Bloodborne Pathogens Exposure Control Plan Generator
Build the written Exposure Control Plan OSHA requires under 29 CFR 1910.1030(c) — exposure determination by job classification, engineering and work practice controls, hepatitis B vaccination, post-exposure procedures, training, and the annual review log. Print it or copy it when you're done.
Pre-filled with a realistic four-chair dental office. Edit any field below and the written plan updates in real time. Swap the practice type and job classifications for a medical office.
Practice & Plan Administrator
Exposure Determination
Made without regard to PPE. List every job title, whether all or only some employees in it are exposed, and the tasks that create exposure.
Methods of Compliance
1910.1030(d): universal precautions are stated automatically. Edit the controls specific to your office.
Engineering Controls
Work Practice Controls
Personal Protective Equipment
Housekeeping & Regulated Waste
Vaccination, Post-Exposure, Training & Review
Name the providers and trainer. The regulatory language for Hep B, labels, training topics, and records is generated for you.
Exposure Incident Procedure (in order)
Annual Review Log
Bloodborne Pathogens Exposure Control Plan
OSHA Bloodborne Pathogens Standard — 29 CFR § 1910.1030(c)
Riverside Family Dental (Dental office)
4410 Lakeshore Drive, Suite 210, Austin, TX 78746
(512) 555-0147
ECP Administrator: Maria Delgado, RDH — Office Manager / OSHA Compliance Coordinator
Effective: September 5, 2026Next review due: September 5, 2027
1. Purpose, Scope & Plan Administration
This Exposure Control Plan (ECP) is established to eliminate or minimize employee occupational exposure to blood and other potentially infectious materials (OPIM) in accordance with the OSHA Bloodborne Pathogens Standard, 29 CFR 1910.1030. The ECP Administrator named above is responsible for implementing this plan, reviewing and updating it at least annually and whenever new or modified tasks or procedures affect occupational exposure, and making it accessible to all employees during their work shift and to OSHA representatives on request. The annual review reflects changes in technology that eliminate or reduce exposure and documents consideration and implementation of appropriate, commercially available safer medical devices.
2. Exposure Determination — 1910.1030(c)(2)
The following exposure determination was made without regard to the use of personal protective equipment. Occupational exposure means reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or OPIM that may result from the performance of an employee's duties.
| Job Classification | Exposure | Tasks & Procedures With Occupational Exposure |
|---|---|---|
| Dentist (DDS/DMD) | All employees | Restorative, surgical and endodontic procedures; local anesthesia; suturing; handling extracted teeth. |
| Dental Hygienist | All employees | Scaling and root planing; ultrasonic instrumentation; periodontal probing; polishing; radiographs. |
| Dental Assistant | All employees | Chairside assisting; instrument transfer; suction; operatory turnover; instrument reprocessing and sterilization. |
| Front Desk / Patient Coordinator | Some employees | Occasional handling of contaminated instruments or lab cases when assisting in the back office. |
3. Methods of Compliance — 1910.1030(d)
Universal precautions are observed to prevent contact with blood or OPIM. Where differentiation between body fluid types is difficult or impossible, all body fluids are considered potentially infectious. Engineering and work practice controls are the primary means of eliminating or minimizing exposure; where exposure remains after institution of these controls, PPE is also used. Engineering controls are examined and maintained or replaced on a regular schedule.
3.1 Engineering Controls
- Sharps containers (puncture-resistant, closable, leak-proof, labeled) mounted at point of use in every operatory and the sterilization area
- Safety-engineered needles and needle recapping devices; one-handed scoop technique where recapping is required for multi-injection dental anesthesia
- High-volume evacuation and rubber dam used during aerosol-generating procedures where clinically feasible
- Automated instrument washer and covered transport cassettes to reduce handling of contaminated instruments
- Handwashing sinks with soap in every operatory and the sterilization area; alcohol-based hand rub at each chair
3.2 Work Practice Controls
- Hands washed immediately after removing gloves or other PPE and after any contact with blood or saliva
- Contaminated needles are never bent, sheared, broken, or recapped by hand (two-handed recapping prohibited)
- Eating, drinking, applying cosmetics or lip balm, and handling contact lenses are prohibited in operatories and the sterilization area
- No food or drink stored in refrigerators or on counters where blood or OPIM may be present
- Contaminated instruments transported in closed, labeled cassettes or containers; never carried loose
- Regulated waste placed in closable, leak-proof, red or biohazard-labeled containers; sharps containers replaced when 3/4 full
3.3 Personal Protective Equipment (provided at no cost to employees)
- Exam gloves for all patient contact and instrument reprocessing; heavy-duty utility gloves for cleaning instruments and surfaces
- Surgical masks and protective eyewear with side shields (or face shields) for every procedure with splash or spatter potential
- Fluid-resistant clinical gowns or lab jackets, changed daily or when visibly soiled; laundered by the practice, not taken home
- PPE is provided at no cost, in appropriate sizes, and removed before leaving the work area
3.4 Housekeeping, Decontamination & Regulated Waste
- Clinical contact surfaces are barrier-protected or cleaned and disinfected with an EPA-registered hospital disinfectant between every patient
- Spills of blood or OPIM cleaned promptly by gloved staff using absorbent material followed by disinfectant
- Contaminated laundry handled with minimal agitation, bagged at the point of use in labeled or color-coded bags
- Regulated waste removed by a licensed medical waste hauler; manifests retained on file
4. Hepatitis B Vaccination — 1910.1030(f)
The hepatitis B vaccination series is made available, at no cost, to every employee with occupational exposure within 10 working days of initial assignment, after the employee has received the required training — unless the employee has previously completed the series, antibody testing shows immunity, or the vaccine is medically contraindicated. Vaccination is performed by or under the supervision of a licensed physician or other licensed healthcare professional at: Austin Occupational Health Partners, 1200 W 38th St, Austin, TX 78705, (512) 555-0190. Employees who decline sign the mandatory declination statement in Appendix A of the standard; the signed form is kept on file, and the vaccine remains available at no cost if the employee later changes their mind.
5. Post-Exposure Evaluation & Follow-Up — 1910.1030(f)(3)
Following a report of an exposure incident (a specific eye, mouth, other mucous membrane, non-intact skin, or parenteral contact with blood or OPIM), a confidential medical evaluation and follow-up is immediately available at no cost through: Austin Occupational Health Partners (business hours) / St. David's Medical Center Emergency Dept (after hours). The following steps are taken, in order:
- Wash the affected area with soap and water; flush splashes to eyes, nose or mouth with water for at least 15 minutes
- Report immediately to the ECP Administrator (or the dentist on duty if the Administrator is unavailable)
- Complete the Exposure Incident Report: route of exposure, circumstances, device involved, PPE worn, and source patient identification
- Refer the employee to the designated healthcare professional the same day for confidential medical evaluation, baseline testing, and post-exposure prophylaxis if indicated
- Request source patient consent for HBV/HCV/HIV testing (where consent is required by state law) and forward results to the treating professional
- Provide the treating professional a copy of this standard, the job description, exposure details, and the employee's vaccination record
- Obtain the healthcare professional's written opinion within 15 days and give the employee a copy; keep it in the confidential medical file
- Record needlestick or sharps injuries on the Sharps Injury Log and, if recordable, on the OSHA 300 log within 7 calendar days
6. Communication of Hazards: Labels & Signs — 1910.1030(g)(1)
- Fluorescent orange or orange-red biohazard warning labels, with the biohazard legend in a contrasting color, are affixed to containers of regulated waste, refrigerators and freezers containing blood or OPIM, and containers used to store, transport, or ship blood or OPIM.
- Red bags or red containers may be substituted for labels.
- Contaminated sharps containers are labeled or color-coded and kept upright, replaced routinely, and never allowed to overfill.
- Contaminated equipment sent for servicing is labeled, with the contaminated portions identified.
7. Training — 1910.1030(g)(2)
All employees with occupational exposure receive training at no cost, during working hours, at the time of initial assignment and at least annually thereafter (within one year of the previous training), with additional training when new tasks or procedures affect exposure. Trainer: Maria Delgado, RDH (OSHA-trained compliance coordinator) with dentist available for questions. Format: In-person session with live Q&A at hire and every 12 months; supplemented by an online module with written quiz. Each session covers, at minimum:
- An accessible copy of 29 CFR 1910.1030 and an explanation of its contents
- Epidemiology, symptoms, and modes of transmission of bloodborne diseases
- This Exposure Control Plan and how to obtain a copy
- How to recognize tasks that may involve exposure to blood or OPIM
- Use and limitations of engineering controls, work practices, and PPE
- Selection, use, location, removal, handling, decontamination, and disposal of PPE
- Hepatitis B vaccine: efficacy, safety, administration, benefits, and that it is free
- Emergency actions and whom to contact for incidents involving blood or OPIM
- The exposure incident procedure, reporting, and available medical follow-up
- Post-exposure evaluation and follow-up the employer must provide
- Signs, labels, and color-coding required by 1910.1030(g)(1)
- An opportunity for interactive questions and answers with the trainer
8. Recordkeeping — 1910.1030(h)
- Confidential medical records for each exposed employee — name, hepatitis B vaccination status and dates, exam and testing results, the healthcare professional's written opinion, and information provided to the healthcare professional — retained for the duration of employment plus 30 years.
- Training records — dates, contents or a summary, trainer names and qualifications, and attendee names and job titles — retained for 3 years from the training date.
- A Sharps Injury Log recording the type and brand of device involved, the department or work area where the incident occurred, and an explanation of how it occurred, maintained so the injured employee's confidentiality is protected.
- Medical records are not disclosed without the employee's written consent except as required by law; all records are available to employees, their representatives, and OSHA as required.
9. Annual Review & Safer-Device Evaluation — 1910.1030(c)(1)(iv)–(v)
Non-managerial clinical staff (hygienists and assistants) reviewed safety-engineered sharps options at the annual staff meeting. Their selections and the meeting date are recorded below.
| Review Date | Reviewed By | Changes / Devices Evaluated / Staff Consulted |
|---|---|---|
| September 5, 2026 | Maria Delgado, RDH | Initial plan adopted. Evaluated retractable-needle anesthetic syringes; staff selected the safety syringe from two trial devices. |
10. Adoption
This Exposure Control Plan is adopted by Riverside Family Dental and is accessible to all employees during their work shift.
ECP Administrator Signature
Date
FIG · 01What Is an Exposure Control Plan?
An Exposure Control Plan (ECP) is the written document OSHA requires from every employer with employees who have occupational exposure to blood or other potentially infectious materials (OPIM). It is the backbone of the Bloodborne Pathogens Standard, 29 CFR § 1910.1030: the plan identifies who is exposed, how the practice eliminates or minimizes that exposure, and what happens when an exposure incident occurs.
The ECP is separate from HIPAA — OSHA protects your staff, HIPAA protects your patients' data — but inspectors and accreditation reviewers ask for both. Practices often manage the two side by side; see our guide to HIPAA and bloodborne pathogens certification for how the two requirements fit together, and use a HIPAA compliance checklist to cover the privacy side.
Who Needs a Written ECP?
Dental and medical offices
Anesthesia injections, venipuncture, instrument reprocessing, and minor surgery all create occupational exposure — a written, site-specific ECP is mandatory.
Any employer with exposed staff
Urgent care, dermatology, home health, tattoo studios, and even offices with designated first-aid responders fall under the standard.
Practices facing inspection
The missing or generic ECP is one of the most commonly cited items under 1910.1030 during OSHA inspections of healthcare offices.
A downloaded template that still says "[Insert Practice Name]" does not count. OSHA expects the plan to be site-specific: your job titles, your devices, your providers. That is what this generator produces. Pair it with your security risk assessment as part of the practice's annual risk-management cycle.
Required ECP Elements Under 1910.1030(c)
OSHA specifies exactly what the written plan must contain. This generator produces every element in the table below:
| Element | Citation |
|---|---|
| Exposure determination by job classification | 1910.1030(c)(2) |
| Universal precautions | 1910.1030(d)(1) |
| Engineering & work practice controls | 1910.1030(d)(2) |
| Personal protective equipment | 1910.1030(d)(3) |
| Housekeeping & regulated waste | 1910.1030(d)(4) |
| Hepatitis B vaccination program | 1910.1030(f)(1)-(2) |
| Post-exposure evaluation & follow-up | 1910.1030(f)(3)-(5) |
| Labels, signs & hazard communication | 1910.1030(g)(1) |
| Employee training program | 1910.1030(g)(2) |
| Recordkeeping & sharps injury log | 1910.1030(h) |
| Annual review & safer-device documentation | 1910.1030(c)(1)(iv) |
| Non-managerial employee input on devices | 1910.1030(c)(1)(v) |
How to Use This ECP Generator
- 1
Enter your practice and plan administrator — The person named is responsible for implementing, reviewing, and updating the plan — in most small practices that is the office manager or lead clinician.
- 2
Complete the exposure determination — List every job title, mark whether all or only some employees in it have occupational exposure, and describe the exposing tasks. OSHA requires this list to be made without regard to PPE.
- 3
Adjust the controls to match your office — The engineering, work practice, PPE, and housekeeping lists are pre-filled for a dental operatory — edit them to reflect your actual devices and procedures.
- 4
Name your providers and trainer — Identify who administers hepatitis B vaccinations, who performs post-exposure evaluations (including after hours), and who conducts annual training.
- 5
Print, sign, and file — Print the generated plan, have the administrator sign it, and keep it where staff can access it during their shift. Log each annual review in section 9.
Important: This tool produces a starting template, not legal advice. Roughly half the states run their own OSHA-approved plans with requirements at least as strict as federal OSHA — check your state plan, and have your final ECP reviewed before adopting it.
Key BBP Deadlines at a Glance
| Requirement | Deadline |
|---|---|
| Written ECP in place | Before any employee with occupational exposure starts work |
| Bloodborne pathogens training | At initial assignment, then at least annually (within 12 months of the last session) |
| Hepatitis B vaccine offered | Within 10 working days of initial assignment, after training, at no cost |
| Post-exposure medical evaluation | Immediately after an exposure incident is reported |
| Healthcare professional's written opinion | Obtained and given to the employee within 15 days of completed evaluation |
| ECP review and update | At least annually, and whenever tasks or procedures change |
Annual BBP training is a common failure point in small practices. Our bloodborne pathogens training guide covers the 14 required content elements, and a training log keeps the documentation OSHA and HHS both expect. Fold the training date into your new-hire onboarding checklist so no one starts patient care without it.
The Annual Review Is Not Optional
Since the Needlestick Safety and Prevention Act amended the standard in 2001, the annual ECP review must do two specific things beyond re-reading the document: it must reflect changes in technology that eliminate or reduce exposure, and it must document, each year, that the practice considered and implemented appropriate commercially available safer medical devices — safety scalpels, retracting needles, needleless connectors.
Inspector's question: "Show me where non-managerial clinical employees were involved in choosing your sharps devices." The standard (1910.1030(c)(1)(v)) requires you to solicit that input and document it in the ECP itself — which is why this generator includes a dedicated employee-input section and review log.
Treat the review like any other recurring compliance task: put it on your compliance work plan or the standing agenda of your compliance committee meeting, and record the outcome in the plan's review log.
Recordkeeping and Exposure Incidents
| Record | Retention |
|---|---|
| Employee medical records (vaccination status, evaluations, written opinions) | Duration of employment + 30 years |
| Training records (dates, content summary, trainer, attendees) | 3 years from training date |
| Sharps injury log (device type/brand, work area, how it happened) | Maintained per 29 CFR 1904 (5 years) |
When a needlestick or splash happens, the paper trail matters as much as the medical response. Document the incident the same day — an incident report form adapted with the ECP's required fields (route, circumstances, device, source) works well — and keep the medical evaluation itself confidential, separate from the personnel file. General staff training obligations are covered in our HIPAA training requirements guide.
Related Tools & Guides
Bloodborne Pathogens Training Guide
OSHA's annual BBP training requirement: the 14 required topics, who must be trained, and when.
HIPAA Training Log
Track staff training dates, topics, and trainers — the documentation OSHA and HHS both ask for.
Healthcare Onboarding Checklist
Every credential, training, and form a new clinical hire needs before seeing patients.
HIPAA Risk Assessment Tool
Run the security risk analysis the HIPAA Security Rule requires, section by section.
HIPAA & BBP Certification Explained
What employers actually need instead of a certificate — and how to document it.