A bloodborne pathogens exposure control plan is the written program OSHA requires when an employee's job can reasonably bring them into contact with human blood or other potentially infectious materials. The rule is 29 CFR 1910.1030. It covers clinics, construction first aid, janitorial work, and any shop where a designated person treats injuries. The plan is not a poster and not a one-time class. It names the jobs, the controls, the hepatitis B offer, and the steps after an exposure.
Call (432) 253-8958 to schedule a consultation
Who needs a bloodborne pathogens exposure control plan?
You need a written plan if any employee has occupational exposure, meaning reasonably anticipated contact with blood or other potentially infectious materials during their duties. OSHA defines that contact as skin, eye, mucous membrane, or parenteral contact. Parenteral means the skin or a mucous membrane is pierced, as in a needlestick, a human bite, a cut, or an abrasion.
Other potentially infectious materials include semen, vaginal secretions, and internal body fluids such as cerebrospinal, synovial, pleural, and amniotic fluid. Saliva in dental procedures counts. So does any body fluid visibly contaminated with blood, and any fluid when you cannot tell what it is. Unfixed human tissue and certain HIV or HBV lab materials also count. Sweat is not on that list. Intact skin contact with sweat is not occupational exposure under this standard.
The duty is not limited to hospitals. A contractor who assigns a trained responder to treat cuts on a jobsite can create occupational exposure. A cleaning crew that handles contaminated laundry or sharps can too. Goodwill first aid by a coworker, with no assigned duty, is different from a designated first-aid role. If you designate people to render first aid, write them into the exposure determination.
States with their own OSHA-approved plans must enforce a bloodborne pathogens rule at least as effective as the federal standard. Public employees in federal-OSHA states are often outside federal coverage. Check which agency inspects your sites before you assume a federal-only plan is enough.
Patriot Safety and Services has 14+ years of experience and more than 230 projects completed helping employers build practical compliance programs. The written plan is the document an inspector can ask to see, copy, and compare with how the work is actually done.
What must the written plan contain?
OSHA lists three items the plan must contain: the exposure determination, a schedule and method for the compliance sections, and a procedure for reviewing exposure incidents. Those sit in 29 CFR 1910.1030(c)(1)(ii). A binder of policies with no schedule is not enough.
The schedule and method have to say when and how you will carry out four parts of the standard:
- Methods of compliance, including universal precautions, engineering and work-practice controls, and personal protective equipment.
- Hepatitis B vaccination and post-exposure evaluation and follow-up, where those sections apply.
- Communication of hazards, including labels, signs, and information and training.
- Recordkeeping for medical records, training records, and, where required, the sharps injury log.
HIV and HBV research laboratories and production facilities have extra plan content. Most construction, manufacturing, and field employers will not use that section. If you do culture HIV or HBV, read 1910.1030(e) separately and do not copy a clinic template over it.
The third required piece is the procedure for evaluating the circumstances of an exposure incident. That procedure should say who is told, what facts are written down, and how the findings change controls. OSHA also requires the plan to be accessible to employees, consistent with the access rules for exposure records, and available to OSHA and NIOSH on request.
How do you write the exposure determination?
List every job where all employees have occupational exposure, every job where only some do, and the tasks that create exposure for that second group. Make the list without regard to gloves, gowns, or other personal protective equipment. PPE does not erase the exposure. It is a control you add after the exposure exists.
A clean determination uses lists. Do not stop at one vague sentence such as "clinical staff." The table below shows the three lists OSHA expects.
| Which list. | What to include. | Example, not a template. |
|---|---|---|
| All employees in the job. | Job titles where every person in that classification can expect contact. | Occupational health nurse or phlebotomist. |
| Some employees in the job. | Job titles where only certain people do exposure tasks. | A maintenance tech who changes a sharps container. |
| Tasks and procedures. | The specific tasks for the some-employees group. | Wound care, contaminated laundry, or spill cleanup. |
Update the lists when you add a task, a shift, or a job title. A plan that still names a clinic you closed, and omits the new mobile unit, fails the "whenever necessary" update rule even if the annual date is still ahead.
Tie the list to how work is assigned. A job hazard analysis can show which steps involve blood or sharps. The exposure determination is still its own OSHA list. Do not bury it inside a general safety manual where employees cannot find it.
Which controls belong in the plan?
Universal precautions come first: treat all human blood and other potentially infectious materials as infectious. When you cannot tell body fluids apart, treat all of them as infectious. That rule is in 1910.1030(d)(1). It is not optional for "known clean" patients or coworkers.
Engineering and work-practice controls must be used to eliminate or minimize exposure. Personal protective equipment is added where exposure remains after those controls. Engineering controls include sharps disposal containers, self-sheathing needles, and needleless systems. Examine and maintain or replace them on a regular schedule, and write that schedule in the plan.
Work-practice controls cover how people do the task. Employers must provide handwashing facilities that employees can reach. If a site cannot have running water, provide an appropriate antiseptic cleanser with clean towels, or antiseptic towelettes. Hands are then washed with soap and running water as soon as feasible. Employees wash hands right after removing gloves or other protective equipment.
Contaminated needles are not bent, recapped, or removed unless the employer can show no alternative is feasible, or a specific medical or dental procedure requires it. Recapping or needle removal then uses a mechanical device or a one-handed technique. Shearing or breaking contaminated needles is prohibited. Sharps go into containers that are closable, puncture resistant, leakproof on the sides and bottom, and labeled or color-coded.
Eating, drinking, smoking, handling contact lenses, and applying cosmetics are not allowed in work areas where exposure can reasonably occur. Food and drink do not go in refrigerators, freezers, shelves, or cabinets that hold blood or other potentially infectious materials.
Personal protective equipment
When exposure remains, the employer provides appropriate PPE at no cost. That can include gloves, gowns, face shields, masks, eye protection, mouthpieces, and resuscitation bags. The employer cleans, repairs, or replaces it as needed. Employees with occupational exposure use it. Rare, brief exceptions exist only when, in the employee's professional judgment, using it would prevent care or create a greater hazard. Those cases are investigated and documented so controls can change.
Gloves are worn when hand contact with blood or other potentially infectious materials is reasonably anticipated, and when handling contaminated items or surfaces. Disposable gloves are replaced as soon as feasible if torn or punctured, and they are not reused. Utility gloves may be decontaminated and reused if they stay intact.
How do hepatitis B offers and declinations work?
The employer makes the hepatitis B vaccine and series available at no cost to every employee with occupational exposure, after training and within 10 working days of initial assignment. The offer is not required if the person already completed the series, antibody testing shows immunity, or the vaccine is medically contraindicated. Do not require a prescreening program before someone can get the vaccine.
The vaccine, post-exposure evaluation, and related lab tests are provided at no cost. Offer them at a reasonable time and place, under a licensed physician or other licensed healthcare professional. Follow current U.S. Public Health Service recommendations except where the standard itself sets a different rule. Labs must be accredited.
An employee may decline. The employer must have that person sign the declination statement in Appendix A of the standard. If the employee later accepts while still covered, the employer makes the vaccine available then. If the Public Health Service later recommends a routine booster, that booster is made available on the same no-cost terms.
Keep the offer, the dates, and any declination in the confidential medical record. A signed form in a shared drive that supervisors can browse is not the record OSHA describes. Medical records under this standard stay confidential and are not disclosed without the employee's written consent, except as the standard or other law requires.
Occupational health services can deliver the vaccine series and the post-exposure visit. Patriot's occupational health services are one place employers send people for work-related medical steps. The plan still has to name how your company offers the vaccine and how an employee asks for it.
What happens after an exposure incident?
After an employee reports an exposure incident, the employer makes a confidential medical evaluation and follow-up available immediately. An exposure incident is specific eye, mouth, other mucous membrane, non-intact skin, or parenteral contact with blood or other potentially infectious materials from doing the job.
The confidential evaluation includes at least these elements, in the order a case usually moves:
- Document the route of exposure and the circumstances.
- Identify and document the source individual, unless identification is infeasible or barred by state or local law.
- Test the source person's blood for HBV and HIV as soon as feasible, after any required consent. If the law does not require consent, test available blood and document the result. Do not retest a source already known to have HBV or HIV.
- Give the exposed employee the source results, and explain laws on disclosing the source's identity and status.
- Collect and test the exposed employee's blood for HBV and HIV status after consent. If the employee agrees to a baseline draw but not to HIV testing yet, preserve the sample at least 90 days. Test it if the employee elects testing within those 90 days.
- Provide post-exposure prophylaxis when medically indicated, counseling, and evaluation of reported illnesses.
The healthcare professional gets a copy of the standard, a description of the exposed employee's duties, the route and circumstances, source results if available, and relevant vaccination records. The professional's written opinion goes to the employer. For hepatitis B, that opinion is limited to whether vaccination is indicated and whether the employee received it. For follow-up, it states that the employee was informed of the evaluation results and told about medical conditions from the exposure that need further evaluation. Other diagnoses stay out of the opinion. The employer gives the employee a copy of that written opinion within 15 days.
Immediate first aid, such as washing the area, is separate from this medical follow-up. A workplace first aid program covers responders and supplies. It does not replace the confidential evaluation the bloodborne pathogens standard requires after an exposure incident. Use your incident investigation steps to record what failed, then feed that into the plan review.
How should training and the annual review show up in the plan?
Train each employee with occupational exposure at no cost, during working hours, at initial assignment, and at least annually within one year of the last session. Add training when tasks or procedures change, limited to the new exposure. Use content and words that match the employees' education, literacy, and language. The trainer must know the subject as it applies to that workplace. The session must allow interactive questions and answers.
The standard lists minimum training topics. Cover the regulatory text and what it means. Cover disease symptoms, how pathogens spread, and how to get a copy of the plan. Cover how to spot exposure tasks and the limits of controls and PPE.
Also cover hepatitis B vaccine facts, emergency actions, how to report an incident, and the follow-up the employer provides. Labels, color coding, and a live question period are required too. This article is not that class. A separate training program should carry the full topic list and the questions.
Training records include the dates, a content summary, the trainer's name and qualifications, and the names and job titles of everyone who attended. Keep those records for 3 years from the training date. Employee medical records, including vaccination status, are kept for the duration of employment plus 30 years under 29 CFR 1910.1020.
Review and update the plan at least annually, and whenever tasks, procedures, or job positions change the exposure. The review must also reflect technology that eliminates or reduces exposure, and it must document the annual consideration of commercially available, effective safer medical devices. Employers who must have a plan solicit input from non-managerial employees who give direct patient care and can be injured by contaminated sharps. Document that solicitation in the plan. A shop with no direct patient care still does the annual device review. It does not invent a patient-care committee it does not have.
Employers who must keep an OSHA 300 injury log also keep a sharps injury log. The log records the type and brand of device, the department or work area, and how the incident happened, without naming the injured employee in a way that breaks confidentiality. Keep it for the period required by 29 CFR 1904.33. The log is not a substitute for the confidential medical record.
How do you keep the plan usable on a jobsite?
Put a current copy where exposed employees can read it during the shift, and name one person who updates it. OSHA requires access. A plan that lives only in a corporate folder, with no copy at the clinic or the trailer, fails that test when the crew cannot get it.
A practical file has the exposure lists, the control schedule, the hepatitis B offer steps, the post-exposure phone tree, the training calendar, and the last annual review date. Housekeeping rules belong in the same schedule. Write the cleaning method, the disinfectant, and who picks up broken contaminated glass with a brush and dustpan rather than by hand.
Labels matter on site. Containers of regulated waste get the biohazard label or the required red color code. So do refrigerators and freezers that hold blood or other potentially infectious materials, and containers used to store or transport that material. Build that into the communication section instead of leaving it to a vendor sticker.
Construction and industrial employers often mix designated first-aid responders with people who never touch blood. Write only the exposed jobs into the determination. Then connect the plan to the broader workplace safety program so new-hire orientation points people to the right document. An emergency action plan covers evacuation and alarms. It does not list hepatitis B offers or source testing, so keep those in the exposure control plan.
If you are unsure whether a task creates occupational exposure, decide in writing and keep the reason. Guessing "we are too small" is a common miss. Size is not the trigger. Anticipated contact is.
Call (432) 253-8958 to talk with Patriot about compliance support
Frequently asked questions
What information must an exposure control plan include?
At a minimum, include the exposure determination and the schedule for compliance methods. Also include hepatitis B and post-exposure follow-up, hazard communication, recordkeeping, and the procedure for evaluating exposure incidents. Review the plan at least annually, and update it when tasks or jobs change.
Is universal precautions an OSHA requirement?
Yes. Under 29 CFR 1910.1030(d)(1), universal precautions shall be observed to prevent contact with blood or other potentially infectious materials. If you cannot tell body fluids apart, treat all of them as potentially infectious.
What should an employee do after exposure to blood?
Wash the area, report the incident right away, and use the employer's post-exposure process. The employer must make a confidential medical evaluation available immediately, including documentation of the route, source testing when allowed, employee testing after consent, prophylaxis when indicated, and counseling.
How often must the plan be updated?
At least annually, and whenever necessary to reflect new or changed tasks, procedures, or employee positions with occupational exposure. The annual review also documents consideration of safer medical devices that can reduce exposure.
Do all offices need this plan?
No. The plan is required when you have employees with occupational exposure as OSHA defines it. An office with no reasonably anticipated contact with blood or other potentially infectious materials does not trigger the written plan. If you assign first aid, cleanup, or clinical tasks, re-check the exposure determination before you decide you are exempt.