Guide

The exposure control plan: who needs one and what it contains

Summary

Only if your practice has 'occupational exposure' — a reasonably anticipated risk of contact with blood or other infectious material during someone's duties, such as injections, phlebotomy, wound care, or handling used sharps. A talk-therapy practice with no such tasks usually has none and needs no plan. Where the trigger fires, there is no small-practice exemption: the plan must name the exposed tasks, the precautions, the Hepatitis B vaccination offer, and the post-exposure follow-up procedure.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

Do you have 'occupational exposure'? The trigger question

The bloodborne pathogens standard applies only where a job involves occupational exposure — reasonably anticipated skin, eye, mucous-membrane, or parenteral contact with blood or other potentially infectious materials as part of someone's duties 1Ref 1Occupational Safety and Health Administration (2026).Bloodborne Pathogens and Needlestick Prevention.The bloodborne pathogens standard's occupational-exposure trigger, plan contents (exposure determination, precautions, Hepatitis B vaccination offer, post-exposure evaluation), and annual review/training requirement.. If no one on your team draws blood, gives injections, handles sharps, or cleans a surface that could carry blood, the trigger may simply not fire.

A cash-pay talk-therapy practice with no injections, no phlebotomy, and no wound care usually has no occupational exposure at all, and no exposure means no exposure control plan requirement. A practice that gives injections, runs point-of-care testing with a fingerstick, treats wounds, or has staff empty sharps containers sits on the other side of that line, and the standard applies in full. Run the analysis task by task, not job title by job title — a receptionist who never touches a patient has no exposure even in a practice where the clinician does.

No small-practice exemption — unlike OSHA's paperwork rule

Where the trigger fires, there is no small-employer exemption from the bloodborne pathogens standard itself 1Ref 1Occupational Safety and Health Administration (2026).Bloodborne Pathogens and Needlestick Prevention.The bloodborne pathogens standard's occupational-exposure trigger, plan contents (exposure determination, precautions, Hepatitis B vaccination offer, post-exposure evaluation), and annual review/training requirement.. That's easy to confuse with OSHA's separate recordkeeping duty, which does exempt employers with ten or fewer employees from routine injury-and-illness logs outside a short list of high-hazard industries 2Ref 2Occupational Safety and Health Administration (2026).Recordkeeping.OSHA's routine recordkeeping duty exempts employers with ten or fewer employees — used to contrast against the bloodborne pathogens standard's lack of any size exemption.. The two rules run on different logic entirely.

One asks what a job's duties expose someone to; the other asks how many people you employ — and a practice can be exempt from one while squarely covered by the other. Settle osha and the solo office first, because workforce size changes almost nothing about whether the bloodborne pathogens standard reaches you; what changes it is whether any job includes contact with blood or OPIM. Bloodborne exposure is only one slice of occupational safety for a clinician working alone — the violence-prevention page covers the other major category solo practices tend to overlook.

What the exposure control plan has to contain

A compliant plan starts with an exposure determination — the specific job classifications and tasks with occupational exposure — and then documents the methods you use to control it: universal precautions, engineering and work-practice controls, and the personal protective equipment provided for each exposed task 1Ref 1Occupational Safety and Health Administration (2026).Bloodborne Pathogens and Needlestick Prevention.The bloodborne pathogens standard's occupational-exposure trigger, plan contents (exposure determination, precautions, Hepatitis B vaccination offer, post-exposure evaluation), and annual review/training requirement.. For a solo practice this is usually short and task-specific rather than sprawling.

Name the task (drawing blood for a rapid test, giving an injection, handling a used sharps container), name the precaution (gloves, a sharps container within reach, a puncture-resistant container for transport), and note who performs it. The plan also documents your housekeeping procedure for surfaces that could carry blood — and CDC's core infection-prevention practices cover the broader environmental-cleaning and hand-hygiene ground for outpatient visits that don't rise to OSHA's narrower occupational-exposure trigger at all 3Ref 3Centers for Disease Control and Prevention (2024).Core Infection Prevention and Control Practices for Safe Healthcare Delivery in All Settings.CDC's core outpatient infection-prevention practices cover environmental-cleaning and hand-hygiene ground broader than OSHA's narrower occupational-exposure trigger., worth folding in even for the tasks the bloodborne standard itself doesn't reach.

Hepatitis B vaccination and post-exposure follow-up

Anyone with occupational exposure must be offered the Hepatitis B vaccine series at no cost, and the plan must describe that offer along with what happens after an actual exposure incident — a needlestick or a splash — including confidential medical evaluation, follow-up, and post-exposure counseling 1Ref 1Occupational Safety and Health Administration (2026).Bloodborne Pathogens and Needlestick Prevention.The bloodborne pathogens standard's occupational-exposure trigger, plan contents (exposure determination, precautions, Hepatitis B vaccination offer, post-exposure evaluation), and annual review/training requirement.. This section is often the one solo practices skip because it feels like paperwork for an audience of one.

For a solo clinician who is also the only person with exposure, the plan still has to say what you'll do if you stick yourself: which clinician or urgent-care service evaluates you, how quickly, and how the incident gets documented. Deciding that in advance, before an actual needlestick, is the entire point of the requirement; deciding it in the moment, adrenaline and all, is exactly how the follow-up gets skipped.

Training and the annual review

Employees with occupational exposure need initial bloodborne-pathogens training before starting exposure-related tasks and again at least annually, and the plan itself has to be reviewed and updated at least yearly and whenever tasks or procedures change 1Ref 1Occupational Safety and Health Administration (2026).Bloodborne Pathogens and Needlestick Prevention.The bloodborne pathogens standard's occupational-exposure trigger, plan contents (exposure determination, precautions, Hepatitis B vaccination offer, post-exposure evaluation), and annual review/training requirement.. The review isn't a formality — it's where a plan either stays current or quietly goes stale.

The annual review also has to document that you considered safer, engineered sharps devices as they become available, not just adopted one once and never revisited the question. For a one- or two-person office, the review can be a short, dated note: what tasks still carry exposure, whether your sharps handling still matches current practice, and whether anything changed since last year. Skipping that review is the single most common way an otherwise-adequate plan goes out of date.

If you're a true sole proprietor with no employees

OSHA's standards run to employees, so a genuine sole proprietor with no one else on payroll may have no OSHA-covered workforce to write the plan for at all — though this is a narrow lane, and it disappears the moment you hire even one employee whose duties carry any exposure. Don't assume your way out of the plan on this basis alone.

Contractors complicate the analysis: a 1099 biller who never enters the clinical space isn't an employee with exposure, but a contracted medical assistant who draws blood or gives injections may functionally need the same protections depending on how the arrangement is structured. When in doubt, write the plan anyway — it costs a few pages, and a practice that grows from one clinician to a small team isn't starting the exposure-control conversation from zero.

Pair it with your HazCom program, not two separate binders

The exposure control plan and your Hazard Communication program cover overlapping ground — hazard labels, safety data sheets, and the training that goes with both — and OSHA's HazCom standard applies wherever hazardous chemicals are used, disinfectants and cleaning agents included 4Ref 4Occupational Safety and Health Administration (2026).Hazard Communication.OSHA's HazCom standard requires labeling, SDS access, and training wherever hazardous chemicals are used, the companion program to the exposure control plan.. A solo or two-person office manages this more easily as one binder than two.

Think of hazcom in miniature and the exposure control plan as companion documents rather than separate compliance projects: both name a hazard, name the precaution, and name who's exposed. Reviewing them on the same annual schedule, rather than remembering one and forgetting the other, is the practical way a one-person office actually keeps both current.

Common questions

Usually not. The bloodborne pathogens standard only applies where a job involves reasonably anticipated contact with blood or other potentially infectious material. A practice with no phlebotomy, injections, wound care, or sharps handling typically has no occupational exposure and no plan requirement — but re-run the analysis the moment any task like that gets added to the practice.

No. Unlike OSHA's recordkeeping duty, which exempts employers with ten or fewer employees from routine injury logs, the bloodborne pathogens standard has no size-based exemption. The question is never how many people you employ — it's whether any job duty creates reasonably anticipated contact with blood or other infectious material.

An exposure determination naming the specific tasks and job classifications with exposure, the precautions used for each (universal precautions, PPE, safe sharps handling), the offer of Hepatitis B vaccination, and the procedure for evaluating and following up after an actual exposure incident. Review and update it at least annually and whenever tasks change.

If you have occupational exposure, the vaccine offer requirement applies to anyone with that exposure, including a sole clinician with no other staff. Document that you were offered the series (and either accepted or declined it) the same way you would for an employee, since the plan has to describe how that offer and any post-exposure follow-up actually work.

OSHA's standards run to employees, so a genuine sole proprietor with nobody else on payroll may have no OSHA-covered workforce to write the plan for. That lane is narrow and disappears the moment you hire even one person whose duties carry any exposure, so most practices are better served writing the plan early rather than waiting to see if they ever cross that line.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Occupational Safety and Health Administration (2026). Bloodborne Pathogens and Needlestick Prevention. U.S. Occupational Safety and Health Administration. link ✓The bloodborne pathogens standard's occupational-exposure trigger, plan contents (exposure determination, precautions, Hepatitis B vaccination offer, post-exposure evaluation), and annual review/training requirement.
2.Occupational Safety and Health Administration (2026). Recordkeeping. U.S. Occupational Safety and Health Administration. link ✓OSHA's routine recordkeeping duty exempts employers with ten or fewer employees — used to contrast against the bloodborne pathogens standard's lack of any size exemption.
3.Centers for Disease Control and Prevention (2024). Core Infection Prevention and Control Practices for Safe Healthcare Delivery in All Settings. Centers for Disease Control and Prevention (CDC). linkCDC's core outpatient infection-prevention practices cover environmental-cleaning and hand-hygiene ground broader than OSHA's narrower occupational-exposure trigger.
4.Occupational Safety and Health Administration (2026). Hazard Communication. U.S. Occupational Safety and Health Administration. link ✓OSHA's HazCom standard requires labeling, SDS access, and training wherever hazardous chemicals are used, the companion program to the exposure control plan.

https://www.gale.care/for-providers/os-bloodborne-pathogen-plan · 4 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers