The exposure control plan: what OSHA requires, and how to keep it true

01

What OSHA requires: the written exposure control plan

The requirement sits in paragraph (c) of the Occupational Safety and Health Administration (OSHA) Bloodborne Pathogens standard, 29 CFR 1910.1030. Paragraph (c)(1)(i) says: "Each employer having an employee(s) with occupational exposure as defined by paragraph (b) of this section shall establish a written Exposure Control Plan designed to eliminate or minimize employee exposure." Occupational exposure means "reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials that may result from the performance of an employee's duties."

The rest of paragraph (c)(1) sets what the plan is and how it is kept:

• What it contains, under (c)(1)(ii): the exposure determination; "the schedule and method of implementation" for the standard's methods of compliance, hepatitis B vaccination and post-exposure follow-up, communication of hazards and training, and recordkeeping; and the procedure for evaluating the circumstances surrounding exposure incidents.
• Who can read it, under (c)(1)(iii): a copy must be "accessible to employees."
• How often it is reviewed, under (c)(1)(iv): "at least annually and whenever necessary to reflect new or modified tasks and procedures which affect occupational exposure and to reflect new or revised employee positions with occupational exposure."
• Who has a say, under (c)(1)(v): an employer must solicit input from "non-managerial employees responsible for direct patient care" in choosing engineering and work practice controls, and document it in the plan.

The standard is not only for healthcare. OSHA's topic page, Bloodborne Pathogens and Needlestick Prevention, names "housekeeping personnel in some industries" among the workers who may be at risk and says "an employer must implement an exposure control plan for the worksite with details on employee protection measures." OSHA's enforcement directive, OSHA Instruction CPL 02-02-069, Enforcement Procedures for the Occupational Exposure to Bloodborne Pathogens (2001, with minor changes in 2017), lists among the jobs that may be covered "housekeepers in healthcare and other facilities," "employees handling regulated waste" and "custodial workers required to clean up contaminated sharps or spills of blood or OPIM."

02

What goes in an exposure control plan

OSHA publishes its own template. Model Plans and Programs for the OSHA Bloodborne Pathogens and Hazard Communications Standards (OSHA 3186, 2003) contains a model exposure control plan that it says "includes all elements required by the OSHA bloodborne pathogens standard" and that "may be used as a template." It adds two warnings: "you must tailor them to the specific requirements of your establishment," and "you should not eliminate any items when converting them for your own use." It is written with a hospital in mind, so a cleaning contractor will swap the laboratory examples for its own. The same publication has a model program for OSHA's Hazard Communication Standard, 29 CFR 1910.1200, which applies to hazardous chemicals in the workplace, including the disinfectants a cleaning schedule usually names; see the guide on the hazard communication program.

Following the model, a complete plan has these parts:

1. Policy: why the plan exists.
2. Program administration. Who is responsible for the plan, supplies, medical follow-up and training.
3. Exposure determination. Who is exposed to blood or OPIM, and doing what.
4. Methods of implementation and control. Universal precautions, engineering controls, work practice controls, personal protective equipment (PPE), housekeeping, regulated waste, laundry and labels.
5. Hepatitis B vaccination. Who offers it, when, and where declinations are kept.
6. Post-exposure evaluation and follow-up. Whom to call, and who carries out the confidential evaluation.
7. Evaluating the circumstances of an exposure incident. What is reviewed after each one.
8. Training. Who trains, and what the program covers.
9. Recordkeeping. Where each record is kept, and for how long.

Size matters less than fit. The directive says an "annotated copy of the final standard may be adequate for small facilities," while "larger facilities could develop a broad facility-wide program." The plan may sit inside a larger safety manual, but then "it must be a cohesive entity by itself or there must be a guiding document" that points to the separate policies that make it up.

The model also covers people who are easy to forget: "Part-time, temporary, contract and per diem employees are covered by the bloodborne pathogens standard. The ECP should describe how the standard will be met for these employees." For a janitorial company with weekend relief staff and seasonal crews, that line belongs in the plan by name.

03

The exposure determination for a cleaning or facilities team

The exposure determination is the heart of the plan, because everything else (training, vaccine, equipment) follows from who is on it. Paragraph (c)(2)(i) requires three lists:

• "A list of all job classifications in which all employees in those job classifications have occupational exposure";
• "A list of job classifications in which some employees have occupational exposure"; and
• "A list of all tasks and procedures or groups of closely related task and procedures in which occupational exposure occurs" for the jobs on the second list.

Paragraph (c)(2)(ii) adds the rule people most often get wrong: the determination "shall be made without regard to the use of personal protective equipment." A custodian who always wears gloves to empty sanitary napkin bins is still exposed for the purpose of the plan; the gloves are a control, not a reason to leave the job off the list.

OSHA's model shows the format with a hospital example, "Housekeeper, Environmental Services, Handling Regulated Waste." In an ordinary building the lists usually look something like this:

• Custodians and janitors assigned to restrooms and locker rooms: emptying sanitary product bins, picking up discarded needles, cleaning up blood and body fluids, servicing sharps containers.
• Day porters: responding to spills reported during the day in lobbies, stairwells and break rooms.
• School custodians: cleanup after nosebleeds and playground injuries, the nurse's office and athletic areas.
• Designated first aid providers, often a supervisor or a security officer whose post orders include first aid.

Group tasks only where they are genuinely related. The directive's examples of acceptable groups are "vascular access procedures," "handling of contaminated sharps" and "handling of deceased persons"; for a custodial crew, "cleanup of blood and body fluid spills," "handling contaminated sharps" and "handling regulated waste" are the usual three.

Contract cleaning adds a second employer. The directive says companies that provide a service "such as radiology or housekeeping" to host employers, and the host employers themselves, "are responsible for complying with all provisions of the standard" under OSHA's multi-employer policy. Each plan should name the other employer, and the contract or post orders should say who supplies the sharps containers and spill kits and who is told when an exposure incident happens.

04

The written cleaning schedule and method of decontamination

Inside the plan's methods of compliance is the part a custodial manager owns outright. Paragraph (d)(4)(i) says: "The employer shall determine and implement an appropriate written schedule for cleaning and method of decontamination based upon the location within the facility, type of surface to be cleaned, type of soil present, and tasks or procedures being performed in the area." The directive's examples include "hard-surfaced flooring versus carpeting" and "gross contamination versus minor splattering," and it adds that "extraordinary attempts to disinfect or sterilize environmental surfaces such as walls or floors are rarely indicated," but "routine cleaning and removal of soil are required."

Paragraph (d)(4)(ii) sets the minimums the schedule has to meet:

• contaminated work surfaces are decontaminated "with an appropriate disinfectant" after procedures, "immediately or as soon as feasible" after any spill of blood or OPIM, and at the end of the shift if they may have become contaminated since the last cleaning;
• "bins, pails, cans, and similar receptacles intended for reuse" that are likely to become contaminated are "inspected and decontaminated on a regularly scheduled basis" and cleaned as soon as feasible when visibly contaminated;
• broken glass that may be contaminated "shall not be picked up directly with the hands."

For a building that is not a hospital, a workable written schedule is a table by location. Each row names the place, the surfaces, the frequency, the product and the person or crew responsible:

• Restrooms and locker rooms: fixtures and touch points on the routine round; sanitary product bins emptied and their reusable liners or receptacles decontaminated on a set day; wall-mounted sharps containers checked on each visit.
• Nurse's office, first aid room or health suite: counters, exam surfaces and waste receptacles at the end of each day.
• Spill kits: checked on a schedule and restocked after every use.
• Any spill of blood or OPIM: as soon as feasible, by the method in the spill procedure; see the guide on blood spill cleanup.

Name the disinfectant by product and EPA registration number, not by "disinfectant." EPA's Registered Antimicrobial Products Effective Against Bloodborne Pathogens (List S) lists products effective against HIV, hepatitis B and hepatitis C, and warns that "a product's effectiveness can change depending on how you use it," including its contact time. The schedule should state the contact time, so nobody has to find it on a label in a closet.

Sharps containers deserve their own line. Paragraph (d)(4)(iii)(A)(1) requires containers that are "closable," "puncture resistant," "leakproof on sides and bottom" and labeled or color-coded, and OSHA's model plan leaves a blank for who inspects and replaces them "every (list frequency) or whenever necessary to prevent overfilling." Fill that blank with a real frequency and a real name.

05

Keeping the plan current: the annual review, training and records

The directive reads "at least annually" as "every 12 months," and tells compliance officers to check "whether the plan is reviewed annually and updated to reflect significant modifications in tasks or procedures." A plan dated three years ago is the easiest citation an inspector can write: "If the employer did not review and update its exposure control plan at least annually, paragraph (c)(1)(iv) should be cited."

A review worth the name asks the same questions each year:

• Has anyone's job changed? A new account, a new health suite, a porter now doing first aid.
• Have the tasks or products changed? A new disinfectant, new sharps containers, a new medical waste disposal vendor.
• What happened this year? The directive says "a review of the sharps log required in paragraph (h)(5) can identify problem areas and/or ineffective devices." Look at every exposure incident, needle found and missed sharps container check.
• What is now available? Under (c)(1)(iv)(A) and (B) the review must reflect "changes in technology" and "document annually consideration and implementation of appropriate commercially available and effective safer medical devices." For a cleaning team that may be better tongs or a locking sharps container; write down what was considered.
• Did the people doing the work have a say? Federal OSHA requires documented input from frontline patient-care staff; Cal/OSHA requires employee involvement in the review itself.

Training runs on its own clock. Under (g)(2)(ii) and (iv), each exposed employee is trained "at the time of initial assignment to tasks where occupational exposure may take place" and again "within one year of their previous training." The training must explain the plan and how to get a copy, and the material must be appropriate to the "educational level, literacy, and language of employees." Under (f)(2)(i) the hepatitis B vaccine is made available after training "and within 10 working days of initial assignment."

The records the plan points to have fixed retention periods:

• Training records, under (h)(2): dates, contents or a summary, the trainers' names and qualifications, and the names and job titles of attendees, kept "for 3 years from the date on which the training occurred."
• Medical records, under (h)(1): vaccination status, post-exposure results and the healthcare professional's written opinion, kept confidential "for at least the duration of employment plus 30 years."
• The sharps injury log, under (h)(5): for any employer required to keep the OSHA injury and illness log under 29 CFR part 1904, recording each percutaneous injury from a contaminated sharp with the device, the work area and how it happened, in a way that protects the injured employee's confidentiality. See the guide on the OSHA 300 Log.

Access is part of compliance too. The directive says the plan may be kept wherever suits the workplace "provided that the employee can access a copy at the workplace, during the workshift," that employees must be trained to use the computer if the plan lives only on one, and that under 29 CFR 1910.1020 a hard copy must reach an employee "within 15 working days of the employee's request." For a night crew, that means a copy on site that they can readily access, and training that tells them where it is.

06

Where the exposure control plan fails, and what SiteClara does about it

The plan rarely fails on paper; it fails in the building. The written schedule says sharps containers are checked on every restroom visit, but nobody can say when the one on the third floor was last looked at. The spill kit was used in March and never restocked. The annual review is signed at a desk, with no record of the needles found or the checks missed.

SiteClara records checks and reports at the place they happen. A printed QR code poster, with an optional NFC tag behind it, goes at each location where a check is scheduled, such as a restroom, a health suite or the cabinet holding a spill kit. Staff scan or tap with their own phone, with no app to install, see the checks set for that place, and mark each one done or say what stopped them. The facility writes the checks from its own written cleaning schedule, so a restroom check can ask whether the sharps container is below its fill line and a spill kit check whether gloves, absorbent and disinfectant are in stock, with a photo when one is asked for. The named person and the time are recorded as it happens.

Staff can also report a problem from the poster at that location, such as a needle found or a sharps container full, and it goes onto the team's list of jobs and stays open until someone closes it. The supervisor sees what is due, done and missed, records the reason a check was missed, and each day approves a report that goes the next morning to nominated managers. A year of those records gives the annual review something to read.

07

Questions people ask

Does OSHA require an exposure control plan?

Yes, for every employer with at least one employee who has occupational exposure to blood or other potentially infectious materials. Paragraph (c)(1)(i) of the Bloodborne Pathogens standard, 29 CFR 1910.1030 says that employer "shall establish a written Exposure Control Plan designed to eliminate or minimize employee exposure." OSHA's enforcement directive, CPL 02-02-069, adds that a Good Samaritan act, such as voluntarily helping a coworker who is bleeding, is not occupational exposure on its own.

How often are employers required to update the exposure control plan?

At least once a year, and whenever new or changed tasks, procedures or positions affect occupational exposure, under paragraph (c)(1)(iv) of 29 CFR 1910.1030. OSHA's enforcement directive, CPL 02-02-069, reads "at least annually" as every 12 months, and the review must reflect newly available devices that reduce exposure.

Where can you get a copy of the exposure control plan?

From your employer, who must make a copy accessible to employees under paragraph (c)(1)(iii) of 29 CFR 1910.1030, and whose training must explain how to obtain one. OSHA's enforcement directive, CPL 02-02-069, says employees must be able to access the plan at the workplace during the workshift, and that a hard copy must be provided within 15 working days of a request.

Is there an OSHA exposure control plan template?

Yes. OSHA's Model Plans and Programs for the OSHA Bloodborne Pathogens and Hazard Communications Standards (OSHA 3186) includes a model exposure control plan that contains all the elements the standard requires. OSHA says you must tailor it to your establishment and should not eliminate any items when converting it.

08

Where to read more, and an exposure control plan checklist to take away

Start with paragraph (c) of 29 CFR 1910.1030 and OSHA's Bloodborne Pathogens and Needlestick Prevention page. OSHA 3186 gives the model plan, CPL 02-02-069 explains how inspectors read each paragraph, and EPA's List S names the disinfectants. All are linked above. In a State Plan state, read your state's own standard; in California, that is 8 CCR 5193.

Before the next annual review, check that:

• the plan names the person or department responsible for it, for supplies, for medical follow-up and for training;
• the exposure determination lists every job and task with exposure, made without regard to gloves or other PPE, including part-time, temporary and relief staff;
• designated first aid providers are listed, and the plan says how first aid incidents are reported before the end of the shift;
• the written cleaning schedule names each location, surface, frequency, product with its EPA registration number and contact time, and who does it;
• sharps containers have a real check frequency and a named person, and are never allowed to overfill;
• the contract or post orders say which employer covers what, and who is told after an exposure incident;
• every exposed employee was trained in the last 12 months and offered the hepatitis B vaccine;
• the review is dated, signed, and records what changed and what safer devices were considered.