An OSHA bloodborne pathogens exposure control program is the written Exposure Control Plan, with the training, hepatitis B vaccination, post-exposure follow-up and record procedures, that 29 CFR 1910.1030 requires of an employer whose employees have occupational exposure to blood or other potentially infectious materials. Integral Healthcare Solutions (IHS) drafts the plan, the exposure determination worksheet, the annual review form, the training outline and the records templates with your safety officer, for you to adopt and run.
It is for clinics, dental offices, laboratories and care facilities. IHS is a consulting firm, not a law firm, and this is not legal advice.
Last updated: November 2026
What does 29 CFR 1910.1030 require of an employer?
It requires a written Exposure Control Plan, an exposure determination, hepatitis B vaccination, post-exposure evaluation, training and records. Section 1910.1030 is OSHA's bloodborne pathogens standard, and paragraph (a) says it applies to all occupational exposure to blood or other potentially infectious materials as paragraph (b) defines them. We read the annual edition of the Code of Federal Regulations revised as of July 1, 2024 (page opened November 2, 2026): GovInfo section 1910.1030. The current eCFR text is at eCFR section 1910.1030; check it for amendments after July 1, 2024.
| Paragraph | Subject | IHS drafts |
|---|---|---|
| (c)(1), (c)(2) | Written Exposure Control Plan and exposure determination | Plan and worksheet |
| (c)(1)(iv) | Annual review and update; safer-device documentation | Annual review form |
| (c)(1)(v) | Front-line employee input on controls | Employee input record |
| (f)(2) | Hepatitis B vaccination and declination | Vaccination tracking form |
| (f)(3), (f)(5) | Post-exposure evaluation and follow-up | Follow-up procedure |
| (g)(2) | Training at assignment and annually | Training outline and schedule |
| (h)(2) | Training records | Training record form |
| (h)(5) | Sharps injury log, where part 1904 applies | Sharps injury log form |
We did not open 29 CFR part 1904 (sharps log applicability) or 29 CFR 1910.1020. Paragraph (h)(1)(iv) says the employer shall maintain the records required by paragraph (h) for at least the duration of employment plus 30 years in accordance with 1910.1020; paragraph (h)(2)(ii) separately says training records are maintained for 3 years. Employee medical records are the employer's, and IHS holds none.
Who needs an exposure control plan and what triggers it?
Under the federal standard, an employer with an employee who has occupational exposure needs one. Paragraph (b) defines occupational exposure as reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials that may result from the performance of an employee's duties. Paragraph (c)(2)(ii) says the exposure determination is made without regard to the use of personal protective equipment.
Common triggers:
- You need a written plan before an inspection or a new location.
- Tasks, procedures or positions with exposure are new or have changed, which paragraph (c)(1)(iv) says calls for a review and update.
- The annual review date has come due.
What must the written plan and the exposure determination contain?
The plan shall contain at least three elements under paragraph (c)(1)(ii): the exposure determination required by paragraph (c)(2); the schedule and method of implementation for paragraphs (d) through (h) of the standard; and the procedure for evaluating the circumstances surrounding exposure incidents as required by paragraph (f)(3)(i).
Paragraph (c)(1)(iii) says each employer shall ensure that a copy of the plan is accessible to employees in accordance with 29 CFR 1910.20(e), which we did not open. Paragraph (d)(2)(i) puts engineering and work practice controls first; where occupational exposure remains after those controls, personal protective equipment shall also be used.
What does the standard require for vaccination and after an exposure incident?
Paragraph (b) defines an exposure incident as a specific eye, mouth, other mucous membrane, non-intact skin, or parenteral contact with blood or other potentially infectious materials that results from the performance of an employee's duties. Paragraph (f)(1)(i) makes the hepatitis B vaccine and vaccination series available to all employees who have occupational exposure, and post-exposure evaluation and follow-up to all employees who have had an exposure incident. Paragraph (f)(1)(ii) adds that all of it is at no cost to the employee and at a reasonable time and place, performed by or under the supervision of a licensed physician or another licensed healthcare professional.
Following a report of an exposure incident, paragraph (f)(3) requires a confidential medical evaluation and follow-up made immediately available, including at least these elements: documentation of the routes of exposure and the circumstances; identification and documentation of the source individual, unless the employer can establish that identification is infeasible or prohibited by state or local law; collection and testing of blood for HBV and HIV serological status; post-exposure prophylaxis, when medically indicated, as recommended by the U.S. Public Health Service; counseling; and evaluation of reported illnesses. Under paragraph (f)(5), the employer shall obtain and provide the employee a copy of the evaluating healthcare professional's written opinion within 15 days of the completion of the evaluation. Sub-paragraphs carry consent and testing conditions not summarized here.
What does bloodborne pathogens training have to cover?
Paragraph (g)(2) requires training at no cost to the employee and during working hours, at initial assignment and at least annually, plus additional training when changes such as modification of tasks or procedures or institution of new tasks or procedures affect the employee's occupational exposure. The additional training may be limited to addressing the new exposures created (paragraph (g)(2)(v)). Materials must suit employees' educational level, literacy and language.
Paragraph (g)(2)(vii) lists fourteen elements, (A) through (N), that the program shall contain at a minimum. In summary form they include the regulatory text, epidemiology and symptoms, modes of transmission, the employer's plan, controls and personal protective equipment, hepatitis B vaccine information, the procedure after an exposure incident, and interactive questions and answers. IHS drafts the outline against the full list.
How IHS helps
IHS runs a gap assessment of your plan and records, maps job classifications and tasks with exposure, drafts the missing documents, mock-reviews the finished file and supports readiness.
IHS drafts the written Exposure Control Plan, the exposure determination worksheet, the annual review form with the safer-device and employee-input documentation, a training outline, schedule and attendance record, a hepatitis B vaccination tracking form, a post-exposure follow-up procedure, and a sharps injury log form.
You supply the job classifications and tasks with exposure, your device and product list, input from front-line staff, the healthcare professional arrangements for vaccination and evaluation, and a trainer. Your safety officer adopts and runs the plan.
The real limit: IHS drafts documents. IHS does not inspect your site, provide medical evaluation or vaccination, deliver clinical training, hold employee medical records, or communicate with OSHA for you.
IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC. IHS works across accreditation consulting, compliance services and program development; this program sits in compliance services.
What to have ready
- Your current Exposure Control Plan, if you have one, with its last review date (paragraph (c)(1)(iv)).
- A list of job classifications and tasks in which employees have occupational exposure (paragraph (c)(2)).
- The sharps and safer medical devices you use (paragraph (c)(1)(iv)(B)).
- Notes from non-managerial front-line staff about devices and controls (paragraph (c)(1)(v)).
- Hepatitis B vaccination offers, acceptances and signed declinations (paragraph (f)(2)).
- Your training outline, dates, trainer qualifications and attendance sheets (paragraphs (g)(2), (h)(2)(i)).
- Training records, which paragraph (h)(2)(ii) says are kept 3 years from the date of the training.
- Whether you must keep an injury and illness log under 29 CFR part 1904, and any sharps injury log you keep (paragraph (h)(5)).
How it compares
This page covers the federal standard only. We did not open any state rule, so ask your counsel whether a state rule applies where you operate. A written plan from a template is another route. In IHS's reading, the standard ties the plan to your own exposure determination, so a template still has to be fitted to your tasks and positions. Patient privacy sits under a different rule, on the HIPAA Privacy Rule page; the wider offering is on compliance services.
What does a bloodborne pathogens exposure control program cost?
First, government fees: the text we read attaches no fee to writing a plan. Second, consulting fees: IHS scopes each engagement after a free introductory call and does not publish a price. Third, your own staff time: in IHS's reading, your safety lead and clinical managers supply the exposure facts and review each draft.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm.
- It is not a site inspection, medical care or clinical training. IHS drafts documents.
- It is not a guarantee about how OSHA will view your program, and IHS does not communicate with OSHA for you.
Frequently asked questions
What must an exposure control plan contain?
Paragraph (c)(1)(ii) says the plan shall contain at least the exposure determination required by paragraph (c)(2); the schedule and method of implementation for paragraphs (d), (e), (f), (g) and (h); and the procedure for evaluating the circumstances surrounding exposure incidents as required by paragraph (f)(3)(i).
How often must the plan be reviewed?
Paragraph (c)(1)(iv) says at least annually and whenever necessary to reflect new or modified tasks and procedures which affect occupational exposure and to reflect new or revised employee positions with occupational exposure. The review and update also reflect changes in technology that eliminate or reduce exposure to bloodborne pathogens, and document annually the consideration and implementation of appropriate commercially available and effective safer medical devices designed to eliminate or minimize occupational exposure.
Do we need a sharps injury log?
Only if you are an employer required to maintain a log of occupational injuries and illnesses under 29 CFR part 1904. Paragraph (h)(5)(ii) applies the requirement to any employer who is required to maintain that log. We did not open part 1904, so your counsel or safety lead decides whether it covers you.
How often is bloodborne pathogens training required?
At the time of initial assignment to tasks where occupational exposure may take place and at least annually thereafter (paragraph (g)(2)(ii)); annual training is provided within one year of the previous training (paragraph (g)(2)(iv)). Additional training is required when changes such as modification of tasks or procedures or institution of new tasks or procedures affect the employee's occupational exposure. The additional training may be limited to addressing the new exposures created (paragraph (g)(2)(v)).
How long do we keep training records?
Paragraph (h)(2)(ii) says training records shall be maintained for 3 years from the date on which the training occurred.
Do we have to offer hepatitis B vaccination?
If you have employees with occupational exposure, yes. Paragraph (f)(2)(i) says the vaccination shall be made available after the employee has received the hepatitis B vaccine information training required in paragraph (g)(2)(vii)(I) and within 10 working days of initial assignment, unless the employee has previously received the complete series, antibody testing has revealed that the employee is immune, or the vaccine is contraindicated for medical reasons.
Do front-line staff have a role in choosing controls and devices?
Yes. Paragraph (c)(1)(v) says an employer required to establish an Exposure Control Plan shall solicit input from non-managerial employees responsible for direct patient care who are potentially exposed to injuries from contaminated sharps in the identification, evaluation, and selection of effective engineering and work practice controls, and shall document the solicitation in the Exposure Control Plan.
Does the consultant deliver the training?
No. IHS drafts the training outline, schedule and attendance record. Paragraph (g)(2)(viii) says the person conducting the training shall be knowledgeable in the subject matter covered by the elements contained in the training program as it relates to the workplace that the training will address.
Does the consultant talk to OSHA?
No. IHS does not inspect your site, provide medical evaluation or vaccination, deliver clinical training, hold your employees' medical records, or communicate with OSHA for you.