Can the plan be signed electronically?

Yes. Electronic signatures are legally recognized under the ESIGN Act (15 U.S.C. ch. 96) and by UETA in most states; ensure you capture signer intent, consent, attribution, and retention to meet the legal-validity test.

Do I need a HIPAA BAA for electronic distribution?

If the plan or acknowledgments include protected health information (PHI), execute a Business Associate Agreement with the e-sign vendor and ensure the platform supports HIPAA controls (45 CFR §164.502 and §164.530).

How often must training be delivered?

OSHA expects initial and annual training for employees with potential exposure; deliver at hire and at least annually, and document content and attendance to demonstrate compliance with 29 CFR 1910.1030.

What records must be retained and for how long?

Maintain training and medical records per HIPAA and OSHA guidance; HIPAA records require six years (45 CFR §164.530(j)), while certain OSHA exposure records may require extended retention (see 29 CFR §1910.1020).

What steps follow an exposure incident?

Initiate immediate first aid, notify occupational health, perform risk assessment, offer evaluation and prophylaxis as appropriate, and document the event and follow-up actions per your plan and OSHA requirements.

Is notarization or witness required for the plan?

No standard federal requirement mandates notarization for an exposure control plan; however, local policies or institutional governance may request signed acknowledgments or witnessed attestations—follow internal control policies.

Electronic Signature
Templates
Healthcare
Healthcare Bloodborne Pathogens Exposure Control Plan

Healthcare Bloodborne Pathogens Exposure Control Plan

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE BLOODBORNE PATHOGENS EXPOSURE CONTROL PLAN

Facility Information

Facility Name Facility Address

Primary Contact

Title

Phone

Exposure Control Officer

Effective Date:

Purpose and Scope

This Exposure Control Plan establishes procedures, engineering controls, work practices, personal protective equipment (PPE), vaccination and post-exposure evaluation protocols, employee training, and recordkeeping required to minimize occupational exposure to bloodborne pathogens. The Plan applies to all personnel whose job duties reasonably involve potential exposure to blood or other potentially infectious materials.

Exposure Determination

The following job classifications at this facility involve occupational exposure to bloodborne pathogens. Select all applicable classifications and identify additional positions.

Nursing staff (RNs, LPNs) Physicians and advanced practice providers Laboratory personnel Phlebotomists Emergency department / EMS personnel Dental personnel Housekeeping / environmental services Other (describe):

Methods of Compliance

The facility will implement multiple complementary controls to eliminate or minimize exposure, including engineering controls, work practice controls, and appropriate PPE. These controls are implemented at no cost to employees.

Engineering Controls (examples and location of devices) Work Practice Controls (procedures, hand hygiene, sharps handling) Personal Protective Equipment (PPE)

Gloves Gowns / protective apparel Eye protection / face shield Surgical masks / respirators as required Other PPE (describe):

Sharps Injury Prevention and Disposal Housekeeping and Decontamination

Hepatitis B Vaccination and Post-Exposure Evaluation

The facility will offer Hepatitis B vaccination to all employees with occupational exposure at no cost, according to the schedule recommended by public health authorities. The facility will provide timely medical evaluation, post-exposure prophylaxis, and follow-up for employees who experience an exposure incident.

Vaccination Offered Vaccination is offered at no cost Employee may decline vaccination (documentation required) Vaccination Provider or Location

Post-Exposure Reporting and Evaluation Procedure

Medical Evaluation Provider

Reporting Timeframe (hours)

Training and Recordkeeping

Training will be provided at the time of initial assignment and at least annually thereafter. Training content will include epidemiology, modes of transmission, the facility Plan, recognition of tasks that may involve exposure, use of engineering controls, work practices, and PPE, and procedures to follow in an exposure incident.

Training Frequency Training Topics Covered (summary) Training and Medical Record Location

Labels and Signage

Biohazard labels and signs will be used to identify regulated waste, contaminated equipment, and areas where exposure risk exists. Employees will be instructed on the meaning and placement of labels as part of routine training.

Person Responsible for Labels and Signage

Plan Review and Record of Revisions

The Exposure Control Plan will be reviewed and, if necessary, revised at least annually and whenever changes in tasks, procedures, or positions affect occupational exposure. All substantive revisions will be documented below.

Last Review Date:

Next Scheduled Review:

Reviewer Name Summary of Revisions (if any)

Certification

By signing below, the Facility Administrator and the Exposure Control Officer certify that this Exposure Control Plan has been prepared and implemented in accordance with applicable occupational health standards. The facility agrees to provide required training, vaccination, and medical follow-up, maintain required records, and make the Plan available to employees and authorized representatives upon request.

Facility Administrator:

By:

Date:

Exposure Control Officer:

By:

Date:

What the Healthcare Bloodborne Pathogens Exposure Control Plan Covers

The Healthcare Bloodborne Pathogens Exposure Control Plan is a written employer program required by OSHA's Bloodborne Pathogens standard (29 CFR 1910.1030). It documents how a healthcare employer assesses occupational exposure to blood and other potentially infectious materials, implements engineering and work-practice controls, provides personal protective equipment and hepatitis B vaccination, conducts training, manages post-exposure evaluation and follow-up, and maintains required records. The plan clarifies roles and responsibilities, describes notification and incident reporting procedures, and establishes a schedule for review and updates to remain compliant with the standard.

Why a Formal Exposure Control Plan Matters for Healthcare Operations

A written plan reduces workplace risk, documents compliance with OSHA (29 CFR 1910.1030), and supports consistent prevention, training, and post-exposure response across clinical settings.

Which Staff and Departments Typically Use This Plan

The plan is used by clinical leadership, occupational health, infection control, human resources, and frontline staff who may encounter bloodborne exposures.

Occupational Health Teams responsible for vaccination, exposure follow-up, and medical record maintenance.
Infection Prevention and Control staff who set engineering controls and training content.
Clinical and Support Staff (nurses, phlebotomists, EMS, custodial staff) who must follow work-practice controls and report exposures.

Departments rely on the plan for training schedules, incident reporting, immunization records, and to ensure standardized post-exposure procedures are followed.

Step-by-Step: Create or Update Your Exposure Control Plan

Follow these core steps to assemble a compliant, practical plan tailored to clinical operations.

01

Assess Exposure: Identify roles/tasks with occupational exposure risk.
02

Document Controls: Record engineering, administrative, and PPE measures in place.
03

Set Training: Schedule initial and annual training with attendance tracking.
04

Plan Review: Assign annual review and revision responsibilities.

Where the Plan Fits in Daily Operations and Reporting

This overview explains routing, recordkeeping, and who receives plan documents within the facility.

Internal Distribution: Post electronic copy to intranet and provide paper copies where needed.
Incident Reporting: Direct staff to immediate supervisor and occupational health for exposures.
Medical Follow-up: Occupational health initiates evaluation and documents care.
Regulatory Access: Make plan available to OSHA and state compliance officers on request.

How to Configure an Online Workflow for Plan Distribution and Acknowledgment

Configure a digital workflow to centralize distribution, tracking, and retraining reminders.

Field	Configuration
Document Host	Use a secure intranet or e-sign platform supporting audit trails
Signer Authentication	Email + access code or SSO for staff verification
Acknowledgment Capture	Use signed acknowledgments with timestamps and user ID
Retention Path	Route completed acknowledgments to central HR/Occupational Health records

Digital Signing and Secure Distribution Requirements

Ensure retention meets HIPAA and OSHA recordkeeping policies and that the platform supports export to PDF/A and secure archiving.

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest
Audit Trail: Capture IP, timestamp, and action log
HIPAA Support: BAA available where PHI is involved

Essential Records and Security Elements to Include

Exposure Records: Maintain detailed incident logs

Training Logs: Date, attendees, curriculum

Vaccination Records: Hepatitis B vaccination status

Policy Version: Effective date and revision history

Medical Follow-up: Post-exposure evaluation documentation

Access Controls: Role-based access to PHI

Common Preparation and Implementation Challenges

Incomplete exposure determinations that omit nonclinical staff, causing gaps in training and protection.
Poor record organization that delays post-exposure evaluation and complicates OSHA responses.
Inconsistent training delivery or missing attendance records that undermine compliance during inspections.
Failure to integrate the plan with occupational health systems, creating duplicate records and reconciliation errors.

Consequences of an Inadequate or Missing Exposure Control Plan

OSHA Citations: Civil penalties and corrective orders

Increased Liability: Higher risk of worker claims

Operational Disruption: Work stoppage or restricted duties

Reputational Harm: Patient and staff confidence erosion

Medical Costs: Testing and treatment expenses

Recordkeeping Fines: Penalties for falsified or missing records

Core Components Every Professional Exposure Control Plan Should Contain

An effective plan combines hazard assessment, control strategies, training, medical management, documentation, and oversight responsibilities.

Exposure Assessment

A written list of job classifications and tasks with potential exposure, detailing locations and frequency to focus controls and training.

Engineering Controls

Descriptions and locations of devices such as sharps disposal containers, safety-engineered devices, and workstations that eliminate or reduce exposure risks.

Work Practices

Procedures for safe handling of sharps, specimen transport, decontamination, hand hygiene, and housekeeping to minimize exposure opportunities.

PPE Requirements

Specific PPE for tasks, instructions for use, storage, and replacement frequency aligned with manufacturer guidance.

Medical Program

Hepatitis B vaccination offer, confidential medical evaluation, post-exposure prophylaxis procedures, and follow-up timelines.

Training & Records

Initial and annual training content, documentation retention, incident reporting process, and plan review cadence with responsible parties named.

Key Timeframes and Deadlines to Track in the Plan

Maintain a schedule for training, reviews, and post-exposure actions to meet regulatory expectations and support timely care.

Initial Training:

At hire or assignment before exposure occurs; document completion date and content

Annual Training:

Deliver annually and document attendance per OSHA guidance

Plan Review:

Review and revise plan at least annually or when tasks/procedures change

Post-Exposure Evaluation:

Provide medical evaluation promptly and document all actions and outcomes

Record Retention:

Follow applicable retention rules for training, medical, and exposure records

eSignature Pricing Snapshot for Managing Plan Acknowledgments and Records

Compare typical starting prices and core capabilities for common eSignature vendors when securing plan acknowledgments and audit trails. Confirm vendor feature details and HIPAA/BAA availability with each provider.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Frequently Asked Questions About the Exposure Control Plan

Answers to common questions about legal validity, digital acknowledgments, retention, and post-exposure steps for workplace incidents.

Need help? Contact support

Can the plan be signed electronically?
Yes. Electronic signatures are legally recognized under the ESIGN Act (15 U.S.C. ch. 96) and by UETA in most states; ensure you capture signer intent, consent, attribution, and retention to meet the legal-validity test.
Do I need a HIPAA BAA for electronic distribution?
If the plan or acknowledgments include protected health information (PHI), execute a Business Associate Agreement with the e-sign vendor and ensure the platform supports HIPAA controls (45 CFR §164.502 and §164.530).
How often must training be delivered?
OSHA expects initial and annual training for employees with potential exposure; deliver at hire and at least annually, and document content and attendance to demonstrate compliance with 29 CFR 1910.1030.
What records must be retained and for how long?
Maintain training and medical records per HIPAA and OSHA guidance; HIPAA records require six years (45 CFR §164.530(j)), while certain OSHA exposure records may require extended retention (see 29 CFR §1910.1020).
What steps follow an exposure incident?
Initiate immediate first aid, notify occupational health, perform risk assessment, offer evaluation and prophylaxis as appropriate, and document the event and follow-up actions per your plan and OSHA requirements.
Is notarization or witness required for the plan?
No standard federal requirement mandates notarization for an exposure control plan; however, local policies or institutional governance may request signed acknowledgments or witnessed attestations—follow internal control policies.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now