Bloodborne Pathogens and Your IIPP: How BBP Fits Your Safety Program
If your California facility already has a written Injury and Illness Prevention Program (IIPP), you may already have the trigger for a Bloodborne Pathogen Exposure Control Plan (ECP) sitting inside it.
If your California facility already has a written Injury and Illness Prevention Program (IIPP), you may already have the trigger for a Bloodborne Pathogen Exposure Control Plan (ECP) sitting inside it. Most employers do not see the link until a gap assessment, a Cal/OSHA inspection, or a safety-package proposal surfaces it. The two programs sit under different parts of Title 8, but they share the same discovery point. The moment your IIPP names designated first-aid responders, an emergency response team, or custodial roles expected to clean blood, sharps, or OPIM (other potentially infectious materials), you should complete a bloodborne pathogen (BBP) exposure determination. If those duties create reasonably anticipated contact with blood or OPIM, Cal/OSHA’s §5193 applies and you need a written Exposure Control Plan.
For the full overview of what an ECP contains, see our bloodborne pathogen exposure control plan pillar.
The IIPP Is Where BBP Usually Surfaces
The IIPP is the umbrella Cal/OSHA safety program every California employer is required to maintain. It names who is responsible for safety, defines how hazards are identified and corrected, and lists the safety training employees receive. It is the document a Cal/OSHA inspector asks for first.
When we walk a facility for a gap assessment or an IIPP rebuild, three signals in the IIPP and its supporting documents are what most often surface a BBP gap:
- The IIPP lists a designated first-aid response team or trained responders. The designation, not the headcount, is the trigger.
- The hazard assessment identifies blood or bodily-fluid cleanup as a foreseeable task. Custodial staff cleaning restrooms, locker rooms, or production areas with sharps risk land here.
- The emergency action plan assigns specific employees to render aid before paramedics arrive. Those employees are covered under Title 8 CCR §5193 even if the facility is not a healthcare site.
If any of those appear in your IIPP and you cannot produce a written ECP, an exposure determination, a Hepatitis B vaccination offer record, and an annual training record, the gap is on the BBP side. The IIPP did its job by surfacing the role. Cal/OSHA will then expect the matching plan. For a deeper breakdown of which roles trigger the standard, see who needs a bloodborne pathogen exposure control plan.
Where the Two Programs Overlap
The IIPP and the BBP standard are governed by different rules but share several pieces. Building them as one coordinated safety program is faster than treating them as separate projects.
| Element | IIPP requirement | BBP / ECP requirement (8 CCR §5193) |
|---|---|---|
| Hazard identification | Periodic inspections; a written process for identifying and correcting workplace hazards. | An exposure determination listing every job classification with reasonably anticipated contact with blood or OPIM. |
| Training | General safety training on the hazards employees face. | Annual training for every covered employee, plus initial-assignment training before a new hire starts covered work. |
| Recordkeeping | Inspection records, hazard corrections, training rosters. | Medical records kept for the duration of employment plus 30 years; training records three years; sharps injury log where applicable. |
| Responsibility assignment | Names the person with safety authority and the chain of accountability. | Names the person responsible for plan implementation, the vaccination program, and post-exposure follow-up. |
| Review cycle | The IIPP is reviewed and updated when conditions change. | The ECP is reviewed and updated at least annually and when new tasks or roles create new exposure. |
| Emergency procedures | An emergency action plan covering injury response and reporting. | A post-exposure evaluation procedure: source-individual identification where permitted, confidential medical evaluation, follow-up, documentation. |
The pattern: the IIPP defines the general safety architecture; the BBP standard adds a specific layer wherever occupational exposure exists. The two programs reference each other in practice. Your IIPP’s emergency-response section should point to the ECP. Your ECP’s training program should appear on the IIPP’s training schedule.
How CDMS Sequences the Work
We almost never write an ECP as a standalone deliverable. The work shows up the way the real demand shows up: as part of a safety plans and training engagement, a public-agency RFP line item (“Bloodborne Pathogen and Exposure Control Plan” sitting next to fire prevention or respiratory protection), or a finding from a gap assessment that flagged a missing program.
When both the IIPP and the BBP standard are in scope, a typical sequence is:
Document review and walkthrough.
We review the existing IIPP, any prior ECP draft, training records, and the safety roster, then walk the site with the EHS lead, identify the emergency-response and custodial roles, and observe the engineering controls in place.
Exposure-determination interview.
We sit with operations and human resources and work through job classifications one by one, marking which are “all employees,” which are “some employees,” and which tasks create the exposure. This is the BBP-specific step that does not appear in a standard IIPP build.
Plan development.
We draft the ECP to fit the facility, update the IIPP’s emergency-response and training sections to reference it, and prepare the Hep B vaccination offer and declination forms. If the IIPP needs other updates, they happen in the same engagement so the documents agree.
Training and rollout.
Annual BBP training for covered employees, delivered on a schedule that aligns with the IIPP training cycle so you are not running two parallel calendars. Sign-in sheets, content outline, and trainer credentials go into the same training file.
The IIPP and the ECP do not need to be written by different people in different months. When they are built as one engagement, the documents agree, the training calendar is one calendar, and the recordkeeping is one system.
What Inspectors See When They Connect the Two
A Cal/OSHA inspector who pulls your IIPP and finds an emergency response team listed will, in our experience, ask for the ECP next. If the two do not match, the deficiency is visible in seconds. The most common findings we see when programs were built in isolation:
- The IIPP names a first-aid response team; the ECP does not list those roles in the exposure determination.
- The ECP has been reviewed annually; the IIPP has not been touched in years and the emergency-response section is out of date.
- BBP training records exist but are not on the IIPP training schedule, so the inspector cannot verify the program is being delivered to the people who need it.
- A Hep B vaccination offer was made; the declination form does not match the wording required by 8 CCR §5193.
The fix is rarely complicated. It usually requires both programs in front of you at the same time. That is the argument for building or updating them together.
Trusted throughout California
BSY started working with CDMS last year after our in-house EHS person departed the company. CDMS reviewed our existing operational permits as well as any additional Federal, State and Local regulations that could apply and helped us to create a comprehensive compliance calendar to track regulatory deadlines and submittal due dates. The CDMS team does an excellent job of tracking everything and can be relied upon to complete the forms accurately and assist with submittals, allowing me to focus on our business.
Speak with a CDMS EHS expert
Tell us about your facility and your deadline. You’ll get a clear read on what applies and a scoped plan to handle it.