How to review a bloodborne-pathogens exposure control plan
A written bloodborne-pathogens Exposure Control Plan (ECP) can be current on the day it is approved and wrong a few months later. A new clinical procedure, a different staff role or a safer sharps device changes how occupational exposure should be assessed. Federal OSHA's 29 CFR 1910.1030(c)(1)(iv) requires the plan to be reviewed and updated at least annually, and whenever necessary to reflect new or modified exposure-related tasks, procedures or positions.
This is a focused guide to the review decision and evidence trail, not a complete model ECP or medical post-exposure protocol. It applies to employers with employees who have “occupational exposure” to blood or other potentially infectious materials under the federal standard. Check the actual work and any applicable OSHA-approved State Plan. Do not assume every healthcare or cleaning job has the same exposure classification, or that a general risk-assessment document replaces the required ECP.
Start with the exposure determination
The ECP must identify job classifications where all employees have occupational exposure and those where some employees do. For the latter group, it must identify the relevant tasks and procedures. Under 1910.1030(c)(2), the exposure determination is made without regard to the use of personal protective equipment. “They wear gloves” is therefore not a reason to omit a task from the determination.
At review, compare the written list with the current roster, job descriptions and work as actually performed. Has a role begun collecting specimens, handling contaminated laundry, responding to injuries or disposing of sharps? Has a procedure moved to a different team or site? If a role has changed, document the old and new exposure decision and the reason. The OSHA enforcement directive explains why an accurate role and task list matters: it drives who receives the standard's training, protective equipment, vaccination and related protections.
Review controls and safer-device decisions
The ECP review must reflect changes in technology that eliminate or reduce exposure. It must also document annually the consideration and implementation of appropriate commercially available and effective safer medical devices. This is a decision record, not a requirement to buy every marketed product or a box ticked by saying “none available”. Record which tasks and devices were considered, who assessed them, what was selected or rejected, and the practical reason.
Where the employer is required to have an ECP, 1910.1030(c)(1)(v) also requires input from non-managerial employees responsible for direct patient care who are potentially exposed to contaminated-sharps injuries when identifying, evaluating and selecting effective engineering and work-practice controls. Document how that input was requested and considered. OSHA's safer-needle explanation gives examples of acceptable evidence, such as meeting records or responses. The exact input requirement follows the employees and exposure described in the regulation; do not mechanically apply a direct-patient-care rule to an unrelated workplace.
The plan should also retain a schedule and method for implementing the standard's relevant control, vaccination and follow-up, hazard-communication and recordkeeping provisions. A one-page annual sign-off without checking those underlying sections does not show that the plan still matches practice.
Use incidents and operational change as review triggers
An exposure incident, a new procedure or an ineffective engineering control may reveal that a task is missing or a measure no longer works. The ECP must state the procedure for evaluating the circumstances of exposure incidents under 1910.1030(c)(1)(ii)(C). Feed lessons from those evaluations into the next plan decision, without copying confidential medical details into the plan.
Some employers covered by the bloodborne-pathogens standard must also keep a sharps injury log under 1910.1030(h)(5). OSHA's sharps-log interpretation recommends reviewing it as part of the annual ECP update to identify devices or activities needing attention. Check whether the log duty applies to the establishment and protect employee privacy. Do not treat the log as a substitute for incident follow-up or the plan itself.
| Review question | Evidence to inspect | Action if the answer changed |
|---|---|---|
| Are the exposed roles and tasks still correct? | Current job duties, procedure changes, exposure determination | Update the lists and affected protections. |
| Have safer controls become available or practical? | Device evaluation, employee input, incident patterns | Document consideration and implementation decision. |
| Does the written method match the actual work? | Work-practice observations, training content, vaccination/follow-up routes | Revise the plan and communicate the change. |
| Can employees access the current plan? | Current controlled version, access route and superseded-version record | Replace outdated copies and tell affected staff where to find the current one. |
Keep the review separate from annual training
The standard also requires training at initial assignment and at least annually thereafter for employees with occupational exposure, with additional training when changes create new exposure. That is 1910.1030(g)(2). An ECP review and a training session are linked but are not the same event. First determine what changed; then ensure the people affected receive understandable information on the changed tasks and controls. Record the plan version and training decision so an auditor can follow the sequence.
Maintain a dated review record showing participants, source evidence, each change considered, the revised plan version, approval and communication to affected employees. If no text change was needed, document what was checked and why the existing plan remained accurate. Do not manufacture a “reviewed” date for a plan that was simply re-saved. Make the current plan accessible to employees as the rule requires, while keeping individual medical and exposure-incident information in the proper restricted records.
For a broader view of safety programme records, Complys US OSHA compliance software is the relevant commercial starting point. Ask the product team to demonstrate the actual record and training workflows before specifying an implementation. This guide does not claim that Complys automatically performs an OSHA ECP review, selects safer devices, provides clinical follow-up or determines legal compliance.
Primary sources and publication gate
- OSHA 29 CFR 1910.1030: scope, ECP content, annual and change-triggered review, exposure determination, staff input and training.
- OSHA enforcement procedures: inspection treatment of the plan and exposed roles/tasks.
- OSHA safer-needle revision explanation: safer-device review and employee-input documentation.
- OSHA sharps-log interpretation: log review as part of programme evaluation.
Before publication: Recheck the current federal standard, applicable State Plan, exact destination and current live/in-flight owner. Preserve the existing generic written-programme page as the broad owner and link to this guide only for the specific ECP review task.
For the related Complys product, see OSHA Compliance Software. This guide is general information, not legal advice; verify current requirements against the official sources linked above.