Written and maintained by CASRAI Editorial Board
Last updated
An Exposure Control Plan (ECP) is the written document 29 CFR 1910.1030(c)(1) requires from every employer with employees who have occupational exposure to blood or other potentially infectious materials (OPIM). It is not the same thing as bloodborne pathogens training, and it is not satisfied by a generic downloaded template with your institution’s name typed in. OSHA inspectors cite ECPs for missing or boilerplate content more often than for any other single element of the standard, because the plan is a program document — it has to describe what your specific workplace actually does, not restate the regulation back at itself.
This page is a document-structure guide: what has to be in the plan, clause by clause, so you can build or audit one against the actual text of 1910.1030(c) rather than a checklist someone else wrote. If you first need to determine whether your laboratory is in scope at all — including the cell-line and primary-human-material questions that catch basic-science labs off guard — start with Bloodborne Pathogens Standard (29 CFR 1910.1030) in Research Laboratories. This page assumes you already know you’re in scope and need to write or fix the plan itself.
What the Plan Actually Is, Structurally
1910.1030(c)(1)(i) requires “each employer having an employee(s) with occupational exposure… [to] establish a written Exposure Control Plan designed to eliminate or minimize employee exposure.” The plan is not a policy statement. Under 1910.1030(c)(1)(ii), it has to contain “the schedule and method of implementation” for four other paragraphs of the standard:
- (d) Methods of Compliance
- (e) HIV and HBV Research Laboratories and Production Facilities, where applicable
- (f) Hepatitis B Vaccination and Post-Exposure Evaluation and Follow-up
- (g) Communication of Hazards to Employees
- (h) Recordkeeping
That structure is the whole point of this page. The plan’s job is to say, for each of those paragraphs, who does it, on what schedule, by what method, at this specific workplace. A plan that just quotes the regulation’s language back without naming a schedule or a responsible role has not actually complied with (c)(1)(ii) — it has only demonstrated that someone read the standard.
Element 1: The Exposure Determination
1910.1030(c)(2) requires an exposure determination made “without regard to the use of personal protective equipment.” That phrase matters: you classify exposure based on what the job requires someone to be near or handle, not on whether they currently wear gloves. PPE is a control, not a basis for exemption from the list.
The determination has to identify:
- Job classifications in which all employees have occupational exposure (e.g., “Research Associate II — Human Tissue Culture”).
- Job classifications in which some employees have exposure, with the specific tasks and procedures that create it listed out (e.g., a lab manager who performs occasional primary-sample processing but otherwise does not).
- A list of the tasks and procedures themselves, not just job titles — because two people with the same title in different labs can have entirely different exposure profiles.
A common deficiency here is a plan that lists departments instead of job classifications and tasks. “Research staff have exposure” is not an exposure determination; it tells an inspector nothing about who specifically, doing what specifically. Build the list at the level of granularity the standard actually asks for, and revisit it whenever a role or protocol changes — not just at the annual review.
Element 2: Methods of Compliance, Documented as Schedule and Method
Paragraph (d) sets the substantive controls — Universal Precautions, engineering and work-practice controls, PPE, housekeeping. The ECP’s job under (c)(1)(ii) is not to restate those controls but to document how and when this workplace implements them: who selects and evaluates safer sharps devices, how often engineering controls (sharps containers, splash shields, biosafety cabinets) are inspected and by whom, what the PPE-provision and laundering procedure is, and what the housekeeping/decontamination schedule is for work surfaces and equipment. For the PPE piece specifically, see PPE Donning and Doffing: The Sequence, the Trained Observer, and the Competency Record for what a documented procedure at this level of specificity looks like in practice.
If your laboratory also falls under 1910.1030(e) — because it cultures, produces, concentrates, or manipulates HIV or HBV specifically, not merely handles material that might contain them — the plan needs a parallel schedule/method section for paragraph (e)’s additional containment and facility requirements. That triggering test is narrow and is covered in full in the standard’s scope guide linked above; most research laboratories with general occupational exposure never reach it.
Element 3: Hepatitis B Vaccination Provisions
Under 1910.1030(f), the vaccination series must be “made available… within 10 working days of initial assignment” to every employee with occupational exposure, at no cost, at a reasonable time and place, and administered under the supervision of a licensed healthcare professional. The plan needs to name who arranges this and confirm the 10-working-day clock, not just assert that vaccination is “offered.”
An employee may decline. The standard requires the employee to sign the declination statement in Appendix A of the standard — not an institution’s own paraphrase of it. If an employee who initially declined later wants the vaccine, it must still be made available at that point, at no cost. The plan should document both the declination-capture procedure and the standing offer for a later opt-in, since inspectors specifically check for evidence that declination wasn’t treated as a one-time, irreversible waiver.
Element 4: Post-Exposure Evaluation and Follow-Up Procedure
1910.1030(c)(1)(ii) requires the plan to document the schedule and method for implementing paragraph (f)’s post-exposure requirements, and separately requires “the procedure for the evaluation of circumstances surrounding exposure incidents.” That means the plan needs a written procedure, not a phone number to call. At minimum it should specify: how and to whom an exposure incident is reported, how the route and circumstances of exposure are documented, the process for source-individual identification and testing (where legally permissible and the source consents), the confidential medical evaluation and bloodborne pathogen testing offered to the exposed employee, post-exposure prophylaxis where indicated, and counselling. All of it has to be confidential and provided at no cost to the employee.
The first-hour mechanics of an actual needlestick or sharps exposure — who to call immediately, what first aid happens before anything else — are covered in more operational detail in Needlestick Injury Response: The First-Hour Protocol. The ECP’s post-exposure section should point to that kind of procedure rather than trying to reproduce it as prose inside the plan itself.
Element 5: Annual Review and Update
1910.1030(c)(1)(iv) requires the plan to be reviewed and updated “at least annually and whenever necessary” to reflect new or modified tasks and procedures affecting occupational exposure. Critically, the review must document “consideration and implementation of appropriate commercially available and effective safer medical devices” — not just a statement that the plan was reviewed, but evidence that safer-device options on the market were actually evaluated that year, even if the conclusion was to keep existing devices.
1910.1030(c)(1)(v) adds a distinct, separate requirement: the employer must solicit input from non-managerial employees with occupational exposure on the identification, evaluation, and selection of engineering and work-practice controls, and document that solicitation in the plan. This is the single most commonly missed element in ECPs that otherwise look complete — a plan that was reviewed and updated by management alone, with no documented frontline input, does not satisfy (c)(1)(v) even if every other section is thorough.
The sharps injury log required under 1910.1030(h)(5) is a direct input to this review: it is where an employer sees whether a given engineering control is actually working in practice, and it should be pulled and considered as part of the annual safer-device evaluation rather than kept as an isolated recordkeeping artifact. For the recordability distinctions that make that log accurate in the first place, see OSHA-Reportable Laboratory Injuries.
Where the Plan Must Live, and Who Has to Be Able to Read It
1910.1030(c)(1)(iii) requires the employer to ensure a copy of the Exposure Control Plan is accessible to employees in accordance with 29 CFR 1910.20(e), the employee-records-access provision. In practice that means every employee covered by the plan needs to be able to obtain a copy within a reasonable time, without having to justify why they want it, and the plan can’t be treated as a management-only document kept in a drawer for inspection day.
A written ECP is a distinct document from a Chemical Hygiene Plan under the OSHA Laboratory Standard, an Emergency Action Plan under 1910.38, or a biosafety manual — each one governs a different hazard class and each has its own required elements, even though a lab may need all of them. See How to Write and Maintain a Chemical Hygiene Plan and Emergency Action Plan for a Research Laboratory for the parallel document-structure requirements each of those carries. Training staff on the finished plan’s contents is a separate obligation under paragraph (g); see Bloodborne Pathogens Training for Research Personnel for what that training has to cover and how often it recurs.
Frequently Asked Questions
Does a research laboratory need an Exposure Control Plan if it never treats patients?
Yes, if any employee has occupational exposure to human blood, human body fluids, or other potentially infectious materials as defined by 1910.1030(b) — that includes unfixed human tissue, primary human cell cultures, and certain established cell lines known or reasonably suspected to carry a bloodborne pathogen. The standard is not limited to clinical or healthcare settings; “research laboratories and production facilities” are explicitly named in paragraph (e) and are otherwise covered under the standard’s general scope whenever occupational exposure exists.
Is a template ECP downloaded from a university or vendor site acceptable?
Only as a starting structure. A plan has to reflect this specific workplace’s actual job classifications, tasks, engineering controls, and responsible individuals under 1910.1030(c)(1)(ii). A template that was never customized past the institution’s name typed into a header is one of the most commonly cited ECP deficiencies, because it demonstrates the schedule-and-method requirement wasn’t actually met.
How is the Exposure Control Plan different from bloodborne pathogens training?
The ECP is the written program document required under paragraph (c); training under paragraph (g) is the mechanism for communicating that plan’s contents, and the specific hazards and controls in it, to employees at initial assignment and at least annually thereafter. A lab can have thorough training built on a deficient or missing plan, and an inspector will still cite the plan itself as the primary violation.
Who has to be included in the annual safer-device review?
1910.1030(c)(1)(v) specifically requires input from non-managerial employees who are responsible for direct patient care or, in a research setting, who actually perform the exposure-generating tasks — not only supervisors or the safety office. The solicitation and its outcome need to be documented in the plan itself, not just conducted informally.
What happens if an employee declines the Hepatitis B vaccine and later changes their mind?
The employer must still make the vaccination series available at no cost at that later point. A declination signed under Appendix A is not a one-time, permanent waiver of the offer — the plan’s vaccination section should document that the offer remains standing, not just the initial 10-working-day availability window.
