If any of your employees have occupational exposure to blood, 29 CFR 1910.1030(c)(1)(i) requires you to establish a written Exposure Control Plan “designed to eliminate or minimize employee exposure”. The standard sets out what the plan must contain. It does not write the plan for you, and the entries a downloaded template leaves blank are the ones that make yours yours.

This article walks the plan section by section, in the order the standard itself gives, and tells you what belongs in each entry. Every paragraph designation below was read from two independent verbatim reproductions of the Code of Federal Regulations before it was written down.

Who has to have a written exposure control plan?

The duty sits at 1910.1030(c)(1)(i), and it applies to each employer having an employee with occupational exposure as the standard defines that term. The word that does the work is “written”: an understanding between you and your staff is not a plan, however good it is.

Nothing in that sentence limits it to healthcare. The gate is the definition of occupational exposure at paragraph (b), and whether your people are inside it is a question about what they are expected to do rather than about what industry you are in. We have treated that question at length in our guide to who legally needs bloodborne pathogen training, and the same analysis decides whether you owe a plan.

One boundary is worth stating early, because it catches food businesses. An exposure control plan under 1910.1030 is not the same document as the written procedures a retail food establishment keeps for vomiting and diarrheal events under Food Code § 2-501.11. Different authority, different trigger, different document — and our article on norovirus outbreak cleanup covers the second one. If you serve food and your staff handle blood, you need both.

What must an exposure control plan contain?

Paragraph (c)(1)(ii) states that the plan shall contain at least three elements, and the second of those three expands into five more. That is the whole of the required contents, and it is worth reading as a table of contents rather than as a rule.

The useful consequence is that you are not being asked to invent a structure. Sub-item (B) names five paragraphs of the standard and gives each one its own title, so those five titles plus the exposure determination plus the evaluation procedure are your headings. Seven entries, handed to you.

One of the seven will not apply to you. Paragraph (e) governs HIV and HBV research laboratories and production facilities, which a restaurant, school, gym or warehouse does not operate. The right answer there is a single line saying so, dated and signed off, rather than a heading that is simply missing — a reader who cannot tell the difference between “not applicable” and “not considered” will assume the second.

Why is the schedule and method of implementation the part that matters?

Read sub-item (B) once more and notice what it does not ask for. It does not ask you to describe paragraphs (d) through (h). It asks for the schedule and method of implementation for them.

That is the difference between a plan and a copy of the regulation. A schedule is a date or an interval. A method of implementation is a named person, a named place, a named product, a named container. Almost every generic template reproduces the rules faithfully and leaves all four of those blank, which satisfies the easy two-thirds of (c)(1)(ii) and nothing of the hard third.

There is a second consequence that follows from the list itself, and it is the single most useful thing on this page. Because sub-item (B) reaches paragraph (h) Recordkeeping, your plan has to state the schedule and method by which your records get made and kept. The plan is therefore the document in which you commit to records that have to exist. A plan describing a training log you do not keep is not an incomplete plan; it is a plan that contradicts itself.

The same logic reaches inside paragraph (d). Housekeeping at (d)(4)(i) requires a written schedule for cleaning and decontamination, so that schedule is not an optional extra document — it is part of what (c)(1)(ii)(B) is asking you to write down. Our timed blood spill cleanup procedure is written to be slotted straight into that entry.

The fill-in template: the seven sections the standard asks for

Here is the whole plan, in the order the standard gives it. Write your own answers into the right-hand column and you have a document that matches (c)(1)(ii) element for element.

Two of those seven entries are already written up on this site in the detail a plan cannot carry. The exposure determination and the training entry are both treated in our training requirements guide, and the protective equipment entry is treated in our guide to OSHA PPE requirements for bodily fluid cleanup. Waste containment and the red bag question are covered in biohazard waste disposal rules by waste type. Cite them in your plan if you like, but keep the plan itself specific to your premises.

For the wider picture of how the kit, the procedure and the paperwork fit together, our hub article on what 29 CFR 1910.1030 requires your cleanup kit to contain is the place to start.

What does the plan have to say about the hepatitis B vaccine?

Paragraph (f) is the entry most small employers get wrong, and it is wrong in an interesting way: the obligation is to make the vaccine available, not to vaccinate anybody. Paragraph (f)(1)(ii)(A) requires that it be “Made available at no cost to the employee”.

The timing is at (f)(2)(i), and it contains two clocks that interlock. The vaccine is made available “after the employee has received the training required in paragraph (g)(2)(vii)(I)” and “within 10 working days of initial assignment”. Read together, that means the training element about the vaccine has to happen inside the same ten working days, because the offer cannot legally come before it.

The same paragraph carves out three situations in which the offer is not required: where “the employee has previously received the complete hepatitis B vaccination series”, where “antibody testing has revealed that the employee is immune”, or where “the vaccine is contraindicated for medical reasons”. Those are conclusions about an individual, so the plan should say who establishes them and where that is recorded.

Sub-paragraph (f)(2)(iii) is the one to write into your plan in plain words, because it is the one a busy manager will otherwise treat as settled. A declination is not a permanent answer. If the same person changes their mind two years later, the offer is live again, at no cost, and your plan should say who they tell.

On the vaccine itself, the Centers for Disease Control and Prevention puts it plainly: “Vaccination is the best way to prevent hepatitis B”, and CDC “recommends vaccination for nearly everyone and screening all adults at least once in their lifetime”. That is public health guidance rather than a workplace rule, and the workplace rule is the narrower one above.

The one page of the plan the standard writes for you

Almost all of 1910.1030 tells you what to achieve and leaves the wording to you. There is exactly one exception, and it is a form. Appendix A to section 1910.1030 is headed “Hepatitis B Vaccine Declination (Mandatory)”, and (f)(2)(iv) requires an employee who declines the vaccine to sign the statement it contains.

Because it is mandatory and short, it should be reproduced rather than paraphrased. These are its phrases, in order, each one read from two independent verbatim reproductions of the regulation:

They are printed as separate phrases on purpose. Our primary sources return short excerpts rather than whole paragraphs, so stitching these into one block quote and calling it verbatim would be a small dishonesty. Take the statement itself from the regulation, which is linked at the end of this article, and reproduce it in full on your form with a line for the name, the signature and the date.

Notice what the signed statement is actually evidence of. It records that an offer was made at no charge, which is your obligation, and that the employee declined, which is theirs. A declination form you have never issued proves nothing either way, which is why the plan should name the person who holds the blanks.

Where does the plan have to live, and who can ask to see it?

Paragraph (c)(1)(iii) requires that a copy of the plan be accessible to employees. The cross-reference printed in the text points at 29 CFR 1910.20(e), an older section number for OSHA’s access to records rule, which now appears at 29 CFR 1910.1020, titled “Access to employee exposure and medical records”, with paragraph (e) headed “Access to records”.

The word in (c)(1)(iii) is accessible, not available, and for a small business that distinction decides where the document lives. A plan in the owner’s email account is not reachable by a closing shift at ten at night. A printed copy in the same cupboard as the cleanup kit is.

Paragraph (c)(1)(vi) adds a second audience: the plan shall be made available to the Assistant Secretary and the Director on request, for examination and copying. In practice that means the plan has to survive being read by somebody who was not there when you wrote it, which is another argument for naming people and places rather than restating the rules.

What does the annual review actually require?

Paragraph (c)(1)(iv) says the plan “shall be reviewed and updated at least annually” and “whenever necessary to reflect new or modified tasks and procedures”, and “to reflect new or revised employee positions with occupational exposure”. Three triggers, only one of which is a date.

The review itself then carries two duties of its own. Sub-item (c)(1)(iv)(A) requires it to “Reflect changes in technology that eliminate or reduce exposure to bloodborne pathogens”. Sub-item (c)(1)(iv)(B) requires you to “Document annually consideration and implementation of appropriate commercially available” “and effective safer medical devices designed to eliminate or minimize occupational exposure”.

Sub-item (B) is a documentation duty, which has a consequence worth being clear about: a review that changes nothing still has to produce a record that it happened. If your business uses no medical devices at all, the honest entry is a dated line saying the consideration was made and nothing applicable was found. Silence looks identical to neglect.

The practical move is to put the review on the same cycle as something you already do annually, and to add one line to your plan listing the events that force an early review. A plan reviewed last March and signed is a strong document. A plan reviewed last March that still describes a role you deleted in June is a weak one.

Do you have to ask your staff for input on the plan?

This paragraph is quoted far more loosely than it reads. (c)(1)(v) requires an employer to “solicit input from non-managerial employees responsible for direct patient care” who are “potentially exposed to injuries from contaminated sharps”, “in the identification, evaluation, and selection of effective engineering and work practice controls”, and to “document the solicitation in the Exposure Control Plan”.

There are two conditions there, and both have to be met. The employee has to be responsible for direct patient care, and the exposure in question has to be to injuries from contaminated sharps. A restaurant, a school office, a gym or a retail store generally has neither, so the documented solicitation duty does not attach to them.

That is a finding to write into the plan, not a heading to leave out. One dated sentence recording that the business employs nobody responsible for direct patient care, and that (c)(1)(v) therefore does not apply, is a better answer than an inherited clinic template promising a consultation you never held. The annual review at (c)(1)(iv) applies to you either way.

And there is a reason to ask anyway, even where the paragraph does not compel it. The people who will pick up the kit at the worst possible moment are the ones who know whether it is in the right cupboard.

Frequently Asked Questions (FAQ)

Does a restaurant need a bloodborne pathogen exposure control plan?

It depends on whether any employee has occupational exposure to blood as 1910.1030 defines it, not on the industry. A restaurant whose staff are expected to deal with a blood spill or to render first aid is inside the standard, and 1910.1030(c)(1)(i) then requires a written plan. The analysis of who is covered is the same one that decides who needs training.

Is there an official exposure control plan template we have to use?

The standard prescribes contents rather than a format. Paragraph (c)(1)(ii) lists the three required elements, and the second of them names five further paragraphs of the standard, which between them give you seven headings. The only mandatory wording anywhere in the plan is the hepatitis B vaccine declination statement in Appendix A.

Does the exposure control plan have to be in writing?

Yes. The wording of 1910.1030(c)(1)(i) is that the employer shall establish a written Exposure Control Plan. A verbal arrangement, however well understood, does not meet it, and neither does a plan that exists only as a set of habits.

How often does an exposure control plan have to be updated?

At least annually under 1910.1030(c)(1)(iv), and also whenever necessary to reflect new or modified tasks and procedures and new or revised employee positions with occupational exposure. The annual review also has to document consideration of appropriate commercially available and effective safer medical devices.

Who has to be able to see our plan?

Employees, under 1910.1030(c)(1)(iii), which requires a copy to be accessible to them. Paragraph (c)(1)(vi) adds that the plan shall be made available to the Assistant Secretary and the Director on request. Accessible to employees is the harder of the two tests in practice, because it decides where the document physically lives.

Do we have to pay for the hepatitis B vaccine?

Where the standard requires it to be made available, yes. Paragraph (f)(1)(ii)(A) requires it to be made available at no cost to the employee, and (f)(2)(ii) prevents an employer from making participation in a prescreening program a prerequisite for receiving it.

What happens if an employee refuses the hepatitis B vaccine?

Paragraph (f)(2)(iv) requires an employee who declines to sign the statement in Appendix A, which is headed as mandatory. The refusal is not final: under (f)(2)(iii), if that employee later decides to accept, the employer shall make the vaccination available at that time.

Do we have to ask employees for input on the plan?

Paragraph (c)(1)(v) requires it only for non-managerial employees responsible for direct patient care who are potentially exposed to injuries from contaminated sharps, and it requires the solicitation to be documented in the plan. Most small businesses employ nobody in that description, and the useful response is to record that conclusion in the plan rather than to omit the section.

Build the plan around a kit you can actually point at

Section 2 of your plan has to name the protective equipment you provide and say where it is kept, and section 7 has to describe how an incident gets written up. Both entries get shorter and more credible when there is a single labelled place in the building that holds the answer.

Our Bloodborne Pathogen and Vomit Cleanup Kit in the bag format and the same kit in the box format contain absorbent powder, towels or wipes, disposable gloves, face masks with shields, shoe covers, aprons, a scraper, biohazard disposal bags, an instruction sheet in English and Spanish, and an incident report form. The bilingual sheet speaks to your communication of hazards entry and the report form speaks to your evaluation of exposure incidents entry.

Neither kit is sold with a disinfectant, so confirm your own stock of an EPA registered product carrying the organism claim you need on its label, and name that product in section 2 of the plan. A job aid in a kit is not training and it is not a plan — it is the thing your plan points at. You can see both formats and the pack sizes in the blood cleanup kits collection, and the bag format is the one most small premises start with.

Primary sources. The text of the standard is at 29 CFR 1910.1030 (Cornell LII), including Appendix A. The access to records rule the plan cross-refers to is at 29 CFR 1910.1020. CDC’s position on the vaccine is at Clinical Overview of Hepatitis B. Paragraph designations change between editions of secondary write-ups, so work from the regulation itself.

Magnicare Safety Team