Bloodborne Pathogen Exposure Control Plan for California Employers
If you are a California employer and you have been told you need a written Bloodborne Pathogen Exposure Control Plan (an ECP), this page covers what the plan is, what Cal/OSHA expects in it, and how a CDMS engagement actually works.
If you are a California employer and you have been told you need a written Bloodborne Pathogen Exposure Control Plan (an ECP), this page covers what the plan is, what Cal/OSHA expects in it, and how a CDMS engagement actually works. The most common trigger is not what most people expect: it is usually a designated first-aid responder, a custodial role, or a job classification that turned up during a broader safety review, not a clinical setting.
If you are not sure whether the standard applies to your facility, you are also in the right place. The short answer: if any of your employees can reasonably be expected to contact blood or other potentially infectious materials (OPIM) as part of their job, Cal/OSHA requires you to have a written ECP, document the exposure determination, offer Hepatitis B vaccination at no cost, train covered employees annually, and keep specific records for the duration of employment plus 30 years. This page is written for that employer. If you are an individual looking for a $15 online certificate, you are on the wrong page; the BBP certification market is owned by training providers, and CDMS does not sell certificates.
Are You Covered? A Quick Self-Check
Most facilities that need an ECP are not healthcare facilities. They are ordinary California industrial and commercial sites with one or more of the following on payroll. If any of these describe your facility, the Cal/OSHA Bloodborne Pathogens standard (Title 8, California Code of Regulations, §5193) applies and you need a written plan.
Designated first-aid responders or an emergency response team.
Anyone whose job includes responding to injuries on site. The trigger is the designation, not the headcount.
Custodial or janitorial staff cleaning restrooms, locker rooms, or production areas
where blood, vomit, sharps, or other OPIM can reasonably show up.
Laboratory workers
handling human blood, tissue, or unfixed specimens, or research staff working with HIV, HBV, or HCV.
Production or warehouse staff at facilities where workplace injuries involve blood exposure
as a foreseeable part of the work, including food processing and distribution sites where sharp equipment and frequent injuries create exposure to a cleanup crew or co-worker.
Healthcare and dental roles
, the obvious cases, plus any role with reasonable patient or specimen contact. Veterinary settings should be evaluated separately; animal blood alone is not automatically OPIM under §5193 unless the work involves human blood, OPIM, or HIV/HBV/HCV research materials.
If you can answer yes to any of the above and you cannot produce a current written Exposure Control Plan, an exposure determination, a Hep B vaccination offer record, training records, and a sharps injury log where applicable, you have a Cal/OSHA gap. That is the working definition.
What the Cal/OSHA Standard Requires
California regulates bloodborne pathogen exposure under Cal/OSHA, not your local CUPA (which may be a county environmental health department, fire department, or another local agency depending on jurisdiction) and not CDPH. The standard is Title 8 CCR §5193, the California analog of the federal OSHA standard at 29 CFR 1910.1030. California’s rule is in places stricter than the federal version. Here is the structure of the obligation.
| Element | What it requires |
|---|---|
| Regulator | Cal/OSHA. Inspections and citations come from Cal/OSHA, not your local fire department or CDPH. |
| Governing rule | Title 8 CCR §5193 (California). Federal counterpart is 29 CFR 1910.1030. Cite the California section. |
| Written ECP | A written Exposure Control Plan, accessible to employees, reviewed and updated at least annually. |
| Exposure determination | A documented list of every job classification where employees have occupational exposure, divided into “all employees in this classification” and “some employees in this classification.” The plan must list the tasks and procedures that create the exposure. |
| Methods of compliance | Engineering and work-practice controls (sharps containers, splash minimization, handwashing facilities), PPE selection and use, housekeeping, regulated-waste handling, contaminated-laundry procedures. |
| Hepatitis B vaccination | Must be offered at no cost to every employee with occupational exposure, within 10 working days of initial assignment to a covered role. Cal/OSHA has a narrow exception for certain collateral-duty designated first-aid providers whose primary job is not first aid, if the employer meets specific ECP, incident-reporting, training, and post-incident vaccination conditions; for those providers, the vaccine must be offered within 24 hours of a rendering-assistance incident. Declination is allowed only on a signed declination form. |
| Post-exposure evaluation | A documented procedure for what happens after an exposure incident: source-individual identification and testing where permitted, confidential medical evaluation, post-exposure prophylaxis, follow-up. |
| Training | Annual training for every covered employee, plus training at initial assignment and any time job tasks change in a way that creates new exposure. Records of attendance, content, and trainer credentials. |
| Recordkeeping | Medical records kept for the duration of employment plus 30 years. Training records kept three years. Sharps injury log where applicable. |
A plan is not just a document. It is a written plan plus a vaccination program plus a training program plus a recordkeeping system that all stay current together. If any one of those is missing, Cal/OSHA treats the facility as out of compliance with §5193.
How the Exposure Determination Actually Works
The center of a real ECP is the exposure determination. It is built from a structured interview, not a template guess. When we walk a facility, we sit down with the EHS lead or operations manager and work through the job classifications one by one. For each role we ask:
- Does this role involve any reasonable contact with blood or OPIM in the normal course of work?
- Is the exposure expected for everyone in the classification, or only some employees (for example, only the trained first-aid responders in a production crew)?
- What tasks or procedures create the exposure (restroom cleanup, lab work, responding to an injury, opening sharps containers)?
- What engineering controls are in place (sharps containers and their locations, splash barriers, ventilation, eyewash stations, handwashing access)?
- What PPE is provided and used (glove type, eye and face protection, fluid-resistant garments)?
- What housekeeping procedures are used for surfaces, equipment, and contaminated laundry?
- Where does an exposed employee go for the post-exposure evaluation, and is that arrangement documented?
The intake also covers practical details that the standard requires but that get missed in template plans: the location of medical records, whether first-aid kits are stocked with personal protective equipment, the brand and decontamination procedure for goggles and stretchers, and whether eyewash and self-closing doors are working in the areas where exposure can occur.
That interview is what makes the plan actually fit the facility. A generic ECP downloaded from a federal site will pass a quick reading; it will not survive a Cal/OSHA inspector asking the operations manager which job classifications are covered and why.
What Goes Into the Written Plan
The ECP we deliver has a defined spine. Each section is in the plan because Cal/OSHA expects it and because someone on the floor needs to be able to reference it.
Introduction and Company Profile.
Facility scope, applicability statement, plan accessibility, annual review commitment.
Occupational Exposure Determination.
The job-classification table built from the interview, with the all-vs-some distinction and the tasks that create exposure.
Engineering and Work-Practice Controls.
Sharps handling, handwashing, splash and aerosol minimization, eating/drinking restrictions in exposure areas, no recapping or hand-bending of needles.
Personal Protective Equipment.
What PPE is required for each task, who provides it, how it is decontaminated or disposed of, how the employer pays for it.
Housekeeping, Spill Cleanup, and Regulated-Waste Disposal.
Cleaning and decontamination schedule, spill response procedure, regulated-waste container labeling, disposal vendor coordination.
Labels and Signs.
Biohazard labeling for containers, refrigerators that hold OPIM, contaminated laundry, regulated waste, and applicable signage.
Hepatitis B Vaccination Program.
Vaccination offer process, the no-cost requirement, the declination form (and the language Cal/OSHA requires on it), the path to revoke a prior declination.
First-Aid Incident Reporting and Post-Exposure Evaluation.
What an employee does after an exposure, who they report it to, where they go, what records get created, what the source-individual evaluation process looks like.
HIV/HBV/HCV Research-Laboratory Provisions.
Only if applicable. The standard has additional requirements for facilities that culture HIV, HBV, or HCV.
Training.
Initial and annual training program, content, trainer qualifications, attendance records.
Recordkeeping.
Medical records (employment plus 30 years), training records (three years), sharps injury log where applicable, declination records.
Appendices.
The signed Hepatitis B vaccination declination form, the exposure-incident report form, the source-individual consent form, and a copy of 8 CCR §5193 for reference.
You get the plan as a binder (or its digital equivalent), the annual training materials, the declination form set, and the recordkeeping framework. We build it to your facility, your job classifications, and your specific operations. We do not deliver a template with your name on the cover.
If you want to dig deeper into the underlying obligations, our piece on what a bloodborne pathogen is and what Cal/OSHA considers OPIM covers the regulatory definitions, and the piece on who needs an exposure control plan beyond healthcare walks through the job-classification analysis with examples from outside the clinical world.
The Hepatitis B Vaccination Requirement
The Hepatitis B vaccination obligation is the part of the standard that most often surprises employers, so it is worth saying plainly. Every employee with occupational exposure must be offered the Hep B vaccine series at no cost to the employee, within 10 working days of initial assignment to a role with exposure. Cal/OSHA has a narrow exception for certain collateral-duty designated first-aid providers. If the employee’s primary job is not first aid and the employer meets the standard’s specific ECP, incident-reporting, training, and post-incident vaccination conditions, the vaccine series must instead be offered within 24 hours of a rendering-assistance incident involving blood or OPIM. If the employee declines, they sign the declination form (the Cal/OSHA-required language is specific). They can revoke that declination later and the employer still has to provide the vaccine at no cost.
CDMS documents the program: the offer process, the declination paperwork, the timing, and the recordkeeping. We do not administer vaccines. The vaccination itself is done through an occupational health provider, and the program documents which provider the employer uses and how the records get to the employee’s confidential medical file.
Training: What Cal/OSHA Expects
Training is the other piece that most facilities underdeliver. Cal/OSHA expects 14 specific topic areas covered at initial assignment and again every year, with attendance records and trainer credentials documented. The full breakdown lives on our bloodborne pathogen training requirements page, but the short version: the training has to cover the standard itself, the epidemiology and transmission of bloodborne diseases, the facility’s specific ECP, the methods of exposure recognition and prevention, PPE, the Hepatitis B vaccination program, post-exposure procedures, biohazard signs and labels, and a question-and-answer portion. Online generic content rarely meets the “facility-specific ECP” requirement.
How a CDMS Engagement Works
The work follows a consistent shape. We scale it to the number of covered job classifications, the number of sites, and the headcount that needs training.
- 1. Scoping call. A short conversation where we confirm applicability (are there covered job classifications, do you currently have a plan, when was it last reviewed). We ask what triggered the call: a gap assessment finding, a public-agency RFP that asked for an ECP by name, a notice from Cal/OSHA, or an internal review.
- 2. On-site assessment. Our consultant comes to your facility. We walk the areas where exposure can occur, examine engineering controls and PPE in actual use, review existing first-aid and emergency-response procedures, and conduct the exposure-determination interview with the people who know the operations.
- 3. Plan development. We build the written ECP to your facility: the exposure determination, the methods of compliance, the vaccination program, the post-exposure procedure, the training program, and the recordkeeping framework. We prepare the forms (Hep B declination, exposure-incident report, source-individual consent) and the appendix copy of the standard.
- 4. Training delivery. Initial training for covered employees, plus the annual refresher schedule. Training records become part of the deliverable.
- 5. Annual review. Cal/OSHA requires the plan to be reviewed at least annually and whenever new tasks or job classifications create new exposure. Many facilities fold the annual ECP review and training refresh into a broader ongoing compliance management arrangement so the obligation does not lapse.
In practice, BBP rarely shows up by itself. It travels with the IIPP, with respirator and fire-prevention programs, and with hazard communication. If your inquiry is bundled, see our piece on how BBP fits into your IIPP and broader safety program. And if radiation came up in the same conversation, see our radiation safety program pillar; they are separate Cal/OSHA programs that often surface in the same gap-assessment cycle.
We do not commit to a specific number of days or weeks before we have seen the facility and confirmed scope. We provide a fixed-price quote and a timeline after the scoping call. Pricing depends on covered job classifications, site count, and training headcount.
What Happens If a Facility Skips the Plan
Cal/OSHA inspectors look for the written ECP, the exposure determination, the Hepatitis B vaccination records, the training documentation, and the recordkeeping framework. A facility that has covered job classifications and no plan is the most common deficiency in the BBP space, and it is the easiest one for an inspector to write up. Cal/OSHA issues citations with corrective deadlines and monetary penalties; the citations carry over into insurance and contractor-prequalification scoring, which is where the cost is often felt next.
The other risk is liability after an exposure incident. Without a written plan, documented training, and a post-exposure procedure, the employer has no record of meeting the standard, and the employee has no clear path to the medical evaluation Cal/OSHA requires. That is the case neither party wants to be in.
Frequently Asked Questions
We are not a healthcare facility. Do we still need a Bloodborne Pathogen Exposure Control Plan?
Probably yes, if you have designated first-aid responders, custodial staff cleaning restrooms or production areas, or any role with reasonable contact with blood or OPIM. The Cal/OSHA standard applies based on occupational exposure, not facility type. Most CDMS BBP plans are written for industrial, commercial, and distribution facilities, not clinical settings.
Do we have to pay for the Hepatitis B vaccine?
Yes. The vaccine series must be offered at no cost to every employee with occupational exposure, generally within 10 working days of initial assignment. A narrow exception exists for certain collateral-duty designated first-aid providers if specific conditions are met; for those employees, the vaccine must be offered within 24 hours of an incident involving blood or OPIM. Employees can decline, but only by signing the Cal/OSHA-required declination form, and they can revoke the declination later and still receive the vaccine at no cost.
How long do we have to keep the records?
Medical records (vaccination, declination, post-exposure evaluations) are kept for the duration of employment plus 30 years. Training records are kept three years. Sharps injury logs, where applicable, are kept five years.
Is online certification enough for our employees?
Not on its own. Cal/OSHA training has to cover your facility’s specific ECP, your specific exposure-determination categories, and an opportunity for live Q&A with a qualified trainer. Generic online content rarely meets the facility-specific requirement and does not produce the attendance records Cal/OSHA expects.
How often does the plan need to be reviewed?
At least annually, and whenever new tasks, procedures, or job classifications create new exposure. The annual review is a documented review, not just a calendar checkbox.
Does our local CUPA enforce this?
No. The Bloodborne Pathogens standard is Cal/OSHA, not your local CUPA (which may be a county environmental health department, fire department, or another local agency depending on jurisdiction, that handles hazardous materials reporting). Inspections come from Cal/OSHA. Your CUPA will not ask about your ECP during an HMBP inspection, but Cal/OSHA can, and they do.
Trusted throughout California
BSY started working with CDMS last year after our in-house EHS person departed the company. CDMS reviewed our existing operational permits as well as any additional Federal, State and Local regulations that could apply and helped us to create a comprehensive compliance calendar to track regulatory deadlines and submittal due dates. The CDMS team does an excellent job of tracking everything and can be relied upon to complete the forms accurately and assist with submittals, allowing me to focus on our business.
Speak with a CDMS EHS expert
Tell us about your facility and your deadline. You’ll get a clear read on what applies and a scoped plan to handle it.