Medical office OSHA compliance checklist for small practices

Last updated 2026-07-11

Which OSHA standards actually apply to a small medical office?

A physician's office with two employees is covered by the same OSHA rules as a hospital with two thousand. Healthcare is one of the most frequently cited industries in the country, and size does not get you off the hook. Most small practice owners think OSHA is a construction and manufacturing problem. It is not.

Here are the standards that apply to almost every medical office:

• Bloodborne Pathogens: 29 CFR 1910.1030
• Hazard Communication: 29 CFR 1910.1200
• Personal Protective Equipment: 29 CFR 1910.132
• Respiratory Protection: 29 CFR 1910.134 (triggered if staff wear filtering facepiece respirators for anything beyond surgical mask comfort)
• Emergency Action Plan: 29 CFR 1910.38
• Exit Routes: 29 CFR 1910.36 and 1910.37
• Electrical Safety: 29 CFR 1910.303 through 1910.308
• OSHA Recordkeeping: 29 CFR 1904 (for practices with 11 or more employees)
• General Duty Clause: Section 5(a)(1) of the OSH Act

Pay attention to the General Duty Clause. It lets OSHA cite any employer for a recognized hazard even when no specific standard covers it. ^[1] Ergonomics at the front desk, violence from patients, chemical exposure from an instrument sterilizer: all of these can generate citations with no named standard behind them.

One size does not fit here. A solo dentist carries different exposure risks than a dermatology practice, which differs again from a primary care office with an on-site lab. The checklist below covers the floor every medical office needs. It also flags where your specific services stack requirements on top of that floor.

What does the bloodborne pathogens standard require for a medical office?

29 CFR 1910.1030 is the standard most medical offices get cited on, and the citations are almost always preventable. The rule requires a written Exposure Control Plan (ECP), updated at least annually and reviewed whenever procedures or job classifications change. ^[2]

Your ECP has to contain four things:

• A list of job classifications where occupational exposure exists (every clinical role, plus the front desk if they handle sharps containers or lab specimens)
• An exposure determination for each classification
• A schedule and method for implementing all other provisions of the standard
• A procedure for evaluating the circumstances around exposure incidents

The standard also requires you to document the annual review, and the review must include input from non-managerial employees who do the clinical work. That last requirement trips up a lot of small practices. If your annual review is just the office manager checking a box, it is not compliant.

Engineering controls matter too. You must use safer medical devices (needles with built-in resheathing mechanisms, for example) and document that you evaluated them. The evaluation does not need to be elaborate. A simple log showing which devices you reviewed and why you chose or rejected them is enough.

Hepatitis B vaccination must be offered to all employees with occupational exposure, at no cost, within 10 working days of initial assignment. ^[2] An employee who declines signs a declination form using the exact language in Appendix A of the standard.

Training is annual, it must happen before initial assignment, and it has to be interactive. A video with no chance to ask questions does not meet the standard's requirement for an "opportunity to ask questions of a trainer." ^[2]

Post-exposure follow-up is its own requirement. The practice pays for the evaluation, the testing, and the follow-up. The employee pays nothing. Confidentiality rules are strict. The physician providing follow-up sends the employer only a written opinion confirming the employee was told of the results and told of any condition that may need further evaluation. Nothing else.

Sharps injury logs are required for practices with one or more employees. ^[2] Keep them for five years, maintain them without employee names to protect privacy, and describe the type and brand of device involved.

What does hazard communication require in a medical office setting?

Every chemical in your office is potentially covered by 29 CFR 1910.1200, from the disinfectant wipes at the front desk to the glutaraldehyde in the sterilization room. ^[3] The HazCom standard requires a written program, a complete chemical inventory with Safety Data Sheets (SDSs), and training.

The written program has to explain how your practice manages labels, SDSs, and training. It does not need to be long. It does need to be specific to your workplace and available to employees during their shifts.

You need one SDS for every hazardous chemical employees may be exposed to. The binder on the shelf still works legally. Electronic access is fine too, as long as you have a backup for power outages. OSHA confirmed in a 2012 letter of interpretation that electronic SDS access is acceptable if employees can reach the information in an emergency without a computer standing in the way. ^[4]

Labeling is where small offices slip. A secondary container (say, a spray bottle you filled from a bulk disinfectant jug) needs a label with the product identifier plus the right hazard pictograms and signal words. A handwritten "bleach" on a spray bottle is not compliant.

For more on building this out, our guide to hazard communication walks through the written program step by step.

Higher-risk chemicals show up in most medical offices:

Chemical	Common Use	Key Hazard
Glutaraldehyde	Instrument sterilization	Respiratory sensitizer, skin/eye irritant
Formaldehyde	Tissue fixation, pathology	Known carcinogen, OSHA-specific 29 CFR 1910.1048
Isopropyl alcohol	Surface disinfection	Flammable
Sodium hypochlorite (bleach)	Surface disinfection	Corrosive, toxic if mixed with ammonia
Mercury (older thermometers, sphygmomanometers)	Measurement	Neurotoxin

Formaldehyde deserves its own callout. If your practice handles tissue specimens with formalin or uses formaldehyde-releasing sterilants, you may trigger the dedicated Formaldehyde standard at 29 CFR 1910.1048, which has its own action level, permissible exposure limit, and medical surveillance requirements. ^[5]

What PPE do medical office employees need under OSHA rules?

29 CFR 1910.132 requires you to run a hazard assessment, pick the right PPE, and provide it at no cost to employees. ^[6] The assessment has to be documented in writing with a certification naming the workplace, the date, and the person who did the evaluation. A one-page memo works.

For clinical staff in a typical outpatient setting, the PPE floor generally includes:

• Gloves for any task with potential blood or body fluid contact (also required separately under 1910.1030)
• Face protection (masks plus eye protection, or a face shield) when splashing is possible
• Gowns or protective clothing when clothing contamination is reasonably anticipated

PPE has to be the right type and the right size. Latex allergy is a real occupational health issue in healthcare, so you need non-latex alternatives on hand. OSHA has cited practices for stocking only latex gloves when employees had documented allergies.

Train employees on which PPE each task requires, how to put it on and take it off without contaminating themselves, how to tell when it needs replacement, and how to dispose of it. That training happens before the employee does the work that needs the PPE.

Here is what confuses many practices. Surgical masks worn by clinical staff for source control (to protect patients) are not PPE under 1910.134, and they do not trigger the respiratory protection standard. But the second staff put on N95 respirators for any reason, including a pathogen outbreak, 1910.134 kicks in. Now you need a written respiratory protection program, medical evaluations, and fit testing. ^[7]

Does a small medical practice need an OSHA 300 log?

The recordkeeping rule at 29 CFR 1904 applies to employers with 11 or more employees. ^[8] If your practice had 10 or fewer employees at all times during the previous calendar year, you are partially exempt from keeping OSHA 300 logs. You are not exempt from reporting.

Every employer, no matter the size, must report to OSHA:

• A work-related employee fatality within 8 hours
• Any work-related inpatient hospitalization, amputation, or loss of an eye within 24 hours ^[8]

You call 1-800-321-OSHA or report online at osha.gov. Missing that window is its own citable offense.

Practices with 11 or more employees run the full three-form system: the OSHA 300 (injury and illness log), OSHA 300A (annual summary), and OSHA 301 (incident report). The 300A summary gets posted from February 1 through April 30 each year, signed by a company executive. ^[8]

Needlestick and sharps injuries get a separate sharps injury log under 1910.1030, even if you are size-exempt from 29 CFR 1904. The two logs overlap but are not identical. The sharps log omits employee names for privacy.

Our article on writing an incident report covers the 301 form and how to decide what counts as recordable.

What training does OSHA require for medical office staff?

Training requirements in healthcare stack up fast. Here is the honest picture, standard by standard:

Bloodborne pathogens (1910.1030): Annual, before initial assignment, must be interactive. It covers the ECP, modes of transmission, engineering controls, PPE, HBV vaccination, post-exposure procedures, and the sharps injury log. A trainer has to be available to answer questions. ^[2]

Hazard communication (1910.1200): At hire and whenever a new hazard is introduced. Covers how to read SDSs, label elements, and the specific hazards the employee may meet. ^[3]

PPE (1910.132): Before employees use PPE. Covers what PPE is required, how to wear and remove it, and when to replace it. ^[6]

Emergency action plan (1910.38): When the plan is first implemented, when an employee's responsibilities change, and when the plan changes. Employees need to know their role, the alarm signal, and the evacuation route. ^[9]

Respiratory protection (1910.134): Before fit testing, before initial use of a respirator, and annually after that if respirators are required. ^[7]

OSHA does not require a certified trainer for any of this. No OSHA 10 or OSHA 30 card is needed for these workplace trainings. What matters is that whoever runs the training knows the subject. Supervisors who want broader compliance knowledge can look at OSHA training and the OSHA 30 course, but those do not replace the topic-specific trainings above.

Keep records of every session: date, content covered, trainer name and qualifications, and a signed attendee list. Inspectors ask for training documentation as a matter of routine. "We did it verbally" does not hold up.

What written safety programs does a medical office legally need?

OSHA requires several written programs. Not suggestions, actual documents on paper or on screen. For a medical office, the mandatory ones are:

1. Exposure Control Plan (29 CFR 1910.1030): covers bloodborne pathogens. 2. Hazard Communication Program (29 CFR 1910.1200): covers chemical management. 3. Emergency Action Plan (29 CFR 1910.38): required for any facility with more than 10 employees, or with fewer if evacuation is part of the safety plan. In practice, every medical office should have one. 4. Respiratory Protection Program (29 CFR 1910.134): only if employees use respirators. 5. Personal Protective Equipment Hazard Assessment (29 CFR 1910.132): a written certification, which is a short program document in its own right.

Practices using formaldehyde above the action level (0.1 ppm as an 8-hour TWA) also need a written compliance program under 1910.1048. ^[5]

The most common mistake is buying a generic template and never customizing it. OSHA inspectors are trained to spot boilerplate. An ECP that lists job titles your practice does not have, or chemical names that never show up in your inventory, tells the inspector the program was never actually put to work. The document has to match your workplace.

Want a starting point without hiring a consultant? SafetyFolio's safety program generator builds a customized set of these documents in about 15 minutes by walking you through your specific job titles, chemicals, and procedures.

Store the finished programs somewhere every employee can reach during their shift. A locked drawer in the office manager's office does not count.

How much can OSHA fine a small medical practice?

OSHA penalty amounts adjust for inflation every year. As of 2024, here are the maximums. ^[10]

Violation Type	Maximum Penalty Per Violation
Other-than-serious	$16,550
Serious	$16,550
Repeat	$165,514
Willful	$165,514
Failure to abate	$16,550 per day

Small employers with 25 or fewer employees can get penalty reductions of up to 60% for serious violations under OSHA's penalty reduction policy. Employers with 26 to 100 employees get up to 30%. ^[10] A good-faith effort at compliance can earn another 25% reduction, and quick abatement can cut the number further.

A typical first-time inspection of a small medical office with a few paperwork violations tends to land in the $3,000 to $8,000 range after reductions. A willful violation is a different animal. Failing to offer the hepatitis B vaccine after an employee was exposed can cost $165,514 per instance, and that is before legal fees.

Inspections in medical offices usually start with an employee complaint, a referral from another agency, or a reported severe injury. They can also be programmed as part of a regional or national emphasis program. Healthcare is currently part of OSHA's National Emphasis Program for Workplace Violence in Healthcare and Social Assistance. ^[11]

What does a medical office OSHA inspection actually look like?

Most owners picture an OSHA inspection as a surprise raid. It can be, but it rarely plays out that dramatically.

The inspector (called a Compliance Safety and Health Officer, or CSHO) presents credentials and explains why they are there. You have the right to walk with them. Use it. Do not let the inspector wander the office alone.

The inspection runs in four phases:

Opening conference: The inspector lays out the scope. Ask whether this is a complaint inspection and, if so, whether you can see the complaint (you generally can, with identifying information redacted).

Walkthrough: The inspector observes the facility, takes photos, and may take air or surface samples. Expect them to look at chemical storage, sharps containers, hand hygiene stations, emergency exits, electrical panels, and housekeeping.

Records review: They will ask for your written programs, training records, SDS binders, vaccination records, exposure incident logs, and OSHA 300 logs if you keep them. Have all of it organized and ready.

Closing conference: The inspector sums up what they found. This is not the citation, just their preliminary read. Actual citations come by mail, usually within six months.

You have 15 working days to contest a citation. If you get one, call an attorney before that deadline runs, especially on willful or repeat violations.

The single best thing you can do before an inspection: run your own annual self-audit using this checklist and fix what you find. OSHA's good-faith reduction applies when you can show you had a working safety program, even one with a few gaps.

Are there state OSHA plans that apply instead of federal OSHA?

Twenty-nine states and two territories run their own OSHA-approved state plans, covering some or all workers in those states. ^[12] These plans have to be at least as effective as federal OSHA, but they are allowed to be stricter, and several are.

California (Cal/OSHA), Washington (L&I), and Michigan (MIOSHA) all have healthcare safety rules that go past federal requirements. California's Aerosol Transmissible Diseases standard (8 CCR 5199) is a clear example: it has requirements federal OSHA does not.

Practice in a state-plan state and you comply with that state's rules, not federal OSHA's. The state standards often use the same CFR numbering structure but carry different content. Check with your state plan agency directly.

States without their own plan fall under federal OSHA for private employers. Federal contractors in state-plan states may still answer to federal OSHA for some purposes.

The full list of state plan states is at osha.gov. ^[12] This is not a place to guess.

What is the fastest way to build a compliant medical office safety program from scratch?

Building compliant written programs from a blank page takes most small practices 20 to 40 hours. That estimate comes from practitioners who have done it, not from any formal study I can point to.

The shortest legitimate path has three steps.

Step 1: Find your actual hazards. Walk every room. List every chemical. List every job function where employees touch blood, body fluids, or sharps. List every task that needs PPE. Two to three hours if you are thorough.

Step 2: Write or customize your programs. Your ECP, HazCom program, and EAP are the non-negotiables. OSHA has free template tools at osha.gov (search "OSHA small business" or visit the OSHA Small Business resources page). ^[13] These are real documents you can adapt, not marketing content.

Step 3: Train and document. Schedule training before anyone new starts clinical work. Keep attendance sheets. Put training due dates on a calendar so annual refreshers do not quietly slip.

Want a faster start? SafetyFolio's program generator asks about your specific practice and outputs customized written programs you can review and adopt. Worth doing if the alternative is a generic internet template or no program at all.

The biggest waste of money here is paying a safety consultant $5,000 to $10,000 to produce documents that look impressive and never get used. The program that protects your employees and your practice is the one that matches how your office actually runs, gets read, and gets updated every year.

Frequently asked questions

Does a medical office with only 2 employees have to follow OSHA?

Yes. OSHA covers all private-sector employers regardless of size, with very limited exceptions. A two-person medical office must comply with the bloodborne pathogens standard, hazard communication, PPE, and the general duty clause. The partial exemption from OSHA 300 recordkeeping logs applies only to employers with 10 or fewer employees, but reporting severe injuries and fatalities is required regardless of headcount. ^[8]

How often does the Exposure Control Plan need to be updated?

At minimum, annually. But 29 CFR 1910.1030 also requires a review and update whenever tasks or procedures change in a way that affects occupational exposure, when new or revised employee positions are created, and after any changes to engineering controls. The annual review must include input from non-managerial employees who do the direct clinical work. Document each review with a date and signature.

What sharps disposal requirements does OSHA have for medical offices?

Sharps containers must be puncture-resistant, leak-proof on sides and bottom, labeled with the biohazard symbol, and accessible where sharps are used. They must be replaced when they reach the fill line, not the top. A separate sharps injury log is required for all practices regardless of size, kept for five years, and maintained in a way that protects employee privacy. ^[2]

Does OSHA require a medical office to pay for hepatitis B vaccines?

Yes. Under 29 CFR 1910.1030, hepatitis B vaccination must be offered at no cost to all employees who have occupational exposure to blood or other potentially infectious materials. It must be offered within 10 working days of initial assignment. If an employee declines, they sign a declination using the exact language in Appendix A of the standard. Vaccination must be available even if an employee initially declines and later requests it. ^[2]

Are medical office receptionists covered by the bloodborne pathogens standard?

It depends on their actual tasks. If a receptionist handles lab specimens, drops sharps into containers, or has any other reasonably anticipated contact with blood or other potentially infectious materials, they are covered. The standard applies based on job tasks, not job titles. Document the exposure determination for every position in your Exposure Control Plan, including front-desk roles.

What OSHA standards apply to sterilization and autoclave use in a medical office?

Several. Glutaraldehyde and other liquid chemical sterilants fall under the hazard communication standard (29 CFR 1910.1200). If formaldehyde-based sterilants are used above the 0.1 ppm action level, the dedicated Formaldehyde standard at 29 CFR 1910.1048 applies, with its own exposure monitoring, medical surveillance, and written program requirements. ^[5] PPE requirements, engineering controls (exhaust ventilation), and SDS availability are all required.

How long do I need to keep OSHA training records for medical office staff?

For bloodborne pathogens training, records must be kept for three years from the date of training per 29 CFR 1910.1030(h)(2)(ii). OSHA 300 logs must be retained for five years. The sharps injury log must be kept for five years. There is no single universal retention period; the standard that requires the record also specifies how long to keep it.

Can I use online training to satisfy OSHA's annual bloodborne pathogens training requirement?

Online training can satisfy the requirement only if it allows employees to ask questions of a knowledgeable trainer. A static video with no interactivity does not meet the requirement in 29 CFR 1910.1030(g)(2)(vii). Recorded webinars with a live Q&A, or online modules followed by a live session with a qualified trainer, are the safer approach. Document the format and keep a record of who completed it.

Does OSHA require a medical office to have an emergency action plan?

Yes, for practices with more than 10 employees under 29 CFR 1910.38. Even for smaller practices, an EAP is strongly advisable because the General Duty Clause can apply if emergency procedures are clearly inadequate. The plan must cover procedures for reporting a fire or other emergency, evacuation routes, employee accounting after evacuation, and rescue or medical duties if assigned to specific employees. ^[9]

What are the most common OSHA violations cited in medical offices?

Based on OSHA inspection data and citation history, the most common citations in outpatient healthcare settings involve bloodborne pathogens (missing or outdated Exposure Control Plan, no annual employee input documentation), hazard communication (no written program, missing SDSs, unlabeled secondary containers), PPE (no written hazard assessment, inadequate training), and recordkeeping failures. Many of these are paperwork violations that are straightforward to fix before an inspector arrives.

Does a medical office need a written respiratory protection program just because staff wear masks?

Not for surgical masks or procedure masks worn for source control. Those are not respirators under 29 CFR 1910.134. The written program, medical evaluation, and fit testing requirements are triggered only when employees wear tight-fitting respirators (like N95s) for protection against airborne hazards. If your practice requires N95s for any reason, a full written respiratory protection program is required before those respirators are used. ^[7]

What is the OSHA penalty for not having an Exposure Control Plan?

A missing or non-compliant Exposure Control Plan is typically cited as a serious violation. As of 2024, serious violations carry a maximum penalty of $16,550 per violation before size and good-faith reductions. Small employers with 25 or fewer employees can receive up to a 60% penalty reduction, potentially bringing the penalty to around $6,600 or less, but the citation still goes on your inspection record. ^[10]

Do medical offices need lockout/tagout procedures under OSHA?

Only if employees perform servicing or maintenance on equipment where the unexpected energization could cause injury. For most small medical offices, standard maintenance is done by outside contractors. If your staff services autoclaves, X-ray equipment, or HVAC systems, 29 CFR 1910.147 applies. For practices that use outside contractors for all equipment service, a lockout/tagout program is less likely to be required, though verifying contractor compliance is still your responsibility. See our lockout tagout guide.

Is workplace violence a recognized OSHA hazard in medical offices?

Yes. OSHA recognizes workplace violence in healthcare as a General Duty Clause hazard, and healthcare workers are five times more likely to experience workplace violence than workers in other industries, according to OSHA's own guidance. ^[11] OSHA currently has a National Emphasis Program for Workplace Violence in Healthcare. While there is no specific violence prevention standard yet, practices can receive General Duty Clause citations for failing to address recognized violence hazards.

Sources

1. OSHA, OSH Act Section 5(a)(1) General Duty Clause: The General Duty Clause requires employers to keep the workplace free from recognized hazards even without a specific standard.
2. OSHA, 29 CFR 1910.1030 Bloodborne Pathogens standard: Requirements for Exposure Control Plan, HBV vaccination within 10 working days, annual interactive training, and sharps injury log.
3. OSHA, 29 CFR 1910.1200 Hazard Communication standard: Requirements for written HazCom program, SDS maintenance, labeling of secondary containers, and employee training.
4. OSHA, Hazard Communication Letters of Interpretation: OSHA has confirmed in a letter of interpretation that electronic SDS access is acceptable if employees can reach the information in an emergency without a computer standing in the way.
5. OSHA, 29 CFR 1910.1048 Formaldehyde standard: Formaldehyde action level is 0.1 ppm as an 8-hour TWA; standard requires written compliance program, exposure monitoring, and medical surveillance.
6. OSHA, 29 CFR 1910.132 Personal Protective Equipment: Requires written hazard assessment certification, employer-provided PPE at no cost, and training before use.
7. OSHA, 29 CFR 1910.134 Respiratory Protection standard: Written respiratory protection program, medical evaluations, and fit testing required when employees wear tight-fitting respirators.
8. OSHA, 29 CFR 1904 Recording and Reporting Occupational Injuries and Illnesses: Employers with 10 or fewer employees are partially exempt from 300 log; all employers must report fatalities within 8 hours and hospitalizations within 24 hours.
9. OSHA, 29 CFR 1910.38 Emergency Action Plans: Written EAP required for employers with more than 10 employees; must include evacuation procedures, alarm signals, and employee accounting.
10. OSHA, Civil Penalty Adjustments, 2024 maximum penalty table: Maximum penalty for serious and other-than-serious violations is $16,550; willful and repeat violations up to $165,514 as of 2024; small employer reductions of up to 60%.
11. OSHA, National Emphasis Program for Workplace Violence in Healthcare and Social Assistance: Healthcare workers are five times more likely to experience workplace violence than workers in other industries; healthcare is subject to a national emphasis program.
12. OSHA, State Plans list and overview: Twenty-nine states and two territories operate OSHA-approved state plans that must be at least as effective as federal OSHA.
13. OSHA, Small Business resources and compliance assistance: OSHA provides free compliance assistance tools, templates, and resources specifically for small employers.