How To Build a Dental OSHA Exposure Control Plan
Build a compliant OSHA Exposure Control Plan for your dental office. DDS Rescue makes it simple. Get expert guidance today!
Key Takeaways
- The Exposure Control Plan is a required written document under 29 CFR 1910.1030 that OSHA inspectors request first, and training certificates alone do not satisfy compliance.
- A complete dental office plan must include exposure determination by job classification, engineering and work-practice controls, PPE requirements, Hepatitis B vaccination documentation, post-exposure procedures, training records, and a sharps injury log when applicable.
- The plan requires an annual review that produces documented evidence, including a dated signature page, safer-device evaluation notes, and records of non-managerial employee input on controls.
- Common violations stem from missing Hepatitis B declinations, absent annual review documentation, and training records stored outside the plan rather than within it.
- DDS Rescue builds and monitors a customized, practice-specific Exposure Control Plan for dental offices, which supports ongoing compliance without disrupting production.
Who Is Covered And Key Terms
Three roles share ownership of the Exposure Control Plan in a dental practice. The office manager or practice administrator owns the document, maintains it, dates it, and can produce it on request. The lead dental assistant or sterilization lead owns the clinical sections, because that is where the exposure risk concentrates. The dentist signs and is accountable for the plan.
Before breaking down the plan itself, three terms appear repeatedly in this article. The Exposure Control Plan (ECP) is the written document OSHA requires a practice to have, review annually, and update when roles or procedures change. PPE means personal protective equipment, such as gloves, masks, eye protection, and protective clothing. The sharps injury log is a confidential record of percutaneous injuries from contaminated sharps, required when the practice keeps OSHA 300 records.
This article addresses U.S. dental practices operating under federal OSHA jurisdiction. Twenty-two OSHA-approved State Plans cover private-sector employers (21 states plus Puerto Rico), and seven additional plans cover only state and local government workers. Those plans must be at least as effective as federal OSHA, and some are more stringent. State dental boards and health departments add their own requirements on top of OSHA’s rules. A practice in California, for example, faces additional sharps injury log requirements under state law that do not apply in every other state.
What Goes In A Dental Office Exposure Control Plan
The required components of a dental office Exposure Control Plan, in the order they typically appear in the document, are:
- Exposure determination by job classification, which lists every role in the practice and whether that role involves occupational exposure to blood or other potentially infectious materials
- Methods of compliance, engineering controls, which include sharps containers, self-sheathing needles, safer medical devices, and the practice’s evaluation of those devices
- Methods of compliance, work-practice controls, which describe how tasks are performed to reduce exposure, including needle-handling procedures and instrument transport
- PPE, which specifies what protective equipment the practice requires by task, who provides it, and how it is maintained
- Hepatitis B vaccination offer and declination, which records the offer, the signed declination form if applicable, and where both are filed
- Post-exposure evaluation and follow-up, which outlines the written steps for a needlestick or blood splash, including the pre-arranged healthcare facility
- Employee training records, which document who was trained, when, on what content, and the trainer’s qualifications
- Recordkeeping, which covers medical records retained for the duration of employment plus 30 years, and training records retained for three years
- Sharps injury log, which is a confidential log of percutaneous injuries, required when Part 1904 recordkeeping applies
- Annual review and signature page, which is dated, signed, names the reviewer, and documents the safer-device evaluation and employee input
Exposure determination by job classification. Under 29 CFR 1910.1030(c)(2), the determination must list job classifications in which all employees have occupational exposure, classifications in which only some do, and the specific tasks that create exposure for that second group. It must be made without regard to the use of PPE, so a dental assistant who wears gloves is still listed as having occupational exposure. The roles that belong in a dental practice’s exposure determination include dentist, hygienist, dental assistant, sterilization technician, and front office staff who handle specimens or regulated waste. Generic templates routinely omit the sterilization technician, even though instrument processing is where exposure risk concentrates in a dental setting.
Engineering and work-practice controls. Engineering controls isolate or remove the hazard, such as sharps containers, self-sheathing needles, and safer medical devices. Work-practice controls reduce exposure by changing how a task is performed, such as handpiece processing protocols, instrument transport procedures, and one-handed needle recapping when recapping is clinically unavoidable. The plan must document the practice’s evaluation of safer medical devices. Under 29 CFR 1910.1030(c)(1)(v), employers must solicit input from non-managerial employees who provide direct patient care and face sharps exposure. That input must cover identifying, evaluating, and selecting engineering and work-practice controls. The solicitation and the feedback must be documented in the plan itself.
PPE. The plan must specify what PPE is required by task and state the practice’s position on protective clothing, including lab coats. Under 29 CFR 1910.1030(d)(3), PPE is provided at no cost to the employee and in appropriate sizes, and the employer is responsible for cleaning, laundering, repairing, and replacing it. A plan that leaves protective clothing unaddressed creates a gap an inspector will find.
Hepatitis B vaccination offer and declination. The offer must be made within 10 working days of initial assignment to any employee with occupational exposure, after training, at no cost. An employee who declines must sign the exact declination statement language in Appendix A of 29 CFR 1910.1030. A verbal declination with no signed form is insufficient. This is paperwork, and it is where practices most often have a gap, because the offer was made, the employee declined, and nothing was signed or filed.
Post-exposure evaluation and follow-up. The plan must contain written steps for what happens after a needlestick or blood splash, including who the employee contacts, which facility they go to, and what forms are completed. Because HIV post-exposure prophylaxis works best when started as soon as possible after exposure, ideally within 24 hours, and must be started no later than 72 hours after exposure, the plan must name a specific facility for after-hours exposures. A generic instruction to find urgent care does not meet that need. The practice’s pre-arranged relationship with an occupational health provider belongs in this section and should be documented before an incident occurs.
Training records. The training-record section of the ECP holds who was trained, when, what content was covered, and the trainer’s qualifications. Under 29 CFR 1910.1030(h)(2), those records must be kept for three years from the training date. This section records training and does not deliver it. For more on what annual OSHA training must include, see OSHA Training for Dental Offices: How To Get Compliant.
Sharps injury log and recordkeeping retention. The sharps injury log, required when the practice keeps OSHA 300 records, must record the type and brand of device involved, the work area where the incident occurred, and how it happened. It is retained for five years. Medical records are retained for the duration of employment plus 30 years and kept confidential. As a practical matter, they are typically maintained in a file separate from the personnel folder.
The Annual Review And Its Deliverables
The annual review matters because it produces evidence that the plan is current. A simple note that says “review annually” does not meet that requirement.
29 CFR 1910.1030(c)(1)(iv) requires the Exposure Control Plan to be reviewed and updated at least annually and whenever new or modified tasks, procedures, or positions affect occupational exposure. The annual review must also reflect changes in technology that eliminate or reduce exposure, and must document the consideration and implementation of appropriate commercially available safer medical devices.
The annual review produces a specific set of documents. These include a dated signature page with the reviewer named, a note on the safer-medical-device evaluation that lists devices considered and the reasoning if none were adopted, documented evidence that non-managerial employees were consulted on engineering and work-practice controls, and any updates to the exposure determination when roles or equipment changed during the year. The obligation is to document consideration, not only adoption. A practice that evaluated three safer devices and adopted none has met the requirement if the evaluation and reasoning are recorded. A practice that adopted a device with no record of having surveyed the market has not met the standard.
A plan with no dated annual review is the first thing an inspector flags. Where the signed page lives, how the document is versioned, and who is named as the reviewer all serve as evidence. Re-signing last year’s plan without updating the safer-device note and the employee-input record does not satisfy the standard.
Assigning Ownership And Keeping The Plan Current
Assign ownership explicitly in the document so everyone knows their role. The office manager maintains the ECP and can produce it on request. The lead dental assistant supplies the clinical content, including instrument processing protocols, sterilization procedures, and waterline treatment. The dentist signs and is accountable for the plan as a whole.
The annual review serves as the scheduled update cycle. Outside that cycle, the plan must be updated when any of the following occur. New equipment is introduced, a new hire joins a role with occupational exposure, an existing role changes in a way that affects exposure, a needlestick or exposure incident happens, or sterilization workflows change. These triggers are mandatory, because the standard requires updates whenever necessary to reflect new or modified tasks and procedures. A plan that was accurate in January and has not been touched since a new sterilizer was installed in July is out of date.
For a full picture of what OSHA requires beyond the ECP itself, including posters, fire extinguisher inspections, PPE hazard assessments, and the HazCom program, see Dental Office OSHA Requirements: The Compliance Checklist.
The Paperwork Failures That Show Up Most
The most common OSHA violations in dental offices are almost always paperwork failures. The clinical work is usually being done correctly, while the documentation of that work falls short.
Missing Hepatitis B declinations. Missing declinations are the most frequent gap. The practice can confirm the offer was made but cannot produce a signed Appendix A form for every employee who declined. Closing this gap means locating every employee with occupational exposure, confirming vaccination status, and obtaining signed declinations from anyone who declined. Those forms belong in the confidential medical record, not the personnel folder.
No dated annual review. An Exposure Control Plan that exists with only the original date, or a signature page that has been re-signed without any substantive update, signals a missing review. Treat the annual review as a deliverable with a checklist that covers the safer-device evaluation, employee input documentation, exposure determination check, and signature page. File the completed version with the prior version archived.
No safer-device evaluation note. Some plans describe engineering controls but contain no record of what devices were evaluated or why current devices were retained or changed. Correcting this requires documenting the evaluation annually, even when no change is made. The record of having looked is what the standard requires.
Training records that live only as certificates. Many practices have certificates from an annual training session, while the ECP’s training-record section is blank or missing. Fix this by moving the training documentation into the plan, including dates, a content summary, trainer qualifications, and attendee names and job titles. The certificate can stay in the drawer, and the record belongs in the plan.
When these failures are found and corrected before an inspection, they are manageable. When they are found during one, they become the basis for citations. The paperwork creates the compliance record, and practices can repair it with focused effort.
Training And The Exposure Control Plan
A training certificate is not the Exposure Control Plan. The plan is the document an inspector asks for first, and training is one component the plan must document.
The ECP’s training-record section documents that training occurred, including who attended, when, what was covered, who delivered it, and why that person was qualified. OSHA’s Bloodborne Pathogens standard requires the plan to contain the schedule and method of implementation for employee training. The plan therefore must describe how training is delivered and tracked, not just confirm that it happened once. A practice whose training records exist only as a stack of certificates, with no connection to the ECP, holds proof of sessions but lacks full compliance documentation.
For the HazCom side of annual training obligations, see OSHA HazCom Compliance for Dental Offices.
Where DDS Rescue Fits In Your Compliance System
DDS Rescue is the dental-exclusive compliance and cybersecurity company that gets dental practices genuinely OSHA compliant, including a customized, practice-specific Exposure Control Plan. Every engagement starts with a live, on-camera, one-hour mock audit walkthrough of the actual facility that covers paperwork, posters, sterilizers, instrument processing, and waterlines. The lead dental assistant and office manager attend that walkthrough, while the doctor stays in production so patient care continues.
The walkthrough produces a written deficiency report. A customized, CE-accredited live training follows about three days later over the lunch hour. The doctor attends that session, which opens with a two-minute executive summary of what the walkthrough found, and that hour is the only time the doctor spends on compliance all year. Everything then lives in a client portal at ddsmethod.com, actively monitored by DDS Rescue. When paperwork goes stale, DDS Rescue calls the practice, so the team does not have to track its own compliance calendar.
The approaches that fall short look familiar. Some rely on training delivered by a rep out of a paper manual, with no one looking at the sterilization area. Others use online courses that issue a certificate and call the job done, AI-generated documents that look complete but have no one accountable behind them, or regional compliance firms that take a half day of production and lead with a fines slideshow. These approaches do not produce a defensible, practice-specific Exposure Control Plan with a named reviewer, a dated signature page, and a vendor who answers the phone when an inspector shows up.
If an OSHA inspection or health department visit happens, DDS Rescue helps draft responses and counterarguments. DDS Rescue has been protecting dental practices nationwide for 15+ years and currently supports more than 1,000 practices. Its leadership brings three decades in dental equipment and infection control. Everything is delivered live and virtually, so location never limits access to support.
The Plan As A Document You Can Hand Over
The Exposure Control Plan is a document the practice builds, dates, reviews annually, and can produce on request. Training records sit inside it rather than replace it. The annual review functions as a set of deliverables with evidence attached, including a dated signature page, a safer-device evaluation note, documented employee input, and any updates to the exposure determination.
DDS Rescue builds and monitors that plan for the practice without costing a production hour. Schedule a FREE Rescue Call to get your plan built and monitored.
Frequently Asked Questions
What Must Be Included In A Dental Office Exposure Control Plan?
A dental office Exposure Control Plan must contain at minimum an exposure determination listing every job classification by exposure status, made without regard to PPE use. It must also include the schedule and method of implementation for engineering controls, work-practice controls, PPE, Hepatitis B vaccination, post-exposure evaluation, employee training, and recordkeeping, along with the procedure for evaluating the circumstances surrounding an exposure incident. The plan must include a dated annual review with a safer-device evaluation note, documented non-managerial employee input on engineering and work-practice controls, and a signature page. The sterilization technician belongs in the exposure determination, because instrument processing is a high-exposure role that generic templates routinely omit.
How Often Must The Exposure Control Plan Be Reviewed?
The plan must be reviewed and updated at least annually under 29 CFR 1910.1030(c)(1)(iv). It must also be updated whenever new or modified tasks, procedures, or employee positions affect occupational exposure, so a new hire in a clinical role, a new piece of equipment, or a change in sterilization workflow each triggers an update outside the annual cycle. The annual review must document the consideration and implementation of safer medical devices and must record that non-managerial employees were consulted on engineering and work-practice controls.
Who Is Responsible For The Exposure Control Plan In A Dental Office?
The dentist, as the employer, is legally accountable for the plan’s existence and accuracy. In practice, the office manager or practice administrator maintains the document and can produce it on request. The lead dental assistant or sterilization lead supplies the clinical content, including instrument processing protocols, sterilization procedures, and post-exposure steps. Assigning these roles explicitly in the plan itself is good practice and makes the annual review easier to execute.
Does OSHA Require Lab Coats?
OSHA requires the Exposure Control Plan to specify what protective clothing is required by task and to state the practice’s position on it. The standard requires employers to provide, clean, launder, and replace protective clothing at no cost to the employee. Whether a lab coat specifically is required depends on the tasks being performed and the practice’s written PPE policy. Leaving the question unaddressed in the plan creates a gap, so the plan should state the practice’s position on protective clothing clearly.
What Is The Most Common OSHA Violation In Dental Offices?
Paperwork failures account for the majority of OSHA violations in dental practices. The most frequent gaps are missing Hepatitis B declination forms, an Exposure Control Plan with no dated annual review, no documentation of the safer-medical-device evaluation, and training records that exist as certificates outside the plan rather than as entries within it. These issues are correctable before an inspection and manageable when handled properly, especially when a system tracks deadlines and documentation.
Does Annual OSHA Training Satisfy The Exposure Control Plan Requirement?
No. The Exposure Control Plan is a written document that must exist, be dated, be accessible to employees, and be produced on request by OSHA. Annual training is one component the plan must document, including who was trained, when, on what content, and by whom. A training certificate confirms that a session occurred, but it does not substitute for the written plan, the exposure determination, the Hepatitis B declination files, the safer-device evaluation, or the annual review signature page.
How Does A Practice Document The Annual Review?
The annual review should produce a dated signature page naming the reviewer, a note on the safer-medical-device evaluation that lists devices considered and decisions made, and the reasoning if no change was adopted. It should also include documentation that non-managerial employees were consulted on engineering and work-practice controls, along with any updates to the exposure determination reflecting role or equipment changes during the year. The completed review is filed with the current version of the plan, and the prior version is archived.
Can The Plan Be Kept Electronically?
Yes. OSHA requires a written Exposure Control Plan under 29 CFR 1910.1030(c)(1)(i), but it does not require that the plan be kept on paper. The plan must be accessible to employees and available to OSHA on request, and an electronic system can meet both requirements. The practical requirement is that the system is accessible to staff during working hours and that the practice can produce the current version, with its dated signature page and review history, immediately on request. A client portal that holds the plan, tracks its review status, and alerts the practice when documentation goes stale satisfies both the accessibility requirement and the accountability need.
