Exposure Control Plan: What OSHA Requires (with an Outline)

Short answer: any employer with employees who have occupational exposure to blood or other potentially infectious materials needs a written exposure control plan under 29 CFR 1910.1030(c)(1). It must contain the exposure determination, the schedule and method for implementing the standard, and the procedure for evaluating exposure incidents; it must be accessible to employees, reviewed at least annually with safer medical devices considered and documented, and built with documented input from front-line staff. Checked October 10, 2026 against eCFR; not legal advice.

Free, no signup: the SDS binder builder at sdsentry.0xpi.com/sds-binder.html turns a pasted list of the products you keep on site into one printable index of their current safety data sheets.

Who needs a written plan

“Each employer having an employee(s) with occupational exposure … shall establish a written Exposure Control Plan designed to eliminate or minimize employee exposure” (1910.1030(c)(1)(i)). In a dental office that is almost always true, because the standard counts saliva in dental procedures as potentially infectious material; in a medical office it is true wherever staff draw blood, inject or handle specimens. A veterinary clinic needs one only if its exposure determination finds employees with exposure to human blood or other potentially infectious materials as the standard defines them.

What the plan must contain: (c)(1)(ii)

1. The exposure determination required by (c)(2): job classifications in which all employees have occupational exposure; job classifications in which some do; and the tasks and procedures in which exposure occurs for that second group. It is made without regard to PPE ((c)(2)(ii)).
2. The schedule and method of implementation for paragraphs (d) methods of compliance, (e) HIV and HBV research laboratories (not relevant to an office), (f) hepatitis B vaccination and post-exposure follow-up, (g) communication of hazards (labels and training) and (h) recordkeeping.
3. The procedure for evaluating the circumstances surrounding exposure incidents, as (f)(3)(i) requires.

Access, annual review and employee input: (c)(1)(iii)–(vi)

• Accessible to employees in line with 29 CFR 1910.20(e) ((c)(1)(iii)), and available to OSHA on request ((c)(1)(vi)).
• Reviewed and updated at least annually, and whenever new or modified tasks, procedures or positions affect exposure ((c)(1)(iv)). The review must reflect changes in technology that reduce exposure and must document annually the consideration and implementation of appropriate commercially available safer medical devices ((c)(1)(iv)(A)–(B)).
• Employee input on safer devices. You must ask non-managerial employees responsible for direct patient care who are potentially exposed to sharps injuries for input on identifying, evaluating and selecting engineering and work practice controls, and document that you asked in the plan ((c)(1)(v)).

OSHA’s model plan

OSHA publishes a model: Model Plans and Programs for the OSHA Bloodborne Pathogens and Hazard Communications Standards (OSHA 3186, PDF on osha.gov), whose Part 1 is a model exposure control plan. It is dated 2003, and OSHA notes it does not alter compliance responsibilities, so check what you adapt against the current text of 1910.1030.

Fill-in outline

A working skeleton for a small dental, medical or veterinary office. It is an outline, not legal advice, and not a finished plan: every blank depends on your own tasks, devices and providers.

1. Purpose and scope. Practice name ; locations covered ; program administrator .
2. Exposure determination ((c)(2)). All employees exposed in: . Some employees exposed in: , with these tasks and procedures: .
3. Methods of compliance ((d)). Universal precautions ((d)(1)); engineering and work practice controls in use (sharps containers, safety-engineered devices, handwashing facilities) and the schedule for examining and maintaining them ((d)(2)(i)–(iii)); the rule against bending, recapping or removing contaminated needles except where no alternative is feasible or a specific medical or dental procedure requires it, and then only by a mechanical device or one-handed technique ((d)(2)(vii)); PPE provided at no cost ((d)(3)(i)); the written cleaning and decontamination schedule ((d)(4)(i)); regulated waste and sharps containers ((d)(4)(iii)); laundry ((d)(4)(iv)).
4. Hepatitis B vaccination ((f)(2)). Who provides it ; offered within 10 working days of initial assignment, after training; declination form (Appendix A) on file.
5. Post-exposure evaluation and follow-up ((f)(3)). Who the employee reports to ; the healthcare provider ; how the circumstances are evaluated (route of exposure, device, how it happened).
6. Communication of hazards ((g)). Biohazard labels or red containers ((g)(1)); training schedule and content ((g)(2)); see bloodborne pathogens training requirements.
7. Recordkeeping ((h)). Where medical records are kept (confidential, employment plus 30 years) and training records (3 years); sharps injury log if you keep OSHA 300 records.
8. Annual review ((c)(1)(iv)–(v)). Date reviewed ; safer devices considered and adopted ; front-line employees asked, and how .

How SDSentry fits, and what it does not do

SDSentry does not write, store as a template, or review an exposure control plan. It is HazCom software. Where it touches the plan:

• The disinfectants, sterilants and cleaners named in your cleaning and decontamination schedule are hazardous chemicals with safety data sheets; keep them in SDSentry’s SDS library alongside your written HazCom program.
• Annual bloodborne pathogens training can be logged as a Bloodborne pathogens training record that holds the (h)(2) elements (date, contents or summary, trainer name and qualifications, attendee name and job title) and defaults to a one-year retraining date; see the training guide for what that record does and does not capture.
• Needlestick cases on the OSHA 300 log can be marked as privacy cases on SDSentry’s Injury log tab; see the OSHA 300 log guide.

Bloodborne pathogens, sharps and amalgam: the full set

• Bloodborne pathogens training requirements
• Sharps container and disposal requirements
• Dental amalgam separator rule (EPA, 40 CFR 441)

By practice type: dental offices, oral surgery and orthodontic offices, medical offices and urgent care and veterinary clinics.

Sources (checked October 10, 2026)

• eCFR, 29 CFR 1910.1030 — (c)(1) exposure control plan; (c)(2) exposure determination; (d) methods of compliance; (f) vaccination and follow-up; Appendix A declination (eCFR current as of October 7, 2026).
• OSHA 3186, Model Plans and Programs for the OSHA Bloodborne Pathogens and Hazard Communications Standards (2003) — Part 1, model exposure control plan.
• OSHA: Bloodborne Pathogens and Needlestick Prevention.

Educational information only, not legal or compliance advice. Quotations and citations are from the current eCFR text and the agency pages listed above, checked October 10, 2026. State Plan states and state and local agencies can add to these requirements; verify with them or consult a qualified professional.