What written programs does a small HVAC company need for OSHA

Last updated 2026-07-10

Why does an HVAC company need OSHA written programs at all?

OSHA doesn't just want you to work safely. Many of its standards require an actual document, a physical or digital file you can hand an inspector on the spot. The phrase "shall establish and implement" runs through 29 CFR 1910 and 29 CFR 1926. If a standard says that and you don't have the paper, the citation is automatic. Nobody has to get hurt first.

The hazard profile for this trade is serious. Techs work with refrigerants, live electrical panels, rooftop units, tight mechanical rooms, and sometimes open construction sites. The Bureau of Labor Statistics put the nonfatal injury and illness rate for heating, air-conditioning, and refrigeration mechanics and installers at 3.0 cases per 100 full-time workers in 2022, above the private industry average of 2.7. ^[1] That gap is exactly why inspectors watch this trade.

The programs don't have to be 50-page consultant binders. OSHA's small business guidance says a program should fit the size and hazards of the workplace. A five-person shop and a 200-person contractor cover the same topics; the detail scales down. Honest and site-specific beats polished and ignored every time.

Which OSHA standards apply to HVAC: general industry or construction?

Both, depending on the job. That answer trips up a lot of owners, but it's the real one.

When your techs service equipment in an existing building, OSHA usually treats the work under 29 CFR 1910 (general industry). When they install new systems on a construction project, 29 CFR 1926 (construction) takes over. Some jobs blur the line. OSHA's standard interpretation letters say HVAC work on existing buildings can fall under either standard depending on the specific tasks. ^[2]

So your written programs have to cover both sets of hazards. A lockout/tagout program written only to 1910.147 can miss the construction energy-control rules. When a standard shows up in both parts, most safety pros write to the stricter version. That's what I'd do too.

Check your state on top of that. Twenty-nine states and territories run their own OSHA-approved plans, and each must be at least as effective as federal OSHA, though some go further. ^[3] You can confirm which rules govern you at OSHA's state plan directory.

What are the mandatory written programs for most HVAC companies?

Here's the honest list. "Mandatory" means the standard itself requires a written program or written procedures, more than safe behavior.

Hazard Communication (HazCom) | 29 CFR 1910.1200 No size exemption exists. Every employer who uses chemicals needs a written HazCom program, a list of every hazardous chemical on site, Safety Data Sheets for each one, and proof employees were trained. HVAC techs handle refrigerants, brazing flux, coil cleaners, and refrigerant oils, and all of those carry SDSs. The written program has to spell out how you manage labels, where SDSs live, and how training happens. Our hazard communication guide walks through every element.

Lockout/Tagout (LOTO) | 29 CFR 1910.147 If your techs service equipment where unexpected energization could hurt them, you need a written energy control program plus machine-specific procedures for each equipment type. This is one of OSHA's most cited standards year after year, and HVAC work hits it constantly: powering down rooftop units, working inside air handlers, servicing electrical controls. The standard also requires documented annual inspections of each procedure. See our lockout tagout article for the full requirements.

Respiratory Protection | 29 CFR 1910.134 If any employee wears a respirator, even voluntarily, you need a written program. It has to cover selection, medical evaluation, fit testing, use, and maintenance. Techs who spray coil cleaner in tight spaces, work around mold, or recover refrigerant in poor ventilation are candidates for required respirator use. Even if they only wear dust masks voluntarily, you still have to hand them Appendix D of 1910.134 in writing.

Personal Protective Equipment (PPE) | 29 CFR 1910.132 The standard makes you conduct a hazard assessment and certify in writing that it happened, by whom, and on what date. The certification itself is required. That assessment drives your choices on eye protection, gloves, arc flash gear, and the rest. The program is short, and skipping the written certification is one of the easiest citations to earn.

Emergency Action Plan (EAP) | 29 CFR 1910.38 Every employer with more than 10 employees must have a written EAP. Ten or fewer can communicate it orally, but writing it down is smart and takes maybe 30 minutes. The plan covers evacuation procedures, employee accounting, and how to report an emergency.

Electrical Safety | 29 CFR 1910.331-335 (general industry) / 29 CFR 1926.400 (construction) Electrical work sits at the center of HVAC. The standard requires written safe work practices for the tasks employees perform on or near electrical equipment. It doesn't have to be its own binder. It can be a section of your broader program, but the practices have to be written down.

Permit-Required Confined Space | 29 CFR 1910.146 Mechanical rooms, ceiling plenums, attics, and crawl spaces can qualify as permit-required confined spaces. If permit spaces exist in your workplace, you need a written program and a written permit for each entry. If your evaluation finds no permit-required spaces, write that determination down and keep it.

Heat Illness Prevention As of 2024, OSHA has a proposed federal heat rule, but even without a final one, it cites heat hazards under the General Duty Clause. Several state-plan states already require written heat illness prevention plans, including California under Title 8 CCR 3395. ^[4] If your techs work outside or in unconditioned attics in summer, this one matters.

What written programs do HVAC companies need if they work on rooftops or at heights?

Fall protection is the single most cited OSHA construction standard, and rooftop HVAC work triggers it head-on. Under 29 CFR 1926.501, construction workers at six feet or more need fall protection. The written piece comes from 29 CFR 1926.502(k), which requires a written fall protection plan for the narrow cases where conventional fall protection isn't feasible, signed by a qualified person and site-specific. ^[13]

For general industry rooftop work, 29 CFR 1910.28 covers walking-working surfaces, and 1910.30 requires documented training.

Rooftop equipment access rarely triggers just one hazard. On the same job you might face live electrical exposure, a cramped equipment housing, and heat stress. Your written programs have to address the combination, not each hazard in isolation. That's the part generic templates never capture.

Do small HVAC companies (under 10 employees) have fewer written program requirements?

Barely. Size changes a few specific standards and leaves most untouched.

The Emergency Action Plan at 29 CFR 1910.38 lets employers with 10 or fewer employees communicate the plan orally instead of writing it. That's the cleanest size break in the rules.

For Hazard Communication, Lockout/Tagout, Respiratory Protection, and Confined Space, the written requirement has no head-count threshold. A one-person HVAC company that uses refrigerants and services electrical equipment still needs written HazCom and LOTO programs.

OSHA's recordkeeping rule at 29 CFR 1904 partially exempts employers with 10 or fewer employees from the routine injury log (OSHA 300), though you still must report fatalities and severe injuries. ^[5] Recordkeeping isn't a written program in the usual sense, but the logs and documentation duties are real regardless of size.

The practical truth: a four-person shop and a 40-person contractor need nearly the same list of topics. What differs is procedure complexity, not whether the documents have to exist.

What does a written HVAC safety program actually need to contain?

Each standard spells out what its written program must cover. No single universal template satisfies all of them, which is why generic downloads fail audits. Here's what the major programs must include:

Written Program	Key Required Elements	CFR Reference
Hazard Communication	Chemical list, SDS access procedure, labeling system, training documentation	29 CFR 1910.1200(e)
Lockout/Tagout	Scope, rules, techniques, machine-specific procedures, annual inspection records	29 CFR 1910.147(c)(4)
Respiratory Protection	Selection criteria, medical evaluation process, fit test records, maintenance procedures	29 CFR 1910.134(c)
PPE Hazard Assessment	Written certification: job tasks, date, assessor name, PPE selected	29 CFR 1910.132(d)(2)
Confined Space	Space identification, entry permit system, rescue procedures, training records	29 CFR 1910.146(c)
Emergency Action Plan	Evacuation routes, assembly points, emergency contacts, employee accountability	29 CFR 1910.38(c)
Fall Protection (construction)	Site-specific hazard survey, protection measures, rescue procedures	29 CFR 1926.502(k)
Electrical Safety	Safe work practices for each category of electrical work performed	29 CFR 1910.333

The mistake most small companies make is writing generic programs that never mention their real equipment, chemicals, or job sites. An inspector who reads a lockout procedure describing equipment your company doesn't own will ask whether you wrote it or downloaded it untouched. Machine-specific LOTO procedures have to match your actual makes and models.

Does refrigerant handling require its own written program?

No standalone program, but refrigerant work feeds at least three programs you already need. It sits at the crossroads of EPA and OSHA rules, which is where the confusion starts.

On the EPA side, Section 608 of the Clean Air Act requires technicians to be certified and bans venting. That certification runs through EPA-approved organizations and lives on technician cards, not an employer-written program. ^[6]

On the OSHA side, refrigerants are hazardous chemicals with SDSs, so they fall under HazCom. Certain refrigerants at high concentration create asphyxiation or toxicity hazards that your Confined Space and Respiratory Protection programs should name directly. Ammonia refrigeration in large commercial systems triggers 29 CFR 1910.119 (Process Safety Management) above threshold quantities, but shops running common HFCs almost never hit that line.

So refrigerant handling doesn't get its own binder. It gets addressed inside HazCom, Respiratory Protection where it applies, and your PPE hazard assessment.

What OSHA written programs are required specifically for HVAC work in construction settings?

Once your crew steps onto a construction site, 29 CFR 1926 takes over and several programs shift.

29 CFR 1926.21 requires that employees be instructed in hazard recognition and given safety training. This one is less a single document than a stack of documented training records.

29 CFR 1926.502(k) requires a written fall protection plan when conventional fall protection isn't feasible, signed by a qualified person and site-specific.

29 CFR 1926.417 covers lockout and tagging of circuits in construction. The energy control requirements parallel 1910.147 but are legally separate.

29 CFR 1926.1204 is the construction confined space standard, and it carries its own written program and permit requirements distinct from the general industry version.

If you send crews alongside other trades on active sites, they also need documented OSHA training matched to the site hazards. Many general contractors demand proof of OSHA 10 or OSHA 30 before anyone sets foot on the project.

The takeaway is simple. If any part of your business touches construction, your program portfolio needs both the 1910 and 1926 versions of confined space, fall protection, and electrical safety.

How often do HVAC written programs need to be updated?

Some standards set explicit clocks. Others don't.

Lockout/Tagout requires annual inspections of energy control procedures for each machine or equipment type, documented (29 CFR 1910.147(c)(6)). That's not a full rewrite every year, but it is a documented annual look at each machine-specific procedure. ^[10]

Respiratory Protection requires annual fit testing for tight-fitting respirators (29 CFR 1910.134(f)(2)), and the program must be reviewed and updated "as necessary." ^[11]

Hazard Communication sets no fixed interval, but you have to update it whenever new chemicals arrive, new hazards surface, or OSHA revises the standard. HazCom was last significantly updated in 2024 to align with GHS Revision 7, with phased employer compliance deadlines running through 2026. ^[7]

Beyond the mandated timelines, most safety pros review every program after any of these: new equipment, hires for new types of work, an incident, or an OSHA inspection. A standing annual review as a business habit covers most of that ground.

What happens if an HVAC company doesn't have required written programs?

OSHA can cite a missing written program as a serious violation even when nobody got hurt. A serious violation carries a maximum penalty of $16,550 per violation as of January 2024, and OSHA adjusts that figure for inflation each year. ^[8] Willful or repeated violations climb to $165,514 per violation.

One inspection can surface several missing programs at once. Miss HazCom, LOTO, and a documented PPE hazard assessment, and that's three citations at up to $16,550 each before any injury charge lands. OSHA often reduces penalties for small employers and first-time violations, and companies that use the informal conference process frequently negotiate the number down. The starting point is still real money.

The bigger hit is often work you never win. General contractors on commercial projects routinely prequalify subs through services like ISNetworld or Avetta, and a missing LOTO or HazCom program is an automatic disqualifier. Missing programs cost jobs faster than they cost fines.

Want to find your gaps before an inspector does? SafetyFolio's safety program generator walks through the HVAC-specific questions in about 15 minutes and produces programs tied to your real equipment and chemical list.

How do you build HVAC written programs without hiring a consultant?

You don't need a consultant for most of this. You need time and a willingness to answer specific questions about your own operation.

Start with OSHA's free material. The OSHA website carries the full text of every standard, small business compliance guides, and sample written programs for HazCom and several other standards. OSHA's On-Site Consultation Program, funded by OSHA but run by state agencies, gives free confidential visits to small businesses. They can't cite you; they help you find and fix gaps. ^[9] It's genuinely useful and badly underused.

Some programs need equipment-specific content that no template can shortcut, and LOTO is the big one. Walk your shop and every job type you run. List every piece of equipment your techs service. For each one, write the energy sources, the isolation points, and the steps to lock it out. That's your machine-specific procedure. It takes a day or two, not weeks.

For the more structured programs, OSHA's directives and appendices hand you model language to adapt. Appendix C to 1910.134 is a sample written respiratory protection program. Appendix B to 1910.146 lays out confined space decision logic.

If you'd rather not stitch it together by hand, tools like SafetyFolio generate HVAC-specific programs from your answers to operational questions. That's faster than a blank page and more accurate than a generic download.

Either route, the goal is the same: programs that describe what your company actually does. An inspector can spot a real program versus boilerplate almost immediately.

What records do you need to keep alongside your written programs?

Written programs are the foundation, not the whole house. Most standards that require a program also require ongoing records that prove you actually follow it.

For LOTO: annual inspection records for each machine-specific procedure, showing who inspected, which employee was involved, and the date (29 CFR 1910.147(c)(6)(ii)).

For Respiratory Protection: fit test records showing the protocol, the respirator make, model, style, and size, and the pass or fail result, plus medical evaluation and training records.

For HazCom: training records by employee (dates and topics), the chemical inventory list, and SDSs for every chemical on it. "Safety data sheets... shall be readily accessible during each work shift to employees when they are in their work area(s)," says 29 CFR 1910.1200(g)(8). ^[12]

For Confined Space: a written permit for each entry into a permit-required space, kept at least one year.

For injury recordkeeping, companies with more than 10 employees maintain OSHA 300, 300A, and 301 logs. When something goes wrong, an accurate incident report is part of staying compliant and feeds your recordkeeping.

Store all of it where you can find it during an inspection. A shared-drive folder labeled by standard number works fine. A filing cabinet nobody's opened since 2019 does not.

Frequently asked questions

Does a one-person HVAC company need written safety programs?

Yes, for most of them. Hazard Communication (1910.1200), Lockout/Tagout (1910.147), and the PPE hazard assessment (1910.132) have no employee-count exemptions. Any company with even one employee that uses chemicals and services electrical equipment is covered. The Emergency Action Plan at 1910.38 is the main standard that lets employers with 10 or fewer workers communicate the plan orally instead of writing it.

What is the most commonly cited OSHA violation for HVAC companies?

Lockout/Tagout (29 CFR 1910.147) shows up in OSHA's annual top-10 most cited standards and hits HVAC hard because techs work on energized equipment constantly. Missing or inadequate machine-specific written procedures are the most frequent single failure. Hazard Communication (1910.1200) and Respiratory Protection (1910.134) also appear often in HVAC-related citations.

Can I download a free OSHA written program template for HVAC?

OSHA publishes sample programs for some standards, including a model respiratory protection program in Appendix C of 29 CFR 1910.134 and HazCom guidance at osha.gov. The catch with any generic template is that standards like Lockout/Tagout require machine-specific procedures for your actual equipment, which no template can fill in. Use the free samples for structure, then customize for your real operation.

Does OSHA require a written safety program for refrigerant recovery and handling?

There's no single OSHA standard titled "refrigerant handling program." Refrigerants are hazardous chemicals covered by HazCom (1910.1200), and some create asphyxiation risks in enclosed spaces that trigger Confined Space requirements. EPA Section 608 certification handles environmental compliance separately. Your existing HazCom and confined space programs should name refrigerant handling directly to be complete.

Do HVAC companies need a written heat illness prevention program?

If you're in a state with an explicit heat standard, yes. California (Title 8 CCR 3395) requires a written Heat Illness Prevention Plan for outdoor workers, and several other state-plan states have similar rules. Federal OSHA has no final heat standard yet but cites heat hazards under the General Duty Clause. Since HVAC techs work in attics and on rooftops in summer, documenting heat prevention is a real risk-management step regardless of state.

How long does it take to write all the required OSHA programs for a small HVAC company?

Plan for two to four full days from scratch. HazCom and the EAP are quick, maybe two to three hours combined. Lockout/Tagout takes the longest because you need machine-specific procedures for each equipment type you service, which requires a physical walkthrough and an equipment list. Respiratory Protection and Confined Space each take a few hours to write properly. A program generator can cut the total to a few hours.

What is the penalty for not having a written lockout/tagout program?

A missing or inadequate Lockout/Tagout program is typically cited as a serious violation. As of January 2024, OSHA's maximum penalty per serious violation is $16,550. Missing machine-specific procedures often generate multiple citations, one per equipment type or procedure gap. OSHA commonly reduces penalties for small employers and companies that correct fast, but the number is per violation, not per inspection.

Do HVAC companies need an OSHA Illness and Injury Prevention Program (I2P2)?

Federal OSHA has not finalized a general rule requiring a written Injury and Illness Prevention Program, though it has long encouraged one. Several state-plan states, including California (IIPP required under Title 8 CCR 3203) and Washington, do require them. Even where it isn't legally required, a written program covering hazard identification and correction is smart practice and often required by commercial clients and general contractors.

What OSHA training records do HVAC companies need to keep?

Most OSHA standards that require training also require you to document it. HazCom needs records of who was trained and when. Lockout/Tagout needs employee training records. Respiratory Protection needs fit test and training records. Confined Space needs entry training documentation. There's no OSHA-prescribed format; a sign-in sheet with names, dates, and topics satisfies most standards. Keep records at least three years as a general rule.

Does my HVAC company need a written program for electrical safety?

Yes. 29 CFR 1910.331 through 1910.335 requires employers to establish and implement safe work practices for employees working on or near electrical equipment, and those practices must be in writing. HVAC technicians who work with electrical panels, controls, and wiring are covered. The program doesn't need to be a separate document; it can be a section of your broader safety manual, but the written requirement is real.

Do I need separate written programs for each job site?

Generally, no. Your core written programs (HazCom, LOTO, Respiratory Protection, and the rest) cover your company's operations broadly. What changes by site are specific documents like confined space entry permits, fall protection plans for particular roof configurations, and site-specific emergency contacts. Some general contractors require site-specific safety plans as a contract term, which is separate from OSHA's regulatory requirements but matters in practice.

What's the difference between a written safety program and an OSHA safety manual?

A safety manual is a collection document that bundles multiple written programs together. The individual written programs are what OSHA's standards actually require, each covering a specific hazard area. Some companies put every required program into one binder called a safety manual; others keep them as separate files. OSHA doesn't care about the format, as long as each required program contains the elements its standard specifies.

Can OSHA inspect a small HVAC company without a complaint being filed?

Yes. OSHA runs programmed inspections targeting high-hazard industries based on injury rate data, plus follow-up inspections after prior citations. HVAC and mechanical contractors sit in OSHA's high-hazard categories. Unprogrammed inspections triggered by complaints, referrals, or reported injuries are more common for small companies, but a programmed inspection is possible with no complaint history at all.

Sources

1. Bureau of Labor Statistics, Occupational Injuries and Illnesses, 2022: HVAC mechanics and installers had a nonfatal injury and illness rate of 3.0 cases per 100 full-time workers in 2022, above the private industry average of 2.7
2. OSHA, Standard Interpretations: Application of general industry vs. construction standards: OSHA's compliance letters acknowledge that HVAC work on existing buildings can fall under either general industry or construction standards depending on the specific tasks
3. OSHA, State Plans overview page: Twenty-nine states and territories run their own OSHA-approved state plans and must be at least as effective as federal OSHA
4. California Department of Industrial Relations, Title 8 CCR Section 3395, Heat Illness Prevention: California Title 8 CCR 3395 requires a written Heat Illness Prevention Plan for outdoor workers
5. OSHA, Recordkeeping Rule 29 CFR 1904, partial exemptions for small employers: Employers with 10 or fewer employees are partially exempt from routine OSHA 300 log requirements under 29 CFR 1904
6. EPA, Section 608 Technician Certification: EPA Section 608 of the Clean Air Act requires HVAC technicians to be certified and prohibits venting of refrigerants
7. OSHA, Hazard Communication Standard (29 CFR 1910.1200) 2024 Final Rule: OSHA updated HazCom in 2024 to align with GHS Revision 7, with phased employer compliance deadlines running through 2026
8. OSHA, Penalties page, updated January 2024: OSHA's maximum penalty for a serious violation is $16,550 per violation as of January 2024; willful or repeated violations go up to $165,514 per violation
9. OSHA, On-Site Consultation Program for small businesses: OSHA's On-Site Consultation Program offers free confidential workplace visits for small businesses; consultants cannot issue citations
10. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): 29 CFR 1910.147(c)(6) requires annual inspections of energy control procedures with documentation including who performed the inspection and which employees were involved
11. OSHA, 29 CFR 1910.134 Respiratory Protection: 29 CFR 1910.134(f)(2) requires annual fit testing for tight-fitting respirators; Appendix C contains a model written respiratory protection program
12. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: 29 CFR 1910.1200(g)(8) requires SDSs to be readily accessible to employees during each work shift; 1910.1200(e) requires a written HazCom program
13. OSHA, 29 CFR 1926.502 Fall Protection Systems Criteria and Practices: 29 CFR 1926.502(k) requires a written fall protection plan when conventional fall protection is not feasible on construction sites; 1926.501 sets the six-foot trigger height
14. OSHA, Top 10 Most Cited Standards (annual list): Lockout/Tagout (29 CFR 1910.147) and Hazard Communication (29 CFR 1910.1200) consistently appear in OSHA's annual top-10 most cited standards