Exposure control plans must be updated at least once a year, per OSHA’s Bloodborne Pathogens standard (29 CFR 1910.1030). But the annual review is a minimum. Certain workplace changes trigger an immediate update regardless of when the last review happened.
The Annual Review Requirement
OSHA requires every employer covered by the Bloodborne Pathogens standard to review and update their exposure control plan (ECP) at least annually. This isn’t a quick sign-off. The annual review must accomplish several things: it must reflect any changes in tasks, procedures, or positions that affect occupational exposure, and it must account for technological changes that could eliminate or reduce that exposure.
A key part of the annual review is documenting your consideration of safer medical devices. OSHA requires employers to evaluate commercially available devices designed to minimize exposure, such as needleless systems or sharps with engineered injury protections, and to document that evaluation in the plan itself. Simply noting “no changes” year after year without evidence of a genuine review can put an employer out of compliance.
OSHA also recommends reviewing your sharps injury log as part of this annual process. While analyzing the log isn’t technically mandated, the agency considers it a valuable tool for spotting patterns: which devices are causing injuries, where incidents cluster, and whether current engineering controls are actually working. That information feeds directly into smarter updates.
Changes That Trigger an Immediate Update
You don’t wait for the annual review date if something meaningful changes at your workplace. The standard requires updates “whenever necessary” to reflect:
- New or modified tasks and procedures that create or change occupational exposure to blood or other potentially infectious materials. For example, if a clinic begins offering a new service that involves drawing blood, the plan needs to address that exposure before the next annual cycle.
- New or revised employee positions with occupational exposure. Adding a medical assistant role, reassigning housekeeping staff to handle regulated waste, or expanding a lab technician’s duties all qualify.
- New engineering controls or safer devices that become commercially available. If a device hits the market that could meaningfully reduce exposure risk for your workers, it should be evaluated and the plan updated accordingly. OSHA has stated that restricting device selection, for instance by only purchasing through a group purchasing organization without considering safer alternatives, can itself be a violation.
In practical terms, this means the ECP is a living document. Any time your workplace changes in a way that affects who is exposed, how they’re exposed, or what protections are available, the plan must catch up.
What the Updated Plan Must Include
Each review should walk through the core elements of the plan and confirm they’re still accurate. The exposure determination, which lists every job classification where workers have occupational exposure, is the foundation. If new roles have been created or duties reassigned, those employees need to appear on the list. The plan should also confirm that the schedule and methods for implementing controls (engineering controls, work practice controls, personal protective equipment) still match actual workplace conditions.
Documentation of safer device evaluation is required annually. This means recording which devices were considered, input that was gathered, and the reasoning behind adopting or rejecting specific options. Employers who skip this step or treat it as a formality risk citations during an OSHA inspection.
Employee Input Is Required
OSHA doesn’t leave the update process entirely to management. Employers must solicit input from non-managerial employees who are responsible for direct patient care and potentially exposed to contaminated sharps injuries. These frontline workers are the ones actually handling devices day to day, so their feedback on which engineering and work practice controls are effective carries real weight. The solicitation itself must be documented in the exposure control plan, not just the outcome but the fact that you asked.
Who Needs Access to the Plan
Once updated, the plan must be accessible to employees and to OSHA representatives. Employers are required to inform covered employees, at hiring and at least annually afterward, about the existence and location of the plan and who is responsible for maintaining it. When an employee or their designated representative requests access, the employer must provide it in a reasonable time and manner, generally within 15 working days. OSHA representatives are entitled to prompt access as well.
Keeping the plan in a shared digital location or a clearly marked physical binder that employees know about is the simplest way to stay compliant. The goal is that no one has to jump through hoops to find the document that’s supposed to protect them.
A Simple Review Checklist
When your annual review date comes around, or when a triggering change occurs, walk through these questions:
- Job classifications: Have any positions been added, removed, or changed in ways that affect exposure?
- Tasks and procedures: Are there new or modified procedures involving blood or other potentially infectious materials?
- Engineering controls: Are there newer, safer devices available? Are current devices performing as expected?
- Sharps injury log: Do recent injuries point to a failing device or a gap in training?
- Employee input: Have you solicited and documented feedback from frontline, non-managerial staff?
- Documentation: Is the evaluation of safer devices written into the plan, with reasoning for your decisions?
Treating the exposure control plan as a living document rather than an annual checkbox is really the point of the standard. The annual deadline keeps employers accountable, but the expectation is that the plan evolves in real time alongside the workplace it’s meant to protect.