Written and maintained by CASRAI Editorial Board
Last updated
A hospital’s written Exposure Control Plan (ECP) is the document 29 CFR 1910.1030(c)(1) requires from every employer with employees who have occupational exposure to blood or other potentially infectious materials (OPIM). In a hospital, that population is large and varied — nursing, phlebotomy, environmental services, sterile processing, surgical services, and behavioral health staff who face bite or restraint-related exposure all belong in it, not just laboratory personnel. This page covers what the plan has to contain for a hospital specifically: the sharps-focused engineering controls the standard was rewritten around in 2001, the annual review language that names direct-patient-care staff by name, and how the post-exposure evaluation and follow-up requirement connects to your Employee Health or Occupational Health department. For the exposure-determination and methods-of-compliance mechanics as they apply to a research laboratory instead — a materially different exposure profile — see Exposure Control Plan for Bloodborne Pathogens: The Five Elements 29 CFR 1910.1030(c) Requires.
Why the Hospital Version of This Plan Looks Different From a Lab’s
29 CFR 1910.1030 is one standard, but two of its paragraphs point in genuinely different directions depending on the setting. Paragraph (e), HIV and HBV Research Laboratories and Production Facilities, imposes extra containment and facility requirements — but by its own scope language it “applies to research laboratories and production facilities engaged in the culture, production, concentration, experimentation, and manipulation of HIV and HBV,” and explicitly “does not apply to clinical or diagnostic laboratories engaged solely in the analysis of blood, tissues, or organs.” A hospital’s own clinical or diagnostic lab is generally outside paragraph (e) for that reason — it only comes into play if the hospital also runs an HIV/HBV research or production operation on top of routine patient care and diagnostics, which is unusual outside academic medical centers.
What a hospital ECP has to get right instead is paragraph (c)(1)(v), added by the Needlestick Safety and Prevention Act amendments effective January 18, 2001: it requires soliciting input specifically from “non-managerial employees responsible for direct patient care who are potentially exposed to injuries from contaminated sharps” on engineering and work-practice controls, and documenting that solicitation in the plan itself. That clause was written with a hospital floor in mind, not a bench lab — it is the regulatory core of the hospital-specific version of this plan.
Element 1: The Exposure Determination, Built at the Unit Level
1910.1030(c)(2) requires an exposure determination made “without regard to the use of personal protective equipment” — you classify exposure by what the job requires someone to be near or handle, not by whether they currently wear gloves. For a hospital, that determination has to be built job-classification by job-classification and department by department, not as a single blanket “clinical staff” entry:
- All employees have exposure: registered nurses on inpatient units, phlebotomy/lab-draw staff, ED and trauma bay staff, OR and procedural staff, sterile processing technicians handling used instruments.
- Some employees have exposure, for specific tasks: environmental services staff handling sharps containers or contaminated linen, security or behavioral-health staff involved in a restraint where a bite or scratch is possible, respiratory therapy performing suctioning or airway procedures, dietary or transport staff who occasionally enter isolation rooms.
A plan that lists “clinical staff” as a single entry, without naming the tasks that create exposure for each classification, has not actually satisfied (c)(2) — the same deficiency OSHA inspectors cite most often in exposure determinations generally, whether the setting is a hospital or a lab.
Element 2: Methods of Compliance — Sharps-Specific Engineering Controls
Paragraph (d) sets the substantive controls: Universal Precautions, engineering and work-practice controls, PPE, and housekeeping. The ECP’s job under (c)(1)(ii) is to document how and when the hospital actually implements them. For a hospital, this section of the plan should name, specifically:
- Where safety-engineered sharps devices (retractable/shielded needles, needleless IV connectors) are deployed, and the process for evaluating new devices as they come to market.
- Sharps container placement and replacement schedule at the point of use — every patient room and procedure area, not a central supply room.
- The work-practice rule against recapping, bending, or manually manipulating used needles, and how it’s enforced across shifts.
- How sharps injuries feed into the hospital’s own sharps injury log — a separate record from the OSHA 300 Log, required under 1910.1030(h)(5) with its own three data fields and confidentiality rule. See Sharps Injury Log vs. OSHA 300 Log for exactly what has to be captured and how the two records differ.
Element 3: The Annual Review, With Frontline Input Named in the Regulation
1910.1030(c)(1)(iv) requires the plan to be “reviewed and updated at least annually and whenever necessary to reflect new or modified tasks and procedures which affect occupational exposure,” and (c)(1)(iv)(B) specifically requires the employer to “document annually consideration and implementation of appropriate commercially available and effective safer medical devices designed to eliminate or minimize occupational exposure.” That review can’t be a desk exercise: (c)(1)(v) requires soliciting the non-managerial, direct-patient-care employees named above in the identification, evaluation, and selection of those controls, and documenting how that input was gathered.
In practice, hospitals operationalize this through unit-based safety committees, nurse-led device trials before a new sharps product is adopted house-wide, and a documented sign-off trail (meeting minutes, trial feedback forms, or a committee roster) attached to the plan at each annual review. A plan that states the review happened without recording who was consulted and what device options were evaluated does not meet (c)(1)(v) as written.
Element 4: HBV Vaccination, Post-Exposure Evaluation, and PEP
Paragraph (f) is where the hospital’s Employee Health or Occupational Health department becomes the operational owner of this section of the plan. It requires the employer to make the Hepatitis B vaccine series available at no cost to any employee with occupational exposure, within 10 working days of initial assignment, and to offer a documented declination for anyone who chooses not to receive it (with the option to accept later if they change their mind). It also requires a defined post-exposure evaluation and follow-up procedure that must be made immediately available after a reported exposure incident, including documenting the exposure route and circumstances, testing the source individual (where legally permitted and the source can be identified), providing the exposed employee’s test results and applicable state/local law information, and offering post-exposure prophylaxis where indicated, medical evaluation of any reported illness, and counseling.
HIV post-exposure prophylaxis specifically is time-sensitive by current clinical guidance — it is most effective when started as soon as possible after exposure and is generally not recommended once a substantial window has passed. The ECP itself should name where that first-hour response lives operationally (typically Employee Health during business hours and the ED after hours) and route staff to it, rather than trying to restate full first-aid and PEP-initiation steps inside the plan document. For the step-by-step first-hour actions themselves, see Needlestick Injury Response: The First-Hour Protocol.
Element 5: Communication of Hazards and Recordkeeping
Paragraph (g) requires biohazard labels on containers of regulated waste, contaminated laundry, and specimens, plus the initial and at-least-annual bloodborne pathogens training the standard requires for every employee with occupational exposure — content elements are enumerated at (g)(2)(vii), including modes of transmission, the ECP itself, and PPE selection and use. Paragraph (h) requires two categories of records: a medical record for each exposed employee (vaccination status, exposure incident details, and post-exposure evaluation results), kept confidential and retained for the duration of employment plus 30 years, and a training record for each session (dates, content summary, trainer, and attendee names), retained for three years.
Where This Plan Differs From a Research-Lab ECP, Side by Side
| Element | Hospital ECP | Research-Lab ECP |
|---|---|---|
| Paragraph (e) applicability | Generally out of scope — routine clinical/diagnostic work is excluded | In scope if culturing/producing/concentrating HIV or HBV |
| Exposure determination unit | Nursing units, ED, OR, sterile processing, EVS | Job classifications by bench task and cell line/agent |
| Primary sharps risk | IV starts, blood draws, injections at the bedside | Needle/syringe use in culture and animal work |
| Post-exposure owner | Employee/Occupational Health, ED after hours | Occupational health service tied to biosafety office |
Both versions answer to the same regulatory text, which is why the document structure — exposure determination, methods of compliance, HBV vaccination and post-exposure follow-up, hazard communication, recordkeeping, annual review — is identical. What changes is who’s named in the exposure determination, which controls actually reduce risk on a hospital floor versus at a bench, and (for a hospital) the (c)(1)(v) frontline-input requirement that has no real analogue in a lab setting. See also Bloodborne Pathogens Standard (29 CFR 1910.1030) in Research Laboratories for the scope questions specific to that setting, and Infection Preventionist: Role, Responsibilities, and CBIC Certification for how this plan typically sits alongside a hospital’s broader infection-prevention programme.
Frequently Asked Questions
Does every hospital employee need to be included in the exposure determination?
No — only those whose job classification has occupational exposure to blood or OPIM, either for all tasks or for specific tasks and procedures. The determination has to name the classification and, where exposure is task-specific, the actual tasks — not a blanket department-wide entry.
How often does a hospital have to update its Exposure Control Plan?
At least annually, and whenever a new or modified task or procedure changes occupational exposure. The annual review must also document consideration and implementation of appropriate, commercially available safer medical devices, with input solicited from non-managerial, direct-patient-care employees.
Is the sharps injury log the same thing as the OSHA 300 Log?
No. The sharps injury log is a separate requirement under 1910.1030(h)(5), with its own three required fields (device type/brand, department, and how the incident occurred) and its own confidentiality requirement, in addition to whatever the incident also triggers on the general OSHA 300 Log under Part 1904.
Who pays for the Hepatitis B vaccine series?
The employer, at no cost to the employee, made available within 10 working days of initial assignment to any employee with occupational exposure. An employee may decline in writing and still request the vaccine later if they change their mind.
How quickly does post-exposure prophylaxis need to start after a needlestick?
Current clinical guidance treats HIV PEP as time-sensitive, with the greatest effectiveness the sooner it starts after exposure. The ECP should route staff to Employee Health or the ED immediately rather than waiting to see if symptoms develop — there typically aren’t any in the window that matters. See the linked first-hour protocol guide for the full step-by-step sequence.
Does paragraph (e) of the Bloodborne Pathogens Standard apply to a hospital’s own clinical lab?
Generally no. Paragraph (e) is scoped to research laboratories and production facilities that culture, produce, concentrate, or experimentally manipulate HIV or HBV; it explicitly excludes clinical or diagnostic laboratories doing routine analysis of blood, tissue, or organs. It only becomes relevant if the hospital also operates an HIV/HBV research or production function separate from patient care and diagnostics.
