Exposure control plan

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The plan follows an exposure determination

First identify job classifications in which all employees have occupational exposure. For classifications where only some employees are exposed, identify the tasks and procedures that create exposure.

Under 29 CFR 1910.1030, occupational exposure is reasonably anticipated skin, eye, mucous-membrane, or parenteral contact with blood or other potentially infectious materials from employee duties. The determination is made without considering PPE.

Review real work across sites and shifts. Assigned first aid, blood-spill cleanup, contaminated laundry, human bites that break skin, and sharps handling may matter. Job title, client diagnosis, or being inside a clinic is insufficient by itself.

Required content becomes an operating system

The plan includes the exposure determination, schedule and method for implementing required controls and provisions, and the procedure for evaluating exposure incidents. Translate those requirements into names, locations, supplies, contacts, and evidence.

A useful site section states:

• covered classifications, tasks, and owners
• engineering and work-practice controls
• PPE selection, storage, cleaning, replacement, and disposal
• hand hygiene, housekeeping, laundry, sharps, and waste procedures
• training and hepatitis B vaccination route
• immediate exposure response and medical-evaluation contact
• source-individual and privacy workflow
• incident evaluation, records, and corrective action
• access to the current plan

The OSHA Bloodborne Pathogens overview summarizes these protection measures. The regulatory text governs details.

Controls come before reliance on PPE

Use universal precautions for covered blood and body fluids. Engineering controls isolate or remove hazards. Work-practice controls change how employees perform tasks. PPE provides a task-specific barrier for remaining exposure.

Ensure handwashing access, appropriate spill supplies, safe sharps containers where applicable, cleanable equipment, task-specific PPE, and approved disposal routes. Required PPE is provided, cleaned, repaired, and replaced at no cost to employees.

Train employees to stop and seek help when supplies, training, or conditions differ from the plan. A manager’s verbal instruction during an incident should not invent a new high-risk task.

Make medical support work after hours

Employees with occupational exposure receive the required hepatitis B vaccination offer after training and within the standard’s initial-assignment period, subject to stated exceptions. Track the offer and confidential medical process.

After an exposure incident, employees need immediate first steps, reporting, and confidential medical evaluation and follow-up. The plan should name a primary and after-hours route and define transportation when needed.

Source-individual identification and testing follow feasibility, consent, and state or local law. Supervisors should preserve facts and privacy, then allow the qualified medical process to operate.

Evaluate every exposure incident

Document the route, circumstances, task, controls in use, PPE, equipment, training, and immediate response. Review how the incident occurred and whether engineering or work-practice changes could prevent recurrence.

Avoid treating the employee as the cause by default. Look at staffing, layout, supply placement, unclear assignments, equipment, time pressure, and plan usability. Share corrective learning without exposing confidential medical information.

A fictional thirteen-control review

Lark ABA identifies thirteen plan controls due before staff with occupational exposure begin work. Eleven pass. The after-hours medical route is untested, and one spill kit contains an expired component.

Readiness is 11 of 13, or 84.6%. Lark replaces the component, tests the call route, and records who answered, what information was requested, and how an employee would reach care. Both controls remain in the denominator until accepted.

The team separately reports eight covered job classifications and does not use thirteen as an employee count. Controls and roles are different units.

Review at least annually and after change

The standard requires review and update at least annually and when new or modified tasks, procedures, or positions affect exposure. Applicable plans also address technology and safer devices, with required employee input for covered sharps contexts.

Update after an exposure incident, new site, new equipment, contractor change, role redesign, or unavailable medical route. Keep the active version accessible and archive prior versions according to the record policy.

Check the OSHA state-plan directory for each worksite. State requirements and enforcement procedures may differ or be more stringent.

Track plan reviews completed by due date, covered employees trained, vaccination offers completed, kits ready, incidents evaluated, and corrective actions closed. Use a clear due cohort for each measure.

Version the plan by site and effective date, retain approval evidence, and confirm that covered employees can reach the current procedure during every shift.

Declare the plan ready only when exposure determinations, controls, supplies, training, vaccination route, after-hours medical pathway, records, and incident response work for every covered role and shift. Keep a failed gate open, apply an interim control within qualified authority, and retest before exposure begins.