An exposure control plan is a written document that spells out how a workplace will protect employees from bloodborne pathogens like HIV, hepatitis B, and hepatitis C. It’s required by OSHA’s Bloodborne Pathogens Standard (29 CFR 1910.1030) for any employer whose workers have a reasonable chance of contact with blood or other potentially infectious materials on the job. The plan must contain at least three core elements: an exposure determination, a schedule and methods for implementing safety measures, and a procedure for evaluating exposure incidents after they happen.
Exposure Determination
The first required piece of the plan is a thorough exposure determination, which identifies exactly who in the workplace is at risk and why. This section has three parts:
- Job classifications with universal exposure: A list of every job title where all employees in that role face occupational exposure. A phlebotomist, for example, would fall into this category because every person in that role handles blood.
- Job classifications with partial exposure: A list of roles where only some employees have exposure, depending on their specific duties. A maintenance worker might qualify if certain assignments involve cleaning up biohazard spills but others don’t.
- Task-level detail for partial-exposure roles: For that second group, the plan must list the specific tasks or procedures that create the exposure risk.
One important rule: the exposure determination must be made without considering personal protective equipment. In other words, you can’t exclude a job classification just because workers wear gloves. The question is whether the exposure exists, not whether it’s currently mitigated.
Methods of Compliance
The plan must lay out a schedule and method for implementing each protective measure required by the standard. This is the operational backbone of the document, covering how the workplace will actually reduce risk day to day.
Engineering Controls
Engineering controls are physical devices or equipment that put a barrier between workers and the hazard. In a bloodborne pathogen context, these include sharps disposal containers, self-sheathing needles, needleless IV systems, and splash guards. The plan needs to identify which controls are in use and where they’re placed. OSHA also requires employers to document that they’ve annually reviewed and considered commercially available safer medical devices designed to reduce needlestick and sharps injuries.
Work Practice Controls
Work practice controls change the way a task is performed to reduce exposure. Examples include prohibiting needle recapping by hand, requiring handwashing immediately after removing gloves, and establishing procedures for handling contaminated laundry or disposing of regulated waste. The plan should describe each practice and how it’s enforced.
Personal Protective Equipment
The plan must specify what protective equipment (gloves, gowns, face shields, eye protection) is provided for each task that involves exposure, where it’s stored, and how it’s maintained or replaced. Employers are responsible for supplying this equipment at no cost to employees.
Hepatitis B Vaccination Program
Every exposure control plan must describe the employer’s hepatitis B vaccination program. The vaccine must be offered to employees after training and within 10 days of their initial assignment to a job involving occupational exposure. It’s provided at no cost.
Employees can decline the vaccine, but they must sign a declination form that makes clear they understand they remain at risk. If they change their mind later and still work in an exposed role, the employer must make the vaccine available at that point, again at no cost. The plan should document how the vaccination program is administered and who’s responsible for tracking it.
Post-Exposure Evaluation and Follow-Up
The plan must include a clear procedure for what happens when an exposure incident occurs, such as a needlestick, a cut from a contaminated sharp, or a splash of blood to the eyes or mouth. OSHA requires employers to make a confidential medical evaluation immediately available to the exposed employee. Blood collection and testing for hepatitis B and HIV should happen as soon as feasible, which OSHA considers to be within three to four hours of the incident.
Employees who consent to baseline blood collection but aren’t ready to decide about HIV testing have up to 90 days to make that decision, and their stored sample can be tested later. A reevaluation within 72 hours is strongly recommended. At the end of the process, the employer must obtain a written opinion from the healthcare professional who handled the evaluation. The plan should spell out every step in this chain so there’s no confusion in the moment.
Incident Evaluation Procedures
Beyond the medical response, the plan must describe how the circumstances of each exposure incident will be investigated. This means documenting what happened, what device was involved, where and when it occurred, and what controls were or weren’t in place. This information feeds into the annual review process and helps identify patterns that need to be addressed.
Hazard Communication and Training
The plan must describe how the employer will communicate bloodborne pathogen hazards to employees. This includes labeling requirements for containers of regulated waste, contaminated equipment, and refrigerators storing blood or infectious materials (typically using fluorescent orange or orange-red biohazard labels).
Training is a major component. Employees with occupational exposure must receive training when they’re first assigned to an at-risk role and at least annually after that. The training must cover the basics of bloodborne disease transmission, the specifics of the employer’s exposure control plan, how to use protective equipment, what to do after an exposure incident, and the details of the hepatitis B vaccination program. The plan should identify who provides the training, how often it’s conducted, and how attendance is documented.
Recordkeeping
The plan must outline the employer’s recordkeeping practices. There are two main categories. Medical records for each employee with occupational exposure (including vaccination status and post-exposure follow-up documentation) must be kept for the duration of employment plus 30 years. Training records, which include dates, content summaries, trainer qualifications, and attendee names, must be retained for three years.
Employers must also maintain a sharps injury log that records the type and brand of device involved, the department or work area where the incident occurred, and a description of how it happened. This log is reviewed as part of the annual evaluation.
Annual Review and Employee Input
An exposure control plan isn’t a document you write once and file away. OSHA requires it to be reviewed and updated at least annually, and more frequently whenever job duties change, new positions are created, or new tasks introduce exposure risks. Each annual review must specifically reflect changes in technology that could reduce exposure, and it must document that the employer has considered and, where appropriate, adopted safer medical devices.
There’s also a participation requirement. Employers must solicit input from non-managerial, frontline employees who provide direct patient care and face potential sharps injuries. These workers should be involved in identifying, evaluating, and selecting engineering and work practice controls. The plan itself must document how this input was gathered. This could take the form of employee interviews, safety committee meetings, or structured review sessions, but it has to happen and it has to be on the record.
Who Needs an Exposure Control Plan
Any employer with workers who have reasonably anticipated contact with blood or other potentially infectious materials during their job duties must have a written plan. This obviously includes hospitals, dental offices, labs, and clinics, but it also applies to settings people don’t always think of: tattoo parlors, correctional facilities, funeral homes, schools with nurses, and janitorial services that clean medical facilities. If an employee could encounter blood as a normal part of their work, the standard applies.
The plan must be accessible to employees at all times. If an OSHA compliance officer requests it, the employer must be able to produce it for review.