifically. That gap is what this guide addresses.
I build HR software for small businesses, and my advice to any practice owner is to start the compliance clock before the new hire's first shift, not during it.
- Sign the offer letter
- Sign the employee handbook
- Workplace Safety course
Why Healthcare Onboarding Fails at Small Practices
The failure pattern at small practices is consistent: a new hire starts on Monday, the office manager walks them through the schedule and introduces them to the team, and by Tuesday they are in the system, seeing patients, and handling records.
The HIPAA (Health Insurance Portability and Accountability Act) training happens at some point in the next few weeks when there is time. The credential verification was done informally. The OSHA (Occupational Safety and Health Administration) training gets mentioned but never documented.
This is not negligence. It is the result of one person managing a regulated onboarding process without a framework designed for that scale. I built FirstHR partly around this problem: the checklists, signed acknowledgments, and training records behind the compliance tracking that office managers currently do manually in spreadsheets, or not at all.
The stakes in healthcare are different from general business. An undertrained new hire in a software company might miss a deadline. An undertrained new hire in a medical practice might harm a patient, access records without authorization, or create a reportable HIPAA breach in their first week. The compliance requirements exist because these risks are real, and regulators audit small practices the same way they audit hospital systems.
Weak onboarding also shows up as early turnover. Research reported by SHRM (2017) shows that up to 20% of all employee turnover happens within the first 45 days, and Gallup (2021) found that only 29% of new hires felt fully prepared and supported to excel in their role after onboarding.
Each of those exits is a hire you pay for twice. According to SHRM's 2025 benchmarking survey, the average cost per hire for nonexecutive roles was $5,475 in recruiting spend alone, before the soft costs and before the clinical replacement timeline, which in a small practice means weeks of coverage gaps.
Nick Anisimov, FirstHR founderWhat Makes Healthcare Onboarding Different
Healthcare onboarding is general onboarding plus six compliance layers that do not exist anywhere else. Each layer has its own documentation requirement, its own timeline, and its own regulatory body. Skipping any of them creates exposure.
The key difference between healthcare onboarding and every other type: several of these steps belong before the employee has patient contact, some because the rules require it and the rest because it is sound practice.
You cannot train HIPAA on week three when the new hire has been documenting in the EMR since Day 2. You cannot verify a license after someone has already been practicing. The sequence matters as much as the content.
The Complete Healthcare Onboarding Timeline: Day -30 to Day 90
This timeline assumes a small practice where the office manager handles onboarding without dedicated HR support. Adapt the specific tasks to your practice type and state requirements, but keep the sequence intact. The compliance steps are ordered by regulatory requirement, not convenience.
Two items in it carry federal deadlines. Form I-9 Section 1 is due by the first day of employment and Section 2 within three business days of that day, per the USCIS employer handbook. New hire reporting to the state directory has a federal ceiling of 20 days after hire, and plenty of states require it sooner.
The most important element of this timeline is the pre-hire phase. Everything from credential verification to drug screening should be completed before Day 1, not during the first week. When credential verification happens in parallel with someone already working, you create a window of exposure: a new hire practicing under an unverified license, or accessing PHI before their background check clears.
10 Healthcare Onboarding Best Practices for Small Practices
These practices are ordered by compliance priority. The first three are non-negotiable. The remaining seven are what set practices with strong onboarding apart from those that lose new hires in the first 90 days.
The common thread across all ten: documentation. In healthcare, an undocumented training session legally did not happen. When a state auditor or an investigator from the Office for Civil Rights (OCR) asks for evidence of HIPAA training, verbal assurance is not evidence. Dates, signatures, and training completion records are the only proof that holds up.
Healthcare Compliance Checklist: HIPAA, OSHA, and Beyond
This checklist covers the minimum required training content for each compliance area. Use it as a training outline and a documentation checklist. Every item should have a completion date and employee signature, filed in a compliance file that sits beside the personnel file. The OSHA bloodborne pathogens standard is the authoritative source for the BBP training requirements below.
Two points on HIPAA penalties every small practice owner should understand. First, the amounts are inflation-adjusted and far above the numbers most people remember. The current HHS penalty table starts at $145 per violation, where the practice could not reasonably have known, and the three lower tiers top out at $73,011 per violation.
Willful neglect, a conscious, intentional failure or reckless indifference to the duty to comply, has a tier of its own when it is not corrected within 30 days of when the practice knew, or should have known, about it. It starts at $73,011 per violation and can reach $2,190,294, the same amount that caps a calendar year of repeats of one requirement.
Second, size shapes the amount, not the rules. A two-provider practice faces the same regulatory framework as a 500-bed hospital, but 45 CFR 160.408 tells the HHS Secretary to weigh the size and financial condition of the entity when setting a penalty. Plan around the training records that keep you out of the table, not around that discretion.
Credential Verification for Small Practices Without a Credentialing Department
Large healthcare systems have credentialing departments. Small practices have whoever is available to run searches online. The good news: most credential verification is free and can be done without a vendor. The requirement is knowing where to look and doing it consistently before every hire.
| Credential | How to Verify | Timing | Re-verification |
|---|---|---|---|
| State professional license | State licensing board website (free) | Before Day 1 | At each state board renewal cycle |
| NPI (providers, nurses, some allied health) | NPPES NPI Registry: npiregistry.cms.hhs.gov (free) | Before Day 1 | At hire only; NPI does not expire |
| DEA registration (prescribers only) | DEA Diversion Control website (free; a DEA registrant must log in) | Before Day 1 | Every 3 years at renewal |
| OIG exclusion list | exclusions.oig.hhs.gov (free) | Before Day 1 | Monthly is best practice |
| GSA SAM exclusion list | sam.gov (free) | Before Day 1 | Monthly is best practice |
| CPR/BLS certification | Inspect the card from the American Heart Association (AHA) or American Red Cross (ARC) | Before Day 1 | Every 2 years (AHA cards expire at the end of the issue month) |
| Background check | Third-party vendor (cost varies) | Before Day 1 | At hire; periodic re-check per state rule |
| Drug screening | Third-party vendor or onsite kit | Pre-employment | Random or post-incident per practice policy |
| Immunization records | Request from employee directly | Before Day 1 | Flu annually; TB test per state rule |
| Malpractice history (providers) | NPDB: npdb.hrsa.gov (fee; eligible practices only, otherwise a self-query from the provider) | Before Day 1 | At hire (query or self-query) |
Three items on this list deserve special attention. First, the OIG and GSA exclusion lists. An excluded individual can receive no payment from federal health care programs for anything they furnish, order, or prescribe, and the OIG warns that anyone who hires someone on the list may face civil monetary penalties. The search is free. Run it before every hire and routinely after.
Second, state license verification. Verify the license directly through the state board, not through a document the employee provides. Licenses can be revoked or restricted without the employee disclosing it. If you provide telehealth across state lines, verify each state license separately.
Third, the NPDB (National Practitioner Data Bank). It contains malpractice payment history, adverse action reports, and Medicare/Medicaid exclusion reports for physicians, dentists, nurses, and other practitioners. Access requires a fee. Small practices are not required to query it, and a group practice may query only if it follows a formal peer review process.
A practice that does not qualify can ask the provider for a self-query, which practitioners run on their own record and may share with anyone they choose. For practices hiring providers, one route or the other is worth the cost.
Running the searches is half the work. The other half is a record showing who ran which search, on what date, and what it returned, because that record is what an auditor asks for. Two sheets hold it: one line per credential at hire, and one line per item that expires.
| A | B | C | D | E | F | G | H | I | J | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Employee | Role | Credential | Number or identifier | Verified where (primary source) | Verified by | Date verified | Result | Expires | Copy filed in the compliance file |
| 2 | State professional license | |||||||||
| 3 | License in each additional state where patients are seen | |||||||||
| 4 | NPI | |||||||||
| 5 | DEA registration (prescribers only) | |||||||||
| 6 | OIG exclusion list | |||||||||
| 7 | GSA SAM exclusion list | |||||||||
| 8 | CPR / BLS certification | |||||||||
| 9 | Background check | |||||||||
| 10 | Drug screening (role-dependent) | |||||||||
| 11 | Immunization records and TB test | |||||||||
| 12 | Malpractice history query (providers) | |||||||||
| 13 |
Keep this workbook in the compliance file rather than the personnel file, and start a new block of rows for every hire instead of overwriting the last one. The history of when a credential was verified is part of what you are being asked to prove.
The Physician Onboarding Process
Onboarding a new physician is everything else on this page plus three tracks that run outside your practice: credentialing, payer enrollment, and hospital privileging. None of them moves at your speed. The start date that matters is not the one on the offer letter. It is the one the payers and the verifiers hand you.
Credentialing is primary source verification of the physician's education, training, license, board certification, and malpractice history. Payer enrollment is a separate process, and it happens once per payer. Privileging is facility-specific and decides which procedures the physician may perform there. Start all three at offer acceptance, or for privileging as soon as the facility takes the application, rather than one after another.
The first three rows below are those tracks. The last two, DEA registration and malpractice coverage, are prerequisites with their own deadlines: the first prescribing day and the first patient.
| Track | What it establishes | Who decides it | When to start |
|---|---|---|---|
| Credentialing | That the education, training, license, board certification, and malpractice history are real and verified at the primary source | Your practice, or a credentialing verification organization you hire | At offer acceptance |
| Payer enrollment | That the physician is in network and their services are billable to Medicare, Medicaid, and each commercial plan | Each payer, separately | At offer acceptance, in parallel with credentialing |
| Hospital privileging | Which specific procedures the physician may perform at a given facility | The medical staff office at that facility, and its credentialing committee | As soon as the facility will accept the application |
| DEA and state controlled substance registration | Authority to prescribe controlled substances at your practice address | The DEA, plus the state agency where your state runs its own registration | Before the first prescribing day, and again after any address change |
| Malpractice coverage | That the physician is covered from the first patient, including any tail coverage owed from a prior employer | Your carrier | Before the first patient |
Separate payer enrollment creates a billing gap. A physician can be fully credentialed by your practice and still not be enrolled with a given plan, which means claims for their patients under that plan are not yet payable. Decide before the start date whether they see those patients, and who absorbs the delay.
Put the DEA renewal on the calendar the day you verify it. A practitioner registration under 21 CFR 1301.13 runs three years at an $888 fee, long enough that nobody remembers without a reminder. Moving the registered address takes a modification request, so a physician who relocates to another of your offices is a registration event.
None of this replaces the rest of the onboarding on this page. A new physician still needs HIPAA training before touching a chart, EMR competency before documenting alone, and the emergency protocol walkthrough every other hire gets. Clinical seniority is the most common reason those steps quietly get skipped.
Onboarding by Practice Type
Healthcare is not one-size-fits-all. A dental practice and a therapy practice share HIPAA requirements but almost nothing else in their onboarding protocols. The table below covers unique requirements for each small-practice setting. Use the relevant row as an addition to the general healthcare checklist, not a replacement.
| Practice Type | Unique Onboarding Requirements |
|---|---|
| Dental practice | Dental board license, radiation safety training, sharps and mercury handling, infection control for dental procedures, dental-specific OSHA training, nitrous oxide safety if applicable |
| Therapy / counseling (LCSW, LPC, LMFT) | State licensure verification per state for telehealth, telehealth consent and technology training, mandated reporter training, suicide risk protocol, clinical supervision documentation |
| Chiropractic | State chiropractic board license, X-ray safety and lead apron use if imaging on site, scope of practice review, informed consent procedures |
| Optometry | State optometry board license, frame and lens ordering systems, contact lens fitting protocols, HIPAA for vision plan billing, scope of practice for therapeutic drug prescribing by state |
| Urgent care | CLIA (Clinical Laboratory Improvement Amendments) waiver review if running point-of-care tests, rapid test protocols, wound care and splinting procedures, transfer protocols for higher-level care |
| Physical / occupational therapy | State license, Medicare and insurance billing compliance, functional outcome reporting, equipment safety, documentation standards for functional assessments |
| Dermatology | Pathology specimen handling, biopsy procedures training, phototherapy safety, aesthetic procedure consent and documentation, laser safety if applicable |
The most frequently overlooked requirement is telehealth compliance for therapy practices. A counselor licensed in one state who provides telehealth to a patient in another state may be practicing without a valid license in that second state. Each state has its own telehealth practice laws. Verify that your telehealth practitioners are licensed in every state where they see patients before their first remote session.
For dental practices, infection control training goes beyond the general OSHA bloodborne pathogens standard. State dental board requirements add specific protocols for instrument sterilization, water quality, and surface disinfection. A new dental assistant needs practice-specific training on your autoclave, your sterilization log, and your instrument tracking system.
Complete Office Manager Healthcare Onboarding Checklist
This is the consolidated checklist for the person running onboarding at a small practice without dedicated HR support. Use it for every hire. The compliance sections have no flexibility on timing. The training sections have some scheduling flexibility but zero flexibility on completion before the relevant patient contact begins.
One practical note on documentation storage. Keep two separate files for each employee: a personnel file (general employment information, performance reviews, offer letters, W-4) and a compliance file (I-9, HIPAA acknowledgments, training completions, credential copies, immunization records). State and federal auditors may request the compliance file independently of the personnel file.
Frequently Asked Questions
What is the onboarding process for new employees in healthcare?
Healthcare onboarding covers five phases: pre-hire credential verification (background check, license verification, OIG exclusion list, immunizations), Day 1 compliance (I-9, W-4, HIPAA Privacy and Security Rule training), Week 1 orientation (OSHA bloodborne pathogens training, infection control, EMR training, emergency procedures), a 30-day compliance audit, and a formal 90-day performance review with credential file update. Unlike general onboarding, healthcare puts documented compliance training and credential checks ahead of patient contact.
What are the HIPAA training requirements for new employees?
The Privacy Rule requires a covered entity to train each new workforce member on its privacy policies within a reasonable period of time after that person joins, and again whenever a material change in those policies affects their job. It names no fixed number of days, so practices set their own rule, and the practical one is that nobody opens a chart before training is done. Cover the Privacy Rule and the Security Rule, and document completion with dates and signatures. The Security Rule adds a workforce security awareness program with periodic reminders, which is where the common annual refresher cycle comes from; the annual cadence is policy, not a federal deadline. Penalties for a violation start at $145 and rise with culpability.
How long does healthcare onboarding take?
Plan on at least 90 days for clinical roles and 60 for administrative ones. The first week is compliance-intensive: OSHA bloodborne pathogens training is due before any exposure-prone task, and HIPAA training and infection control belong ahead of patient contact as a matter of practice policy. Allow three to five days of supervised EMR practice before a new hire documents on their own. The 30-day and 90-day formal reviews are non-negotiable checkpoints. Rushing healthcare onboarding is a patient safety issue, not just an HR inconvenience.
What credential verification is required for new healthcare employees?
The standard pre-hire set covers: state professional license via the state licensing board, NPI registry for providers and nurses, DEA registration for prescribers, the OIG exclusion list (its List of Excluded Individuals and Entities), the GSA SAM exclusion list, CPR/BLS certification, a background check, and immunization records. Drug screening is role-dependent but standard in most clinical settings. Complete every one of these checks before Day 1, not after. A license check that fails after a new hire has already started creates an immediate compliance problem.
What is OSHA bloodborne pathogens training and who needs it?
OSHA's bloodborne pathogens standard (29 CFR 1910.1030) requires documented training for any employee with occupational exposure risk. This includes clinical staff, but also any staff who handle specimens, soiled linens, or sharps containers. Training happens at the time of initial assignment to tasks where exposure may occur, and the standard requires a refresher within one year of the previous session. It must cover standard precautions, PPE use, hand hygiene, sharps safety, and exposure incident response. Hepatitis B vaccination has to be made available within 10 working days of initial assignment, after the employee has had the training. Keep the completion records; unlike the HIPAA cycle, this annual refresher is a genuine federal requirement.
How do you onboard a new employee in a small practice without an HR department?
The office manager becomes the HR, compliance, and onboarding coordinator simultaneously. This works when you build a checklist and follow it consistently. The checklist covers three tracks: compliance (HIPAA, OSHA, I-9, W-4, state new hire reporting), credential verification (license, NPI, OIG exclusion, CPR/BLS, immunizations), and training (EMR, infection control, patient communication, emergency procedures). The compliance items have fixed deadlines that do not change based on how busy the practice is.
What happens if a small practice skips HIPAA training during onboarding?
A practice that never trains a new employee who handles PHI is on the wrong side of the Privacy Rule, because training is one of the administrative requirements the Office for Civil Rights (OCR) checks. OCR investigates complaints and breaches. In the adjusted penalty table, a violation the practice did not know about and could not reasonably have known about starts at $145, and no violation in the three lower tiers can exceed $73,011. Willful neglect left uncorrected past the 30-day correction window begins at $73,011 and can run to $2,190,294 per violation, and violations of one identical requirement are capped at $2,190,294 per calendar year. Small practices are not exempt, although the regulation does tell the Secretary of Health and Human Services to weigh the size and financial condition of the entity when setting an amount. Getting the training done costs an afternoon; the exposure from skipping it does not scale down to match.
What forms are required for new employees in a healthcare practice?
Federal requirements include: Form I-9 (identity and work authorization; the employee completes Section 1 by the first day of employment, and you finish Section 2 within three business days of that day), Form W-4 (federal tax withholding, before first paycheck), and state new hire reporting (federal law sets a ceiling of 20 days after hire, and many states require it sooner). On the healthcare side, the Privacy Rule requires a record that HIPAA training was given, and the signed, dated workforce acknowledgment serves as that record. Add OSHA bloodborne pathogens training records and credential verification records. Keep all compliance documents in a dedicated file separate from general personnel records.
Make HR the easy part of running your business
Onboarding, e-signatures, training and core HR in one place. Up and running in 5 minutes.
- 7-day free trial
- No credit card required
- Cancel anytime