Exposure control plans must be reviewed and updated at least once a year. That’s the minimum frequency set by OSHA under standard 1910.1030, which governs bloodborne pathogen safety in the workplace. But the annual review is a floor, not a ceiling. Certain workplace changes require an immediate update regardless of when the last review took place.
The Annual Review Requirement
OSHA’s Bloodborne Pathogens Standard (1910.1030) states that the exposure control plan “shall be reviewed and updated at least annually.” This isn’t optional or a best practice recommendation. It’s a regulatory requirement, and failing to do it can result in citations during an OSHA inspection.
The annual review serves several purposes. It forces employers to reassess which job classifications and tasks involve potential exposure to blood or other infectious materials. It also requires a fresh look at the control measures in place, from engineering controls like sharps containers to work practice controls like hand hygiene protocols. Even if nothing in your workplace has changed in 12 months, the review still needs to happen and be documented.
Changes That Trigger an Immediate Update
Beyond the yearly cycle, OSHA requires updates “whenever necessary” in response to specific workplace changes. Three categories of change trigger this requirement:
- New or modified tasks and procedures that affect occupational exposure. If your facility starts performing a procedure that wasn’t part of the original plan, or changes how an existing procedure is done, the plan needs to reflect that before employees carry out the work.
- New or revised employee positions with occupational exposure. Adding a job role, or changing an existing role so it now involves contact with blood or infectious materials, means the exposure determination section of the plan is out of date.
- Changes in technology that eliminate or reduce exposure to bloodborne pathogens. When a safer device becomes available for a procedure your workers perform, that needs to be evaluated and documented in the plan.
Any of these changes also triggers a training obligation. Employees affected by the new task, procedure, or equipment must receive additional training that addresses the new exposure risks. That training can be limited to just the changes rather than a full refresher course.
The Safer Medical Device Evaluation
One of the most commonly overlooked parts of the annual review is the requirement to evaluate safer medical devices. Each year, employers must actively look into whether new or improved safety devices have come to market for the procedures their employees perform. This could include safety-engineered needles, retractable lancets, or needleless IV systems.
This evaluation has to be documented in the exposure control plan itself. If no safer device exists for a particular procedure, you need to note that in writing. Simply continuing to use the same equipment without checking for alternatives doesn’t satisfy the standard.
OSHA also requires employers to solicit input from non-managerial employees who are responsible for direct patient care or otherwise handle sharps and infectious materials. These frontline workers must be part of the process for identifying, evaluating, and selecting safer devices. The names or job titles of employees involved in this input process need to be documented in the plan.
What the Plan Must Cover
During each annual review, it helps to check that every required component is present and current. OSHA’s model exposure control plan identifies these core sections:
- Exposure determination: a list of job classifications and tasks where employees have occupational exposure, made without regard to personal protective equipment use
- Methods of exposure control: universal precautions, engineering controls, work practice controls, personal protective equipment, and housekeeping procedures
- Hepatitis B vaccination: how the vaccine is offered to exposed employees and what happens if they decline
- Post-exposure evaluation and follow-up: the steps that occur after a needlestick or other exposure incident
- Hazard communication and training: how employees are informed about bloodborne pathogen risks and what training they receive
- Recordkeeping: how exposure incidents, training, and medical records are documented and stored
- Procedures for evaluating exposure incidents: how the circumstances of each incident are investigated to prevent recurrence
Each of these sections should be checked against current workplace conditions during the annual review. A plan that was accurate two years ago may have gaps if staffing, procedures, or equipment have changed.
Recordkeeping Timelines
The plan itself needs to be accessible to employees and available for OSHA inspection at any time, but the surrounding records have their own retention requirements. Training records must be kept for three years from the date the training occurred. Medical records for employees with occupational exposure to bloodborne pathogens must be maintained for the duration of employment plus 30 years. These retention periods apply even after an employee leaves your organization.
Keeping a dated copy of each annual revision of the exposure control plan is a practical way to demonstrate compliance during an inspection. It shows that the review actually happened on schedule and documents what changed from year to year.
How to Structure the Annual Review
A productive annual review typically follows a consistent process. Start by pulling the current plan and comparing it against the actual day-to-day operations in your facility. Walk through each job classification listed and confirm the exposure determination is still accurate. Check whether any new roles have been created or existing ones modified. Review your sharps injury log for patterns that might point to a need for different engineering controls.
Next, research whether new safety devices have entered the market for the procedures your workers perform. Contact suppliers, review trade publications, or check with industry groups. Document what you find and the input you received from frontline employees. If you decide not to adopt a new device, note why.
Finally, update any sections of the plan that are out of date, add the revision date, and make the updated plan available to all employees with occupational exposure. Schedule any additional training needed to cover the changes. The entire process should leave a clear paper trail showing that the review was thorough, timely, and involved the right people.