What Is an Exposure Control Plan
An Exposure Control Plan is a written document that identifies jobs and tasks where employees face potential contact with blood or other potentially infectious materials (OPIM), and specifies the engineering controls, work practices, and personal protective equipment (PPE) needed to eliminate or reduce that risk. Under OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030), any workplace with employees who have occupational exposure must have a written plan in place.
For safety managers, this plan serves as your operational blueprint. For homeowners in healthcare situations, such as caring for a family member with a bloodborne illness, it's your safety framework. The plan must be reviewed and updated annually, or whenever job classifications, tasks, or procedures change.
OSHA Requirements and Legal Framework
OSHA mandates that organizations with exposure risk maintain a plan that includes specific elements. The plan must identify positions and job classifications with exposure, list the tasks that create exposure risk, and document how you'll implement standard precautions. You must also include procedures for handling exposure incidents, documenting needlestick injuries and other sharps injuries in a sharps injury log, and providing post-exposure medical evaluation and follow-up at no cost to the employee.
The standard applies to healthcare workers, first responders, laboratory technicians, mortuary staff, and anyone else whose job involves potential contact with human blood or OPIM. Failure to maintain a written plan can result in citations with penalties up to $16,131 per violation as of 2024.
Core Components of Your Plan
- Exposure determination: List every job classification that has exposure risk, even if exposure is occasional. Include specific tasks like phlebotomy, wound care, cleanup of biohazardous spills, or laundry handling.
- Methods of compliance: Document your Universal Precautions approach, engineering controls (sharps containers, biohazard cabinets, needleless systems), and work practice controls (handwashing stations, spill kits, no eating in risk areas).
- PPE requirements: Specify which PPE is required for each task, glove types, lab coats, face protection, and provide employees with the equipment at no cost.
- Incident response procedure: Define immediate steps after exposure, medical evaluation timelines, and testing protocols. Include how you'll report the incident to OSHA if required.
- Training and recordkeeping: Document that all employees received initial training and annual refresher training. Track training dates, content covered, and attendee names.
- Medical surveillance: Outline baseline testing, post-exposure testing schedules, and how you'll handle results and employee counseling.
How to Implement Your Plan
Start by conducting a workplace assessment. Walk through each area and identify every task where Bloodborne Pathogens exposure is possible. Don't assume you know all the tasks, ask employees directly. In healthcare settings, this includes not just clinical staff but housekeeping, maintenance, and administrative staff who handle contaminated materials.
Next, select and implement controls in order of effectiveness. Engineering controls are most effective (sharps containers, self-sheathing needles), followed by work practice controls (handwashing, proper disposal), and finally PPE as the last line of defense. Make the controls practical. If your system is too complex, employees will bypass it.
Train all employees before they start work and annually thereafter. Document the training with sign-in sheets. Train supervisors and managers separately on how to respond to exposure incidents and maintain compliance during safety audits.
Common Questions
- Do homeowners need an Exposure Control Plan? OSHA standards apply to employers, not homeowners providing personal care. However, if you're caring for someone with hepatitis B or C, HIV, or other bloodborne pathogens, creating a simple written plan for yourself using the same principles (gloves, handwashing, spill cleanup) protects your health and follows best practices.
- How often should we update the plan? OSHA requires annual review at minimum. Update it whenever job duties change, new tasks are introduced, equipment or procedures change, or after an exposure incident reveals gaps in your controls.
- What happens during a safety audit? OSHA inspectors will ask to see your written plan, interview employees about their training, observe work practices, check that PPE is available and used correctly, and review your sharps injury log and exposure incident records from the past three years.
Related Concepts
Bloodborne Pathogens are the infectious agents you're controlling for. Universal Precautions is the infection control approach your plan implements. Understanding both deepens your ability to design effective controls.