How to Start an Employee Health Program: A Roadmap for Healthcare Facilities

Someone in your building just got stuck with a used needle. It's 4:45 on a Friday. Who do they call, what gets documented, where does the source-patient consent live, and how do you know the follow-up serology gets drawn at six weeks, three months, and six months? If you can't answer that cleanly, you don't have an employee health program yet—you have a phone number and good intentions.

If you've been handed the job of figuring out how to start an employee health program, this is the moment that defines whether it exists. Building one from scratch feels overwhelming because people imagine "wellness": step challenges, biometric screenings, flu-shot posters. That's not where you start. In a healthcare facility, an employee health program is first and foremost a compliance engine built on a handful of federal standards, and the wellness layer comes later. Get the mandated functions right and the rest follows.

This is a roadmap for the person who's been told "figure out employee health" and doesn't know where the floor is. We'll cover what the program has to do, who has to run it, which regulations apply, and how to stand it up in phases without standing the whole thing up at once.

Employee health department setup: what the program must cover

Skip the generic mission statements. In a hospital, clinic, or long-term-care facility, an occupational/employee health department owns five federally driven functions. Anchor everything to these:

1. Bloodborne pathogen exposure control — a written plan, hepatitis B vaccination, post-exposure evaluation and follow-up, and a sharps injury log.
2. Respiratory protection — medical evaluation and annual fit testing for anyone in an N95 or other respirator.
3. Immunization and immunity screening — reviewing personnel vaccination/immunity status per CDC/ACIP.
4. Tuberculosis screening and testing — built on a baseline individual risk assessment.
5. Injury and illness recordkeeping — the OSHA 300, 300A, and 301 forms.

If your program does these five things well, you're compliant and you're protecting staff. Everything else—ergonomics, return-to-work coordination, wellness—is built on top of this foundation, not instead of it. Any employee health department setup that starts with the wellness perks and leaves these five to "later" is building on sand.

Why the emphasis? Because healthcare is a genuinely hazardous industry. The health care and social assistance sector recorded about 562,500 nonfatal workplace injuries and illnesses in 2023, per the BLS Survey of Occupational Injuries and Illnesses; private industry overall averaged 2.4 recordable cases per 100 full-time workers that year. Your staff get hurt at work, and someone has to own that.

The regulations that apply

Before you write a single policy, know your legal hooks. These are the standards a U.S. healthcare facility answers to.

OSHA Bloodborne Pathogens Standard — 29 CFR 1910.1030

The big one. If you have employees with reasonably anticipated occupational exposure to blood or other potentially infectious material, this standard governs you. It requires a written Exposure Control Plan reviewed and updated at least annually and whenever new tasks change exposure risk. It mandates that hepatitis B vaccination be offered at no cost, and it sets the recordkeeping rules that shape your whole information system (more on the 30-year retention below). The standard was amended after the 2000 Needlestick Safety and Prevention Act to add safer-device requirements, employee input on device selection, and the sharps injury log.

OSHA Respiratory Protection — 29 CFR 1910.134

If any employee wears a respirator—and in a facility with airborne-isolation patients, plenty do—you need a written respiratory protection program run by a trained program administrator. Crucially, a medical evaluation by a physician or other licensed health care professional (PLHCP) must clear each employee before fit testing or use. Fit testing happens before first use and at least annually thereafter, and again whenever the facepiece model changes or the employee's physical condition changes in a way that could affect fit.

OSHA Recordkeeping — 29 CFR Part 1904

Three forms do the work: Form 300 (Log), Form 300A (Summary), and Form 301 (Incident Report). A contaminated needlestick that's work-related must be recorded on the 300 Log as an injury under 1904.8. You keep these records—including the privacy case list—for five years after the calendar year they cover, and you update the 300 Log when cases are newly discovered or reclassified.

The General Duty Clause — Section 5(a)(1)

The catch-all. Even where no specific standard exists, OSHA can cite a "recognized hazard likely to cause death or serious physical harm." Treat it as the reason to address hazards that don't have their own CFR subsection.

CDC/ACIP and CDC/NTCA — authoritative, not OSHA

Two more sources drive clinical practice even though they aren't OSHA rules:

• Immunization: CDC's Advisory Committee on Immunization Practices recommends healthcare personnel be vaccinated against or show immunity to hepatitis B, seasonal influenza (annually), MMR, varicella, and pertussis (Tdap). CDC/HICPAC encourages facilities to review personnel vaccination and immunity status at hire and at least annually. ACIP recommendations change, so verify the current CDC adult immunization schedule rather than trusting any single document.
• Tuberculosis: This is where a lot of programs are running outdated protocols. The CDC/National Tuberculosis Controllers Association 2019 recommendations (MMWR 68(19), May 2019) stopped recommending routine annual TB testing of health care personnel after baseline, absent a known exposure or ongoing transmission. Instead: a baseline (preplacement) individual TB risk assessment, symptom evaluation, and testing of personnel without prior TB/LTBI—plus annual TB education for everyone. If you're still drawing an annual PPD on your whole staff by default, that practice is no longer recommended.

A word on penalties. As of 2025, OSHA's civil penalty maximums stand at $16,550 per serious violation and $165,514 per willful or repeat violation, with the same $16,550-per-day figure for failure to abate. These amounts are adjusted periodically, so confirm the current figures before you quote them internally. They—and the deadlines below—apply to federal OSHA. State-plan states—California, Washington, and roughly two dozen others—can impose stricter rules. California's Aerosol Transmissible Diseases standard, for example, adds respiratory and TB requirements beyond federal OSHA. Check your state plan before you finalize anything.

Staffing employee health

The regulations dictate your minimum staffing, not the other way around. Two requirements in particular force the question.

Respirator medical evaluations and post-exposure evaluations must be performed by a physician or other licensed health care professional. That drives your basic staffing choice:

• In-house model: an occupational-health nurse or clinician performs evaluations, runs fit testing, manages immunizations, and owns recordkeeping. This is the norm for hospitals and larger systems. In a mid-sized hospital, one occupational-health nurse can often run evaluations, fit testing, and immunizations when the scheduling and records are well organized.
• Contracted PLHCP model: common for smaller clinics and long-term-care facilities. You contract respirator medical evaluations and post-exposure care to an occupational-medicine clinic while an internal coordinator—often from HR or safety—owns scheduling, documentation, and the paper trail.

Either way, someone must be explicitly designated as the respiratory protection program administrator, and someone must own recordkeeping. Don't leave these as "everybody's job," which means nobody's job. Name people in the written plans.

Whoever you assign, understand the records burden before you decide "we'll use spreadsheets." Under the Bloodborne Pathogens Standard, employee medical records must be kept for the duration of employment plus 30 years, while training records are kept for three years. Thirty years of confidential medical records, access-controlled, retrievable on an OSHA inspector's request—that's not a spreadsheet job. It argues for a purpose-built system from day one, whether that's a vendor platform like carefoundryESC or an EHR module your facility already runs. Choose deliberately; migrating three decades of records later is miserable.

The policies you need on day one

Each regulatory hook demands a specific written document. Here's the minimum policy set, mapped to its source:

• Written Exposure Control Plan — reviewed at least annually, documenting your consideration of safer medical devices and documented input from non-managerial, direct-patient-care employees on device selection. That employee-input piece gets skipped constantly and cited routinely. Build it into your annual review as a real meeting with real notes.
• Written Respiratory Protection Program — administered by your named program administrator, covering evaluation, fit testing, training, and cleaning/storage.
• Hepatitis B vaccination policy — including the formal declination process. Vaccine is offered within 10 working days of initial assignment, after training, at no cost to the employee.
• Immunization policy — defining which vaccines/immunity you verify at hire and annually.
• TB program — built on the baseline individual risk assessment, symptom screening, and testing model from the 2019 recommendations, plus annual education.
• Recordkeeping ownership — who maintains the 300/300A/301, the sharps log, and medical records, and how confidentiality and retention are enforced.

Building your occupational health program: a phased roadmap

You can't do all of this in week one, and you shouldn't try. Building an occupational health program is a sequencing exercise: cover the highest-risk gaps first, then layer on the recurring machinery.

Phase 1 — Assess and comply

Identify which standards apply to your facility (they almost certainly all do). Write the Exposure Control Plan and the respiratory protection program. Stand up recordkeeping—get the 300 Log, 300A, and 301 in place and decide where medical records will live for the next 30 years. This phase is about having a defensible written foundation. If an inspector walked in, could you hand them a current, signed ECP? That's the bar.

Phase 2 — Screen and immunize

Turn the policies into intake workflow. Every new hire gets a baseline TB individual risk assessment and symptom screen, and an immunity/vaccination review at hire. Hepatitis B vaccine is offered within 10 working days of assignment, with declinations documented on the OSHA form language. This is where the program starts touching every employee, so build the workflow to scale before your next hiring wave.

Phase 3 — Operationalize surveillance

Now the recurring machinery: annual respirator fit testing, the annual ECP review with documented employee input, annual TB education, and—critically—using the sharps injury log to actually drive device evaluation. The sharps log must capture at minimum the device type and brand, the work area, and how the injury occurred (required for employers with 11+ employees). If three sticks in a quarter trace to the same butterfly needle, that log is telling you to change the device. Bloodborne-pathogens training runs at initial assignment and at least annually.

Phase 4 — Report and improve

Post the 300A summary in the workplace from February 1 through April 30 each year. If your establishment is covered by electronic submission—generally 250+ employees in non-exempt industries, or 20–249 employees in designated high-hazard industries—submit your data to OSHA's Injury Tracking Application by March 2. Then use the data: read your own injury numbers and feed them back into device selection, training, and staffing. A program that files the 300A and never reads it is doing paperwork, not safety.

Occ health program checklist

Print this. Use it as your standing audit against gaps.

• Written Exposure Control Plan on file, reviewed within the last 12 months
• Documented non-managerial employee input on device selection
• Sharps injury log maintained (device type/brand, work area, mechanism)
• Hepatitis B vaccine offered within 10 working days of assignment; declinations documented
• Bloodborne-pathogens training at hire and annually; records kept 3 years
• Written respiratory protection program with named administrator
• PLHCP respirator medical evaluations completed before fit testing
• Annual fit testing scheduled and tracked
• Baseline TB individual risk assessment + symptom screen at hire
• Annual TB education for all personnel
• Immunity/vaccination status reviewed at hire and annually (current ACIP schedule)
• OSHA 300 Log, 300A, 301, and privacy case list maintained; retained 5 years
• 300A posted Feb 1–Apr 30
• ITA electronic submission by March 2 (if covered)
• Medical records secured and retained for employment + 30 years
• State-plan requirements verified (if applicable)

FAQ

Do I need an occupational-health physician on staff to start? Not necessarily on staff, but you need access to a physician or other licensed health care professional for the evaluations OSHA reserves to a PLHCP—respirator medical clearances and post-exposure care. Many smaller facilities contract these to an occupational-medicine clinic and staff the coordination role internally.

Is annual TB testing still required for all healthcare workers? No. The CDC/NTCA 2019 recommendations ended the default of routine serial TB testing after baseline, absent a known exposure or ongoing transmission. The current model is a baseline preplacement risk assessment, symptom evaluation, and testing—plus annual TB education. Some state plans may still impose more, so verify locally.

How long do we keep employee health records? Under the Bloodborne Pathogens Standard, employee medical records are kept for the duration of employment plus 30 years. Training records are kept three years. OSHA 300/300A/301 records are kept five years after the covered calendar year. Plan your system around the 30-year requirement, not the shortest one.

What happens if we're in a state-plan state? Federal OSHA is the floor. State plans can and do require more—California's Aerosol Transmissible Diseases standard being a notable example with additional respiratory and TB obligations. Confirm your state plan's rules before finalizing policies.

Where to go from here

Start with Phase 1 this month: get the Exposure Control Plan written and name your owners. Everything else has somewhere to attach once that foundation exists. Nothing in this article is legal advice, and regulations shift—so verify current OSHA standards, your state plan, and the live CDC/ACIP schedule before you commit policy to paper.

If you reach the point where spreadsheets are buckling under fit-test dates, immunization records, sharps logs, and 30-year retention, a purpose-built employee health system—carefoundryESC among them—can handle the recordkeeping and surveillance tracking so your clinical staff spend their time on people instead of paperwork. But build the program first; software only tracks what the program already does.