Bloodborne Pathogens Exposure Control Plan Generator

Build the written Exposure Control Plan OSHA requires under 29 CFR 1910.1030(c) — exposure determination by job classification, engineering and work practice controls, hepatitis B vaccination, post-exposure procedures, training, and the annual review log. Print it or copy it when you're done.

Cyanotype vignette of a wall sharps container, a glove box and a plumbed-in eyewash stationFIG · 01
A wall sharps container, a glove box and a plumbed-in eyewash station.

What Is an Exposure Control Plan?

An Exposure Control Plan (ECP) is the written document OSHA requires from every employer with employees who have occupational exposure to blood or other potentially infectious materials (OPIM). It is the backbone of the Bloodborne Pathogens Standard, 29 CFR § 1910.1030: the plan identifies who is exposed, how the practice eliminates or minimizes that exposure, and what happens when an exposure incident occurs.

The ECP is separate from HIPAA — OSHA protects your staff, HIPAA protects your patients' data — but inspectors and accreditation reviewers ask for both. Practices often manage the two side by side; see our guide to HIPAA and bloodborne pathogens certification for how the two requirements fit together, and use a HIPAA compliance checklist to cover the privacy side.

Who Needs a Written ECP?

Dental and medical offices

Anesthesia injections, venipuncture, instrument reprocessing, and minor surgery all create occupational exposure — a written, site-specific ECP is mandatory.

Any employer with exposed staff

Urgent care, dermatology, home health, tattoo studios, and even offices with designated first-aid responders fall under the standard.

Practices facing inspection

The missing or generic ECP is one of the most commonly cited items under 1910.1030 during OSHA inspections of healthcare offices.

A downloaded template that still says "[Insert Practice Name]" does not count. OSHA expects the plan to be site-specific: your job titles, your devices, your providers. That is what this generator produces. Pair it with your security risk assessment as part of the practice's annual risk-management cycle.

Required ECP Elements Under 1910.1030(c)

OSHA specifies exactly what the written plan must contain. This generator produces every element in the table below:

ElementCitation
Exposure determination by job classification1910.1030(c)(2)
Universal precautions1910.1030(d)(1)
Engineering & work practice controls1910.1030(d)(2)
Personal protective equipment1910.1030(d)(3)
Housekeeping & regulated waste1910.1030(d)(4)
Hepatitis B vaccination program1910.1030(f)(1)-(2)
Post-exposure evaluation & follow-up1910.1030(f)(3)-(5)
Labels, signs & hazard communication1910.1030(g)(1)
Employee training program1910.1030(g)(2)
Recordkeeping & sharps injury log1910.1030(h)
Annual review & safer-device documentation1910.1030(c)(1)(iv)
Non-managerial employee input on devices1910.1030(c)(1)(v)

How to Use This ECP Generator

  1. 1

    Enter your practice and plan administratorThe person named is responsible for implementing, reviewing, and updating the plan — in most small practices that is the office manager or lead clinician.

  2. 2

    Complete the exposure determinationList every job title, mark whether all or only some employees in it have occupational exposure, and describe the exposing tasks. OSHA requires this list to be made without regard to PPE.

  3. 3

    Adjust the controls to match your officeThe engineering, work practice, PPE, and housekeeping lists are pre-filled for a dental operatory — edit them to reflect your actual devices and procedures.

  4. 4

    Name your providers and trainerIdentify who administers hepatitis B vaccinations, who performs post-exposure evaluations (including after hours), and who conducts annual training.

  5. 5

    Print, sign, and filePrint the generated plan, have the administrator sign it, and keep it where staff can access it during their shift. Log each annual review in section 9.

Important: This tool produces a starting template, not legal advice. Roughly half the states run their own OSHA-approved plans with requirements at least as strict as federal OSHA — check your state plan, and have your final ECP reviewed before adopting it.

Key BBP Deadlines at a Glance

RequirementDeadline
Written ECP in placeBefore any employee with occupational exposure starts work
Bloodborne pathogens trainingAt initial assignment, then at least annually (within 12 months of the last session)
Hepatitis B vaccine offeredWithin 10 working days of initial assignment, after training, at no cost
Post-exposure medical evaluationImmediately after an exposure incident is reported
Healthcare professional's written opinionObtained and given to the employee within 15 days of completed evaluation
ECP review and updateAt least annually, and whenever tasks or procedures change

Annual BBP training is a common failure point in small practices. Our bloodborne pathogens training guide covers the 14 required content elements, and a training log keeps the documentation OSHA and HHS both expect. Fold the training date into your new-hire onboarding checklist so no one starts patient care without it.

The Annual Review Is Not Optional

Since the Needlestick Safety and Prevention Act amended the standard in 2001, the annual ECP review must do two specific things beyond re-reading the document: it must reflect changes in technology that eliminate or reduce exposure, and it must document, each year, that the practice considered and implemented appropriate commercially available safer medical devices — safety scalpels, retracting needles, needleless connectors.

Inspector's question: "Show me where non-managerial clinical employees were involved in choosing your sharps devices." The standard (1910.1030(c)(1)(v)) requires you to solicit that input and document it in the ECP itself — which is why this generator includes a dedicated employee-input section and review log.

Treat the review like any other recurring compliance task: put it on your compliance work plan or the standing agenda of your compliance committee meeting, and record the outcome in the plan's review log.

Recordkeeping and Exposure Incidents

RecordRetention
Employee medical records (vaccination status, evaluations, written opinions)Duration of employment + 30 years
Training records (dates, content summary, trainer, attendees)3 years from training date
Sharps injury log (device type/brand, work area, how it happened)Maintained per 29 CFR 1904 (5 years)

When a needlestick or splash happens, the paper trail matters as much as the medical response. Document the incident the same day — an incident report form adapted with the ECP's required fields (route, circumstances, device, source) works well — and keep the medical evaluation itself confidential, separate from the personnel file. General staff training obligations are covered in our HIPAA training requirements guide.

Related Tools & Guides