Writing a Bloodborne Pathogens Exposure Control Plan Under OSHA 1910.1030

Most of the plans our team reviews share the same fatal flaw: the bloodborne pathogens exposure control plan was written once, signed, and dropped into a three-ring binder that nobody has touched since. That binder is exactly what an OSHA compliance officer opens first, and it's usually where the citations start. The Bloodborne Pathogens standard treats the Exposure Control Plan (ECP) as a living operational document, not a one-time deliverable — and the paragraphs most employers skip are the cheapest ones to get right.

Here's what the standard actually requires, why the annual review is the weak point in most programs, and the two nuances that people filling in an ECP template for healthcare miss almost every time.

Who is actually covered

The governing rule is OSHA's Bloodborne Pathogens standard, 29 CFR 1910.1030, which applies to "all occupational exposure to blood or other potentially infectious materials" (OPIM). Coverage is task-based, not job-title-based — a distinction that trips people up constantly.

"Occupational exposure" is defined as reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or OPIM that may result from performing an employee's duties (1910.1030(b)). "Bloodborne pathogens" are pathogenic microorganisms in human blood that can cause disease, including but not limited to hepatitis B virus (HBV) and human immunodeficiency virus (HIV) — and in practice, hepatitis C (HCV) as well.

The obvious population is direct-care clinical staff. But the standard reaches further than a lot of managers assume: laboratory personnel, housekeeping and laundry workers who handle contaminated linens, first responders, and anyone whose job brings reasonably anticipated contact with blood or OPIM. If a housekeeper empties sharps-adjacent trash or cleans a spill, they're in scope. The question is never "what is their title?" — it's "does the task create reasonably anticipated exposure?"

What the plan must contain

Employers with any employee who has occupational exposure must establish a written ECP designed to eliminate or minimize that exposure (1910.1030(c)(1)(i)). The standard is specific about the contents. Per 1910.1030(c)(1)(ii), the written plan must contain, at minimum, three things:

1. The exposure determination required by paragraph (c)(2) — covered in detail below.
2. The schedule and method of implementation for paragraphs (d) through (h): methods of compliance (d), HIV/HBV research laboratory requirements (e), hepatitis B vaccination and post-exposure evaluation and follow-up (f), communication of hazards to employees including labels and training (g), and recordkeeping (h).
3. The procedure for evaluating the circumstances surrounding an exposure incident — how you investigate when a needlestick or splash actually happens.

There's a fourth element that predates the internet-era templates and gets omitted constantly. Under 1910.1030(c)(1)(v), you must solicit input from non-managerial front-line employees — the people at the bedside who risk contaminated-sharps injuries — when identifying, evaluating, and selecting engineering and work-practice controls, and you must document that solicitation in the plan itself. A signature page from your safety committee isn't enough. If your ECP doesn't name how you gathered floor-nurse input on which safety-engineered syringes to buy, you have a gap.

When you flesh out the "schedule and method of implementation," a usable plan reads more like an operations manual than a policy statement. This is where the 1910.1030 requirements meet daily practice, and practitioners expect to see these companion sections spelled out:

• Engineering controls (sharps containers, safety-engineered devices) and work-practice controls
• Personal protective equipment — what, where, and who provides it
• Housekeeping, including a written decontamination and laundry protocol
• The hepatitis B vaccination program
• Post-exposure evaluation and follow-up procedures
• Hazard communication, labeling, and training
• The sharps injury log

The exposure determination — and the trap in it

The exposure determination is the analytical heart of the plan, and it's where the most avoidable citations live. Under 1910.1030(c)(2)(i), it must contain three lists:

• (A) Job classifications in which all employees have occupational exposure — e.g., every phlebotomist, every ED nurse.
• (B) Job classifications in which some employees have occupational exposure — e.g., housekeeping, where the floor tech who handles regulated waste is exposed but the office custodian may not be.
• (C) All tasks and procedures, or closely related groups of tasks, in which occupational exposure occurs — drawing blood, starting IVs, handling specimens, cleaning contaminated surfaces.

Now the trap. Per 1910.1030(c)(2)(ii), the exposure determination must be made without regard to the use of personal protective equipment. You assume no gloves, no gown, no face shield when you decide who is exposed. This is counterintuitive — people naturally think "well, they wear gloves, so they're protected" — but that reasoning defeats the whole point. PPE is a control you apply after you've identified who is at risk. If you let PPE erase names from your lists, you'll under-scope training, vaccination offers, and post-exposure coverage for the very people who need them. Write your lists as if the PPE cabinet were empty.

How often you review it

At least annually, and more often when circumstances change. A proper annual BBP plan review is not a formality: 1910.1030(c)(1)(iv) requires the ECP to be reviewed and updated at least annually, and whenever necessary to reflect new or modified tasks and procedures affecting occupational exposure or the creation of new positions with exposure. Two specific things the annual review must do, and both are top citation drivers:

• Reflect changes in technology that eliminate or reduce exposure to bloodborne pathogens.
• Document annually the employer's consideration and implementation of appropriate commercially available and effective safer medical devices.

Read that second one carefully. It's not enough to buy safer sharps once. Every year you must document that you looked at what's now on the market, evaluated it, and either adopted it or recorded why you didn't. A plan dated three years ago with no device-evaluation record is a plan that fails its most-cited requirement. The ECP must also be accessible to employees — a locked binder in the DON's office doesn't satisfy that.

This annual cadence, the front-line input requirement, and the sharps injury log all arrived together. They were added by the Needlestick Safety and Prevention Act of 2000 (Pub. L. 106-430, signed November 6, 2000); OSHA published the revised standard on January 18, 2001, effective April 18, 2001.

The compliance details that ride alongside the plan

A few dates and durations worth pinning to the wall:

• Hepatitis B vaccine must be offered at no cost to all employees with occupational exposure, after they've completed training and within 10 working days of initial assignment (1910.1030(f)(2)(i)). An employee who declines signs the declination statement in Appendix A — but can accept the vaccine later, at no cost, while still covered.
• Training happens at initial assignment and at least annually thereafter (1910.1030(g)(2)(ii)).
• Medical records are kept for the duration of employment plus 30 years, per 29 CFR 1910.1020. Training records are kept 3 years.
• The sharps injury log (1910.1030(h)(5)) is required for any employer who must keep OSHA 300 logs. It records, at minimum, the type and brand of device involved, the department or work area where the incident happened, and an explanation of how it occurred — maintained in a way that protects the injured worker's privacy per 29 CFR 1904.

What it costs to get this wrong

The paperwork exists because the injuries are real. The CDC estimates roughly 385,000 sharps injuries among hospital-based healthcare personnel every year. On the enforcement side, OSHA's maximum civil penalties in effect for 2026 are $16,550 per serious or other-than-serious violation and $165,514 per willful or repeat violation, with $16,550 per day for failure to abate (2026 penalty adjustments). Those amounts carried over from the January 2025 adjustment with no inflation increase — but they climb most Januaries, so cite the current year.

FAQ

When is an annual BBP plan review due, and what triggers an off-cycle update? The calendar drives it — at minimum once every 12 months — but any new or modified task, procedure, or position that changes occupational exposure forces an update regardless of the date (1910.1030(c)(1)(iv)). The review is only complete if it captures newer exposure-reducing technology and records your evaluation of safer medical devices for the year.

Should I subtract employees who always wear gloves from the exposure determination? No — the determination ignores PPE entirely (1910.1030(c)(2)(ii)). List everyone whose tasks create reasonably anticipated contact as though no protective equipment existed, then treat gloves, gowns, and shields as controls layered on afterward.

We're a small clinic — are we exempt from writing an ECP? Size doesn't exempt you. The obligation attaches to any employer with even one employee who has occupational exposure to blood or OPIM (1910.1030(c)(1)(i)), and exposure is judged by task, not headcount or job title. Clinics, long-term care, labs, tattoo studios, and first-response agencies all qualify.

The plan itself is straightforward once you accept that it has to move. The failure mode is almost always the same: an annual review that never happens and a device-evaluation record that was never kept. What matters is keeping the exposure determination, training dates, HBV vaccination offers, and the sharps injury log current — and provable on the day an inspector asks. A dedicated occupational health system helps, but the standard doesn't care what tool you use; it cares that the document is alive. Put the annual review on the calendar today, and write down who you asked and what you decided.

This article is general guidance, not legal advice. Verify specifics against the current eCFR text and your jurisdiction — state-plan states such as California may impose stricter requirements — with your compliance officer or counsel.