NSQHS Standard 3: Preventing Healthcare-Associated Infections in Your Clinic

Every year, roughly 165,000 Australians develop a healthcare-associated infection (HAI). That figure comes from the Australian Commission on Safety and Quality in Health Care, and it should stop you in your tracks. These are infections people picked up while receiving care, not before they walked through the door.

Some of those infections are minor. Many are not. HAIs contribute to longer hospital stays, increased antimicrobial resistance, and preventable deaths. For clinics and day hospitals, the risk profile is different from a major tertiary centre, but the obligation is identical: you must have robust infection prevention and control (IPC) systems in place.

That obligation lives in NSQHS Standard 3. If you've been treating it as a box-ticking exercise, this is your wake-up call.

What does NSQHS Standard 3 actually require?

Standard 3 of the National Safety and Quality Health Service Standards is titled "Preventing and Controlling Healthcare-Associated Infections." It applies to all health service organisations assessed against the NSQHS Standards, from large hospitals down to private day procedure centres.

The standard has eight action areas:

Clinical governance and quality improvement for infection prevention and control
Infection prevention and control systems
Reprocessing of reusable medical devices
Antimicrobial stewardship
Hand hygiene
Aseptic technique
Transmission-based precautions (previously called additional precautions)
Environmental cleaning and management

Each action area contains specific actions your organisation must meet. The standard is designed so that these areas work together as a system. You can't just nail hand hygiene and ignore reprocessing. Auditors assess the whole picture.

If you're new to the NSQHS Standards framework, our NSQHS standards guide covers all eight standards and how they interact.

Who is responsible for infection prevention and control governance?

Governance is where Standard 3 starts, and it trips up more clinics than you'd expect.

Your organisation needs a defined governance structure for IPC. In a large hospital, that means a dedicated IPC committee with terms of reference, scheduled meetings, and documented minutes. In a smaller clinic, it might be a standing agenda item at your clinical governance meeting with a nominated IPC lead.

What you need at minimum:

A nominated IPC lead with defined responsibilities and appropriate training
IPC policies and procedures that are current, evidence-based, and accessible to all staff
A risk management approach to infection prevention, including a risk register that identifies IPC-specific risks
Surveillance data collection and analysis, even if basic (e.g., tracking surgical site infections for your most common procedures)
Regular reporting to your governing body on IPC performance, incidents, and audit results

The governance piece also requires you to involve your workforce. That means IPC training at orientation, ongoing education, and a culture where staff feel safe to report breaches or near-misses.

One thing auditors consistently look for is whether your governance is active or decorative. A policy manual gathering dust in the break room doesn't count. They want to see evidence that policies are reviewed, updated, communicated to staff, and actually followed.

What are the five moments of hand hygiene?

Hand hygiene is the single most effective measure for preventing healthcare-associated infections. It sounds basic. It is basic. And yet compliance rates across Australian healthcare hover around 87% nationally, which means roughly one in eight opportunities is missed.

The five moments framework, adopted from the World Health Organization and promoted by Hand Hygiene Australia, defines when hand hygiene must be performed:

| Moment | When | Why | |--------|------|-----| | Moment 1 | Before touching a patient | Protect the patient from harmful germs on your hands | | Moment 2 | Before a procedure | Protect the patient from their own germs and external germs entering their body | | Moment 3 | After a procedure or body fluid exposure risk | Protect yourself and the healthcare environment from patient germs | | Moment 4 | After touching a patient | Protect yourself and the healthcare environment from patient germs | | Moment 5 | After touching a patient's surroundings | Protect yourself and the healthcare environment from patient germs |

Under Standard 3, your organisation must:

Implement a hand hygiene program consistent with the National Hand Hygiene Initiative
Conduct regular hand hygiene audits (the national benchmark target is 80% compliance or above)
Report audit results to your governing body and to staff
Provide alcohol-based hand rub at the point of care
Ensure staff are trained in correct hand hygiene technique

For smaller clinics, the audit requirement can feel onerous. But it doesn't need to be complicated. A validated hand hygiene audit tool, a trained auditor (can be an existing staff member), and a quarterly audit cycle will satisfy the requirement. The key is that you're measuring, reporting, and acting on results.

If your compliance is below 80%, you need a documented improvement plan. Auditors will want to see what you did about it, not just the number.

What PPE is required for different procedures?

Personal protective equipment (PPE) is your second line of defence after hand hygiene. Standard 3 requires that PPE is selected based on a risk assessment of the task being performed, not habit or convenience.

The NHMRC Australian Guidelines for the Prevention and Control of Infection in Healthcare provide the evidence base for PPE selection. Here's a practical summary for common clinic scenarios:

| Procedure/Task | Gloves | Gown/Apron | Surgical Mask | Eye Protection | |----------------|--------|------------|---------------|----------------| | Standard patient consultation (no contact with blood/body fluids) | No | No | No | No | | Wound dressing or minor procedure | Yes | Apron if splash risk | If splash risk | If splash risk | | Surgical procedure (minor) | Yes, sterile | Yes | Yes | Yes | | Surgical procedure (major/invasive) | Yes, sterile, double gloving recommended | Yes, sterile | Yes | Yes | | Cleaning blood/body fluid spill | Yes, heavy-duty | Yes | If splash risk | If splash risk | | Handling contaminated instruments | Yes | Apron | If splash risk | If splash risk | | Contact with patient on transmission-based precautions | As specified by precaution type | As specified | As specified | As specified |

A few points that catch clinics out:

Gloves are not a substitute for hand hygiene. You must perform hand hygiene before putting gloves on and after taking them off. This is a common audit finding.
PPE must be donned and doffed in the correct sequence. Training on this should be documented.
Single-use PPE must not be reused. This includes surgical masks between patients.
PPE stock must be monitored. Running out of the right size gloves is not an acceptable reason for non-compliance.

How should you manage reprocessing of reusable medical devices?

This action area catches more clinics off guard than almost any other. If your practice uses any reusable instruments (forceps, speculums, scopes, surgical instruments), you must comply with AS/NZS 4187:2014, the Australian and New Zealand standard for reprocessing of reusable medical devices.

The standard classifies devices by infection risk:

Critical items (enter sterile tissue or the vascular system): must be sterilised
Semi-critical items (contact with intact mucous membranes or non-intact skin): must be sterilised or receive high-level disinfection
Non-critical items (contact with intact skin only): require cleaning and low-level disinfection

What Standard 3 requires for reprocessing:

Documented procedures for cleaning, disinfection, and sterilisation of each reusable device type
Compliance with AS/NZS 4187:2014, including validation and routine testing of sterilisation equipment
Traceability systems so you can track which instruments were used on which patient (critical for recall situations)
Trained staff with documented competency in reprocessing procedures
Appropriate facilities, including separation of clean and dirty workflows
Routine monitoring and maintenance of sterilisation equipment, including biological and chemical indicators

If you're using a tabletop steriliser (autoclave), you need to be running daily air removal tests (Bowie-Dick equivalent for your machine type), chemical indicators in every load, and biological indicators at least weekly. Records must be kept and reviewed.

Common mistakes in smaller clinics:

Not validating the steriliser according to AS/NZS 4187 (validation is different from routine testing)
Not maintaining a traceability system for instruments
Staff performing reprocessing without documented competency assessment
Using instruments beyond their designated shelf life after sterilisation
Inadequate separation between dirty and clean processing areas

If reprocessing feels like too much overhead for your practice, single-use instruments are a legitimate alternative. But you need to make that decision deliberately and document it.

What does antimicrobial stewardship look like in a clinic?

Antimicrobial stewardship (AMS) is about using antibiotics and other antimicrobials wisely. It's a core component of Standard 3 because inappropriate antimicrobial use drives resistance, and resistance makes HAIs harder to treat.

For hospitals, AMS programs are substantial. For day clinics and smaller practices, the expectation is scaled but still real.

At minimum, your clinic should have:

An AMS program appropriate to the size and scope of your service
Prescribing guidelines or reference to national/state guidelines (e.g., Therapeutic Guidelines: Antibiotic)
Monitoring of antimicrobial prescribing, even if simple (e.g., auditing surgical prophylaxis compliance)
Education for prescribers on appropriate antimicrobial use
A designated AMS lead or champion within your team

Surgical prophylaxis is the most common AMS issue in day procedure settings. The right antibiotic, at the right dose, at the right time (typically within 60 minutes before incision), and stopped at the right time (usually within 24 hours). Getting this wrong is a frequent audit finding.

If your practice doesn't prescribe antimicrobials, you still need to demonstrate awareness of AMS principles and document how you manage referrals or transfers involving antimicrobial therapy.

How should environmental cleaning be managed?

Your physical environment is a reservoir for pathogens. Standard 3 requires a systematic approach to environmental cleaning that goes well beyond "the cleaner comes every night."

You need:

A cleaning schedule that specifies what is cleaned, how often, with what product, and by whom
Risk-based classification of areas (e.g., clinical areas require more frequent and thorough cleaning than administrative areas)
Cleaning products that are TGA-registered and appropriate for the surfaces and pathogens in your setting
Trained cleaning staff with documented competency, whether they are your employees or contractors
Cleaning audits to verify that cleaning is actually happening to the required standard (visual inspection alone is not sufficient; consider fluorescent marker or ATP testing)
Terminal cleaning procedures for when a room has been used for a patient on transmission-based precautions or after a known contamination event

A common gap: clinics that outsource cleaning to a commercial cleaning company and assume the company knows healthcare cleaning requirements. They usually don't. You are responsible for specifying the cleaning standard, providing appropriate products, training the cleaners, and auditing compliance. This must be documented.

The cleaning schedule should distinguish between routine cleaning (e.g., daily, between patients) and periodic cleaning (e.g., weekly deep cleans, equipment maintenance cleaning).

What should your outbreak management plan include?

Outbreaks happen. Even in well-run clinics. Standard 3 requires that you have a plan for recognising and responding to infection outbreaks or clusters.

Your outbreak management plan should cover:

Trigger criteria for activating the plan (e.g., two or more linked cases of the same infection within a defined period)
Notification requirements to your state or territory communicable disease authority
Roles and responsibilities during an outbreak (who leads, who communicates with staff and patients, who liaises with public health)
Investigation steps, including case identification, line listing, environmental assessment, and source identification
Control measures, including enhanced cleaning, cohorting, and communication
Post-outbreak review to identify lessons learned and system improvements

For most clinics, the plan doesn't need to be a 50-page document. A clear, practical flowchart with contact numbers and escalation pathways will serve you well. The important thing is that staff know it exists and know where to find it.

If you haven't tested your outbreak plan (e.g., through a tabletop exercise), consider doing so. Auditors love seeing evidence that a plan has been tested and refined.

What do auditors look for under Standard 3?

Assessors evaluating your compliance with Standard 3 are looking for evidence across four dimensions:

Governance: Is there a functioning IPC governance structure? Are policies current and based on best available evidence? Is there a risk register? Are IPC performance data reported to the governing body?
Systems: Are IPC systems implemented consistently? Is there evidence of hand hygiene audits, PPE compliance, reprocessing validation, AMS activity, and cleaning audits? Are results trended over time?
Workforce: Are staff trained and competent in IPC? Is there evidence of orientation training, ongoing education, and competency assessment? Do staff know the five moments? Can they demonstrate correct PPE use?
Patient focus: Are patients and carers informed about IPC? Is there consumer involvement in IPC governance? Are patients advised about their role in infection prevention (e.g., hand hygiene, wound care)?

Assessors use a combination of document review, observation, and interviews. They will walk through your clinical areas, watch procedures, check hand hygiene compliance in real time, inspect reprocessing areas, and talk to staff at all levels.

The strongest indicator of genuine compliance is consistency. If your policy says one thing but your practice shows another, that's a non-conformity. If your hand hygiene audit says 95% but the assessor observes multiple missed moments during their visit, that's a problem.

What are the most common non-conformities and how do you avoid them?

Based on published assessment reports and industry experience, these are the areas where clinics most commonly fall short under Standard 3:

1. Hand hygiene audit compliance below benchmark The fix: Run audits quarterly at minimum. If results are below 80%, implement targeted interventions (education sessions, point-of-care prompts, leadership visibility) and re-audit. Document everything.

2. Incomplete reprocessing records or missing traceability The fix: Implement a tracking system, whether paper-based or electronic, that links each instrument set to a patient and a sterilisation cycle. Keep steriliser logs, chemical indicator results, and biological indicator results together and accessible.

3. Outdated IPC policies The fix: Set a review schedule (at least every three years, or sooner if guidelines change). Assign policy owners. Use version control. When you update a policy, communicate the change to staff and document that communication.

4. No evidence of AMS activity The fix: Even a simple annual audit of surgical prophylaxis compliance counts. Document it. Report the findings. Act on any gaps.

5. Cleaning audits not conducted or not documented The fix: Schedule regular cleaning audits using a standardised tool. Record results. Feed results back to cleaning staff (or your contractor). Track improvements over time.

6. Staff unable to articulate IPC practices during interviews The fix: Regular, practical IPC education. Not just an annual online module, but hands-on sessions, scenario-based training, and regular reminders. Make IPC part of your team culture, not a separate compliance activity.

7. PPE misuse or inconsistent use The fix: Conduct PPE competency assessments during orientation and periodically. Make correct PPE selection easy by providing wall charts in clinical areas. Address non-compliance promptly.

8. No outbreak management plan or untested plan The fix: Write a plan appropriate to your setting. Test it. Review it annually. Keep contact numbers current.

If you want a structured way to track all of these requirements, AHCRA's compliance platform maps each Standard 3 action to your clinic's evidence, so nothing falls through the cracks.

How do you build infection prevention into your clinic culture?

Compliance with Standard 3 is not a project with a finish date. It's an ongoing system that needs feeding.

The clinics that do this well share a few traits:

Leadership visibility. When the practice owner or clinical lead visibly prioritises IPC (performing hand hygiene correctly, wearing PPE appropriately, attending IPC meetings), staff follow.
Open reporting culture. Staff report breaches, near-misses, and concerns without fear of blame. Those reports are reviewed, acted on, and fed back.
Data-driven improvement. Hand hygiene rates, surgical site infection rates, cleaning audit scores. These are tracked, trended, and discussed at governance meetings.
Practical education. Short, regular, relevant training beats a lengthy annual compliance day. Think 10-minute huddle topics, case studies from your own practice, and hands-on skills refreshers.
Consumer involvement. Patients and carers are informed about IPC and encouraged to participate (e.g., asking healthcare workers if they've cleaned their hands).

If you're looking to upskill your team, our staff training courses cover infection prevention and control fundamentals alongside other NSQHS requirements. For a broader view of infection control standards in Australia, we've covered that in a separate post.

Standard 3 is one of the more resource-intensive standards to maintain, but it's also one of the most clinically important. Healthcare-associated infections are preventable. Your IPC system is what stands between your patients and that risk.

If you're not sure where your gaps are, start with an internal audit against the Standard 3 actions. Map your current evidence, identify what's missing, and build a plan to close those gaps. Or get in touch with AHCRA and we'll help you work through it.

Frequently asked questions

Does Standard 3 apply to small private clinics?

Yes. If your clinic is assessed against the NSQHS Standards (which includes most licensed day procedure centres, private hospitals, and many accredited practices), all Standard 3 actions apply. The scale of your response should be proportionate to your size and risk profile, but you cannot exclude entire action areas.

How often should hand hygiene audits be conducted?

The National Hand Hygiene Initiative recommends auditing three times per year at minimum for organisations that submit data nationally. For smaller clinics, quarterly audits are a sensible baseline. The key is consistency and acting on results. If your compliance drops below 80%, increase your audit frequency and implement corrective actions.

Do we need a dedicated infection control nurse?

Not necessarily. Larger organisations typically have dedicated IPC practitioners. Smaller clinics can nominate an IPC lead from existing clinical staff, provided that person has appropriate training and dedicated time for IPC activities. What matters is that someone is accountable, supported, and resourced.

What happens if we get a non-conformity under Standard 3?

A non-conformity (called a "not met" action) means you haven't demonstrated sufficient evidence of meeting a specific action. You'll be given a timeframe to address the gap and provide evidence of remediation. Serious or systemic non-conformities can affect your accreditation status. The best approach is proactive: identify and fix gaps before your assessment.

Can we use single-use instruments to avoid reprocessing requirements?

Yes. Transitioning to single-use instruments is a legitimate strategy to reduce reprocessing risk and overhead. However, you must ensure single-use items are genuinely single-use (never reprocessed), stored correctly, within expiry, and disposed of appropriately. You should also consider cost, environmental impact, and clinical suitability when making this decision.

Sources

Australian Commission on Safety and Quality in Health Care (ACSQHC), "Preventing and Controlling Infections Standard." https://www.safetyandquality.gov.au/standards/nsqhs-standards/preventing-and-controlling-infections-standard
Hand Hygiene Australia, National Hand Hygiene Initiative. https://www.hha.org.au/
National Health and Medical Research Council (NHMRC), "Australian Guidelines for the Prevention and Control of Infection in Healthcare (2019)." https://www.nhmrc.gov.au/about-us/publications/australian-guidelines-prevention-and-control-infection-healthcare-2019
Standards Australia/Standards New Zealand, AS/NZS 4187:2014, "Reprocessing of reusable medical devices in health service organisations."