One Exposure Control Plan Template, Different Job Classifications at Every Site

Corporate publishes the exposure control plan once: a template that lists the job classifications with occupational exposure to blood or other potentially infectious materials, the engineering and work practice controls that apply, the hepatitis B vaccination offer, and the post-exposure evaluation procedure. Every site adopts it. Every site's annual review checkbox gets marked complete. Then an OSHA compliance officer walks one facility following an employee complaint, asks to see the exposure determination for the maintenance technicians who service the on-site medical clinic's sharps containers, and finds that this site added a role the corporate template never anticipated — one that exists at four of the company's thirty-one locations and was never separately evaluated at any of them.

The Standard Requires a Determination, Not a Document

29 CFR 1910.1030 doesn't ask an employer to have an exposure control plan in the abstract. It requires the plan to include an exposure determination: a list of job classifications in which all employees have occupational exposure, and a list of job classifications in which some employees have occupational exposure, along with the specific tasks and procedures that create it. That determination has to be made without regard to the use of personal protective equipment — the question is whether the task creates exposure, not whether the employee is currently protected against it. This is a task-level and role-level analysis, not a company-level policy statement, and it has to be performed for the actual roles and actual tasks present, which is precisely what tends to drift once a company operates more than a handful of locations.

A single-site employer runs this determination once against a job list they can hold in their head. A multi-site operator is running it, in effect, once per location, because the roles present at a distribution center, a manufacturing plant with an on-site clinic, a fleet maintenance yard, and a corporate office are not the same, and the tasks a nominally identical job title performs can vary by site even when the title doesn't. A "facilities technician" at one plant might never touch anything but HVAC and lighting; the same title at a plant with an occupational health clinic might handle sharps disposal as a routine part of the job. The corporate template's exposure determination is only accurate at the sites it was built against — every other site is adopting a document that describes someone else's job classifications.

Where the Determination Actually Breaks

The gap rarely opens because a site ignores the requirement. It opens because roles change locally in ways that never get reported back to whoever owns the template. A site adds an on-site first aid room staffed by employees who weren't previously in a role with exposure. A plant brings cleaning and janitorial work in-house instead of contracting it, and now employees who empty restroom trash and clean up after injuries are performing a task the original determination assigned only to an outside vendor's staff. A distribution center starts handling occasional returned medical supply pallets as a new account, and warehouse staff who were never in an exposure-determined classification are suddenly handling packaging that may contain contaminated materials. None of these are dramatic changes from the site's perspective — they read as ordinary operational adjustments — and none of them trigger an update to a document that lives with corporate EHS and gets reviewed on an annual calendar, not an operational one.

The training and vaccination obligations that follow from the exposure determination compound the gap rather than catching it. Once an employee is correctly identified as having occupational exposure, 1910.1030 requires training at the time of initial assignment and annually thereafter, and it requires the employer to make the hepatitis B vaccination available at no cost within ten working days of initial assignment. An employee who was never added to the exposure-determined classification in the first place doesn't get flagged for either — not because the training or vaccination program failed, but because the roster feeding it was never corrected to include them. The company can have a fully compliant vaccination and training process running perfectly against an exposure determination that stopped being accurate at a given site months or years earlier.

Why the Corporate Rollup Doesn't Catch It

The annual review requirement in the standard asks the employer to review and update the exposure control plan at least annually to reflect changes in tasks, procedures, and job classifications that affect occupational exposure. At a single site, that review is a conversation between the safety lead and the people who actually know what changed in the roles that year. At a multi-site company, that review usually happens at the template level — corporate confirms the document itself still reads correctly, the controls it describes are still current, the vaccination and training language still matches the standard — without a parallel process asking each site whether its own local job classifications still match what the template assumes. A plan can be reviewed, updated, and technically current at the document level every single year while drifting further from accurate at an increasing number of individual sites, because the review that satisfies the standard's paperwork requirement isn't the same review that would catch a site-level classification gap.

This is also where OSHA's Recordkeeping standard intersects the exposure question in a way that's easy to miss. A bloodborne pathogens exposure incident that meets the criteria for a recordable injury or illness has to be recorded on that establishment's OSHA 300 Log, and if the underlying exposure determination for that role was wrong at that site, the recordkeeping failure and the exposure control plan failure are two citations arising from one root cause: a job classification that was accurate somewhere in the company and inaccurate at the establishment where the incident occurred.

What Closes the Gap

The fix isn't a better template — it's a mechanism that surfaces local role and task changes back to whoever owns the exposure determination, on a cadence tighter than the annual plan review. That typically means treating "new task assigned to an existing role" and "new role created at this site" as triggers for a targeted look at whether the exposure determination needs to be revisited for that location specifically, rather than waiting for the next scheduled plan update to catch it incidentally. It also means the annual review has to include an explicit step asking each site whether its actual job classifications and tasks still match what the plan assumes, rather than only confirming the plan document itself is current.

A company with thirty-one sites does not have one exposure determination problem. It has as many as thirty-one, and the corporate template's job is to give each site a correct starting point — not to substitute for the site-specific determination the standard actually requires. An exposure control plan that reads perfectly and matches nobody's current job list at a given location has not reduced the company's risk at that site; it has just made the gap harder to see until an inspector, or an incident, finds it.