Infection Control Risk Assessment Template for General Practice: What US Regulators Actually Expect

September 12, 2026

Ready to be survey-ready?

See how AccrediCulture turns compliance into an operating system across every facility.

What a US general practice ICRA template must contain

An infection control risk assessment (ICRA) template for a US general practice must document facility-specific transmission risks, prioritize them by likelihood and severity, tie each risk to a written mitigation plan with an owner and due date, and be reviewed at least annually. The template also needs to map back, line by line, to CDC’s Guide to Infection Prevention for Outpatient Settings, OSHA’s Bloodborne Pathogens Standard at 29 CFR 1910.1030, OSHA’s Respiratory Protection Standard at 29 CFR 1910.134, CMS Conditions for Coverage or Participation that apply to your practice type, and the infection prevention chapter your accreditor uses (AAAHC Chapter 8, or TJC IC.01.03.01 and IC.02.01.01).

At minimum, the template should include these sections:

Facility profile: services offered, procedures performed, patient population, high-risk populations served (immunocompromised, pediatric, geriatric).
Risk inventory: injection safety, point-of-care testing, sterilization and high-level disinfection, single-use device handling, hand hygiene, respiratory hygiene, environmental cleaning with EPA-registered disinfectants, waste and sharps handling, laundry, water management, and construction or renovation activity.
Scoring: likelihood x severity, with a numeric threshold that triggers a written mitigation plan.
Mitigation plan per risk: control measures, responsible person, target date, monitoring method, evidence of completion.
Regulatory crosswalk: each risk mapped to the specific CDC recommendation, OSHA paragraph, and accreditor standard it addresses.
Annual review signature block: preparer, medical director, and administrator.
CAPA linkage: field connecting any open finding to a corrective action plan.

CDC states plainly that the guide represents the minimum infection prevention expectations for safe care in ambulatory care settings and reflects existing evidence-based guidelines produced by CDC and the Healthcare Infection Control Practices Advisory Committee. That is your floor, not your ceiling.

Why the paperwork matters: enforcement data from OSHA and CDC

Two data points make the case for a real ICRA, not a copied PDF sitting in a shared drive.

First, OSHA. The Bloodborne Pathogens Standard is the most frequently requested and referenced OSHA standard affecting medical and dental offices, and the standard itself requires a written Exposure Control Plan, employee training at no cost during work hours, availability of HBV vaccination and post-exposure follow up, and an exposure plan reviewed and updated at least annually. When a compliance officer walks into a family medicine practice, those are the documents they ask for first. A well-built ICRA feeds directly into the Exposure Control Plan and gives you a defensible answer.

Second, CDC. Although hundreds of patients became infected in unsafe-injection outbreaks, an estimated 150,000 patients during 2001 to 2012 required notification advising them to undergo bloodborne pathogen testing after potential exposure to unsafe injections, and approximately 90% of these known outbreaks occurred in outpatient settings. A follow-on review found that since 2001, nearly 200,000 patients in the United States were notified about potential exposure to blood-contaminated medications or injection equipment. Injection safety is not a hypothetical section in your ICRA. It is the section that has generated the most patient harm in ambulatory care.

As CDC’s Melissa Schaefer and colleagues wrote, “Facility leadership has an obligation to ensure adherence to safe injection practices and to respond properly if unsafe injection practices are identified.” Your ICRA is how leadership documents that obligation before an event forces the conversation.

Mapping the template to AAAHC, Joint Commission, and CMS

US general practices tend to be accredited by one of three bodies, and each expects a written, dated ICRA available on request:

AAAHC addresses infection prevention and control and safety in its standards chapter for infection prevention and requires a documented, risk-based program. Your ICRA is the evidence that the program is risk-based, not generic.
The Joint Commission requires organizations to identify risks for acquiring and transmitting infections under IC.01.03.01 and to implement its infection prevention and control plan under IC.02.01.01. The ICRA is the source document for both.
CMS expects infection control programs consistent with nationally recognized guidelines. For ambulatory surgical centers this is spelled out in the State Operations Manual Appendix L; primary care practices participating in Medicare must still meet applicable Conditions for Coverage and any state licensure rules.

The CDC guide itself was designed to plug into this framework. The materials complement ongoing work by CDC and CMS to integrate CDC guidelines into CMS surveys used during inspections of outpatient settings including ambulatory surgery centers. When your ICRA cites the CDC recommendation, the OSHA paragraph, and the accreditor standard side by side, a surveyor spends less time asking questions and more time checking boxes.

One structural note that trips up small practices: CDC recommends that all outpatient practices ensure at least one individual with specific training in infection control is on staff or regularly available, and that this individual be involved in developing a written infection control policy and have regular communication with health care providers. That person owns the ICRA. Name them in the template.

Building the annual review workflow so the ICRA stays alive

Most deficiencies we see in general practice are not about the absence of an ICRA. They are about an ICRA that was written once, signed once, and never revisited. The workflow needs four moving parts.

Trigger events. New service line, new procedure, new equipment, new construction, an outbreak, a needlestick, a positive environmental culture, a state health department alert, an updated CDC or APIC guideline. Any of these should force a review before the annual date.
Data inputs. Incident reports, sharps injury log, hand hygiene audits, sterilization monitoring, environmental rounds, patient grievances that touch infection concerns. The ICRA should draw from real data captured during the year, not a memory of the year.
Sign-off. Preparer (the trained IP designee), medical director, and administrator. Dated signatures, not initials.
CAPA linkage. Every risk that exceeds your threshold generates a corrective action plan with an owner and a due date. When the CAP closes, the evidence attaches back to the ICRA row.

This is exactly the kind of workflow we built AccrediCulture to hold in one place. Incident reports flow into risk scoring, environmental rounds feed the environment of care section, and open CAPs stay visible in a command-center view so no due date slips past your team. When a surveyor asks for last year’s ICRA and this year’s revision, you pull both in under a minute, with the signatures and the underlying evidence intact.

Frequently asked questions

How often does a general practice need to update its infection control risk assessment?
At least annually, and any time a trigger event occurs (new service, new equipment, outbreak, exposure incident, updated guideline, construction). OSHA’s Bloodborne Pathogens Standard also requires the written Exposure Control Plan to be reviewed and updated at least annually, and your ICRA is what drives that update.

Who should sign off on the ICRA in a small primary care practice without a dedicated infection preventionist?
The trained infection prevention designee prepares it, and the medical director and administrator co-sign. CDC recommends that all outpatient practices ensure at least one individual with specific training in infection control is on staff or regularly available, and that this individual be involved in developing a written infection control policy. In a small practice this is often a nurse manager or office manager who has completed an infection prevention course; the role must be named, not assumed.

What’s the difference between an ICRA for construction and an annual facility ICRA?
A construction ICRA (sometimes called ICRA 2.0 in the American Society for Health Care Engineering framework) evaluates dust, air, water, and traffic risks tied to a specific renovation or build. The annual facility ICRA covers the full infection prevention program: injection safety, reprocessing, hand hygiene, environmental cleaning, waste, respiratory protection, and surveillance. General practices need both when construction happens. Only the annual one is required every year.

Which accreditation bodies require a written ICRA for outpatient primary care?
AAAHC (Chapter 8, Infection Prevention and Control and Safety), The Joint Commission (IC.01.03.01 identifies risks, IC.02.01.01 implements the plan), and NCQA PCMH standards touch it through safety expectations. CMS surveys also expect a risk-based infection control program consistent with recognized guidelines.

What are the most common ICRA-related survey deficiencies in general practice?
Three patterns recur: no annual review signature, no crosswalk between identified risks and written mitigation plans, and injection safety practices that do not match CDC guidance. Injection safety is not a paperwork problem, it is a patient safety one. Approximately 90% of known unsafe-injection outbreaks reported to CDC occurred in outpatient settings, which is why surveyors probe this section hardest.

References