An exposure control plan (ECP) is a written plan that OSHA's bloodborne pathogens standard requires of every employer with employees who have occupational exposure to blood or other potentially infectious materials. It identifies which jobs and tasks involve exposure and explains how the employer will eliminate or minimize that exposure.
The ECP matters because it is the backbone of a bloodborne pathogens program. It ties together engineering controls, work practices, PPE, hepatitis B vaccination, post-exposure follow-up, training and records. OSHA inspectors routinely ask for it, and an outdated or generic plan is one of the most frequently cited problems under the standard.
What Is an Exposure Control Plan?
Under 29 CFR 1910.1030(c)(1), each employer with an employee who has occupational exposure must establish a written exposure control plan designed to eliminate or minimize employee exposure. Occupational exposure means reasonably anticipated skin, eye, mucous membrane or parenteral contact with blood or other potentially infectious materials that may result from an employee's duties.
The standard covers healthcare, but also many other workplaces: first responders, designated first aid providers, laboratory staff, housekeeping and janitorial workers who handle contaminated waste, and others. If an employee is assigned to give first aid as part of their job, the employer generally needs an ECP.
What an ECP Must Include
At a minimum, the plan must contain:
- The exposure determination required by paragraph (c)(2).
- The schedule and method of implementation for methods of compliance, hepatitis B vaccination and post-exposure evaluation and follow-up, communication of hazards to employees, and recordkeeping.
- The procedure for evaluating the circumstances surrounding exposure incidents.
Exposure determination
The exposure determination lists:
- Job classifications in which all employees have occupational exposure.
- Job classifications in which some employees have occupational exposure.
- The tasks and procedures, or groups of closely related tasks, in which exposure occurs for those partially exposed classifications.
The determination must be made without regard to the use of personal protective equipment. A nurse who wears gloves still has occupational exposure, because gloves can tear and splashes can reach unprotected skin.
Methods of compliance the plan describes
- Universal precautions.
- Engineering controls, such as sharps disposal containers and safer medical devices like self-sheathing needles and needleless systems.
- Work practice controls, such as handwashing and not recapping needles.
- Personal protective equipment provided at no cost to employees.
- Housekeeping, decontamination, laundry and regulated waste handling.
Annual Review and Updates
The ECP must be reviewed and updated at least annually, and whenever necessary to reflect new or modified tasks and procedures that affect exposure, or new or revised employee positions with exposure. The annual review must also:
- Reflect changes in technology that eliminate or reduce exposure to bloodborne pathogens.
- Document the employer's annual consideration and implementation of appropriate commercially available and effective safer medical devices.
Employers must solicit input from non-managerial employees responsible for direct patient care who are potentially exposed to injuries from contaminated sharps when identifying, evaluating and selecting engineering and work practice controls. That solicitation must be documented in the plan.
Access and Related Program Requirements
The plan must be accessible to employees in accordance with OSHA's access to records rule, and available to OSHA and NIOSH on request. Related requirements that the ECP should describe include:
- Hepatitis B vaccination: made available at no cost, after training and within 10 working days of initial assignment, unless an exception applies. Employees who decline must sign the declination statement in the standard.
- Training: provided at initial assignment and at least annually thereafter, within one year of the previous training, and when tasks change and affect exposure.
- Sharps injury log: required for employers who must keep OSHA 300 injury and illness logs.
- Records: medical records kept for the duration of employment plus 30 years, and training records kept for 3 years. See employee exposure and medical records.
Evaluating Exposure Incidents
The ECP must describe how the employer evaluates the circumstances surrounding an exposure incident, such as a needlestick or a splash to the eyes. After an incident, the standard requires the employer to make a confidential medical evaluation and follow-up available to the exposed employee right away. The evaluation of circumstances should look at the engineering controls and work practices in use, the device involved, and the PPE worn, so the plan can be improved to prevent a repeat.
How to Write and Maintain an ECP Step by Step
- Identify exposed jobs. List every job classification and task with reasonably anticipated exposure, without considering PPE.
- Select controls. Choose engineering controls, safer devices and work practices, with input from frontline employees.
- Specify PPE. Define which PPE is required for each task and how it is provided, cleaned and replaced.
- Set up vaccination and follow-up. Arrange hepatitis B vaccination and a post-exposure evaluation process with a healthcare provider.
- Plan training. Schedule initial and annual training with an opportunity for questions.
- Define recordkeeping. Describe medical, training and sharps injury log records and who maintains them.
- Review annually. Update the plan, document safer device evaluations and employee input, and record the review date.
Common Mistakes to Avoid
- Using a generic template without site-specific job classifications and tasks.
- Making the exposure determination based on PPE use.
- Skipping or failing to document the annual review and safer device evaluation.
- Not soliciting or documenting input from frontline healthcare employees.
- Overlooking designated first aid providers, custodians or maintenance staff who handle contaminated items.
- Keeping the plan where employees cannot access it.
How SMS360 Helps
SMS360's Document Library keeps the current ECP version accessible, with review dates and revision history. Training Management tracks initial and annual bloodborne pathogens training, and Incident Management records exposure incidents and follow-up actions.
Read the full standard at 29 CFR 1910.1030 on eCFR.
Frequently Asked Questions
Who needs an exposure control plan?
Any employer with one or more employees who have occupational exposure to blood or other potentially infectious materials. This includes healthcare, labs, emergency responders and employers who designate employees to provide first aid.
How often must the ECP be updated?
At least annually, and whenever new or changed tasks, procedures or positions affect exposure. The annual review must document consideration of safer medical devices.
Can employees see the exposure control plan?
Yes. The plan must be accessible to employees under OSHA's access to employee exposure and medical records rule.
Does the ECP need to list PPE?
The plan describes how the employer will implement PPE requirements, but the exposure determination itself must be made without regard to PPE.
