Bloodborne Pathogen Exposure Control Plan: What OSHA 1910.1030 Requires and How to Write One

The OSHA bloodborne pathogens standard has been in place since 1991, but exposure control plans remain one of the most commonly cited documents in healthcare and first responder workplaces. The citations aren’t usually for major failures. They’re for plans that exist on paper but haven’t been updated since 2018, or that list job classifications without identifying the specific tasks that create exposure, or that skip the needlestick-safer technology review that the 2001 Needlestick Safety and Prevention Act added to the requirements.

If your plan checks all those boxes, you’re ahead of most employers. But the details matter, and OSHA compliance officers know exactly where to look.

Who Needs an Exposure Control Plan

OSHA 1910.1030 applies to any employer with workers who have “occupational exposure” to blood or other potentially infectious materials (OPIM).

Occupational exposure has a specific meaning under the standard. It’s the reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or OPIM that may result from performing the worker’s duties. The word “reasonably anticipated” matters. It doesn’t require that exposure actually occurred. It requires that the employer could reasonably expect it to occur given the nature of the work.

Healthcare is the obvious category: nurses, phlebotomists, surgeons, dental hygienists, ER staff. But the standard reaches further. First responders who provide emergency medical care have occupational exposure. Janitorial and housekeeping staff in medical facilities who handle potentially contaminated materials have occupational exposure. Laundry workers handling soiled linens have occupational exposure. Lab technicians handling blood specimens have occupational exposure. And anyone formally designated as a first aid provider for their workplace has occupational exposure, even if they work in an office or manufacturing facility.

That last category surprises employers. If your company has designated employees to provide first aid and CPR, and those employees might respond to an injury involving blood, OSHA expects them to be covered under your exposure control plan. Your new employee safety orientation should make that clear to new first aid designees from day one.

The Exposure Determination Section

Every exposure control plan must include an exposure determination. This is the list of job classifications and tasks where occupational exposure exists.

The standard requires two lists. The first covers job classifications where all employees in that classification have occupational exposure, regardless of what task they’re doing at any given time. ER nurses are the standard example. The second covers job classifications where only some employees have occupational exposure, and for those classifications, the plan must list the specific tasks that create the exposure.

That second list is where most plans fail. Writing “maintenance workers” is not enough if only some maintenance tasks involve blood contact. The plan needs to say “maintenance workers performing cleaning and repair tasks in patient care areas” or “maintenance workers responding to biohazard spills.”

Generic job classification lists are a compliance shortcut that OSHA cites regularly. The exposure determination needs to reflect how work actually happens at your facility.

The Core Required Elements

Beyond the exposure determination, OSHA 1910.1030(c)(1)(ii) lists the elements every plan must address.

The plan must describe the engineering and work practice controls in use. It must identify the PPE provided and required. It must address hepatitis B vaccination availability. It must describe the post-exposure evaluation and follow-up process. It must cover training, housekeeping, and recordkeeping. And since 2001, it must document the employer’s evaluation and implementation of needlestick-safer technologies.

None of these sections can be placeholder language. OSHA expects the plan to reflect what actually happens at your workplace. Copying a template and changing the company name produces a plan that fails an inspection.

Engineering Controls: The First Line of Defense

Universal precautions is the foundational concept. Under universal precautions, all blood and OPIM are treated as if they are infectious, regardless of the source individual’s known or unknown status. This isn’t optional. It’s the baseline assumption the entire standard is built on.

Engineering controls come first in the hierarchy. Sharps disposal containers are the most common example. The plan must document the containers in use, their locations, who replaces them, and on what schedule. A container that’s overfull because no one has a clear replacement responsibility has failed its purpose, and the exposure control plan that didn’t address that is part of the reason.

Needlestick-safer technologies get specific attention because the 2001 Act added explicit requirements. The plan must document that the employer evaluated commercially available safer needle devices, must document which devices were selected (and why others weren’t), and must document that frontline workers who use these devices were involved in the selection process.

That last requirement, the frontline worker input, is the one that catches facilities off guard during inspections. It’s not enough to have switched to safety-engineered syringes. The plan needs to show that bedside nurses or the workers who actually use the devices had a voice in selecting them. Documentation of a meeting, a survey, or an evaluation process satisfies this. A note that says “we asked staff and they agreed” does not.

Handwashing facilities are also an engineering control under the standard. The plan should address where sinks are located relative to work areas, and what happens when workers are in locations without immediate sink access (how waterless antiseptic hand cleaner fits into the protocol, and its limitations).

PPE Requirements

The PPE guide covers selection and use in detail. For bloodborne pathogens specifically, the standard requires that employers provide appropriate gloves, gowns or other protective clothing, masks, eye protection, and face shields when occupational exposure exists.

Gloves are required any time workers have hand contact with blood or OPIM, with non-intact skin, or with mucous membranes. The plan should specify glove types for different tasks. Latex allergy considerations need to be addressed, either by providing non-latex alternatives or documenting that alternatives are available.

Eye protection and masks are required when splash, spray, or droplet exposure to the face is reasonably anticipated. In a clinical setting, this is procedure-specific. An IV insertion doesn’t typically require face protection. A surgical procedure, arterial line placement, or suctioning does.

The employer must clean, launder, or dispose of PPE at no cost to the employee. Workers can’t be required to take contaminated clothing home for washing.

Hepatitis B Vaccination

The standard requires employers to make hepatitis B vaccination available to all workers with occupational exposure, at no cost, at a reasonable time and place, under the supervision of a licensed healthcare professional, and after the worker has received the required training.

Workers can decline the vaccine. If they do, OSHA requires them to sign a specific declination form that uses language from the standard. The form can’t just be an informal note. It needs to use the prescribed language, which includes a statement that the worker understands their risk and may choose to receive the vaccine in the future.

Employers cannot require workers to get the vaccine. But the vaccination offer and the declination (or acceptance) records need to be maintained.

The Annual Review Requirement

OSHA 1910.1030(c)(1)(iv) requires the plan to be reviewed and updated at least annually.

The annual review isn’t a formality. It has specific required content. The plan must be updated when new or modified tasks affect occupational exposure, and the annual review must document the employer’s consideration of needlestick-safer technologies, including which devices were evaluated during that calendar year.

Facilities that do a genuine annual review, document the needlestick technology evaluation, and update the job classification list when new positions are added pass inspections. Facilities that treat the annual review as a date change on the cover page get cited.

Training Requirements

Workers with occupational exposure must receive training at the time of initial assignment to tasks where exposure may occur, and annually thereafter. The training can’t be pre-recorded content watched without any interaction. OSHA requires an opportunity for workers to ask questions of a knowledgeable trainer.

Training must cover: what bloodborne pathogens are and how they’re transmitted, the exposure control plan (workers must know it exists and how to access it), engineering and work practice controls, PPE selection and use, hepatitis B vaccine information, post-exposure evaluation procedures, signs and labels required under the standard, and how to report an exposure incident.

Annual retraining needs to cover new information or updated procedures, not just repeat the initial training verbatim. If you changed your sharps disposal containers, that goes in the retraining. If you evaluated a new safety syringe, that goes in the retraining.

Post-Exposure Evaluation

After a needlestick or other blood exposure incident, the employer must make a confidential post-exposure evaluation and follow-up available at no cost to the worker.

The evaluation process includes documenting the route and circumstances of the exposure, identifying the source individual and attempting to obtain consent for testing (or determining whether consent is required by law), providing baseline blood testing to the exposed worker, and referral to a healthcare professional for evaluation and counseling.

The healthcare professional provides a written opinion to the employer. That opinion is limited. It states only whether the vaccine was indicated and whether the employee received it. The employer doesn’t receive the exposed worker’s test results or the source individual’s test results. Confidentiality of medical information is explicit in the standard.

Make sure your incident investigation process captures exposure incidents separately from the medical evaluation. The investigation focuses on the root cause and what changed. The medical evaluation is confidential and happens in parallel.

Recordkeeping

Medical records for workers with occupational exposure must be kept for the duration of employment plus 30 years. Training records must be kept for 3 years.

The Sharps Injury Log, required since 2001, must document all percutaneous injuries from contaminated sharps. The log must protect the confidentiality of the injured worker and must include the type and brand of device involved, the department or work area where the injury occurred, and an explanation of how the injury happened.

That injury log data is meant to drive your needlestick-safer technology evaluations. If your sharps injuries are concentrated in one unit using one type of device, the log tells you where to focus the next year’s technology evaluation.

Getting a BBP certification gives workers and employers a standardized baseline of knowledge that supports the training requirement. But the certification doesn’t replace the site-specific training OSHA requires, which must address your facility’s specific exposure control plan, engineering controls, and procedures.