OSHA Safety Checklist for Medical Offices

Two standards carry most of the work: the bloodborne pathogens standard¹ and the hazard communication standard².

In 21 states and Puerto Rico, an OSHA-approved State Plan⁴, rather than federal OSHA, covers most private employers. It must be at least as effective as federal OSHA, so check its version of each rule.

Patient privacy is a separate program under HIPAA, with its own policies and procedures and security risk assessment.

List every role, how many people hold it and what they do on an ordinary day. Each role can land on one list, both or neither, whatever its title or department.

Blood exposure is decided by task. The standard asks for the job classifications where everyone is exposed, those where only some people are, and the tasks that expose that second group. Decide without regard to protective equipment: gloves never take a role off the list.

Chemical exposure is wider than handling. It includes potential exposure, such as a splash or spill, so people who work where hazardous chemicals are used can be covered too. Office workers who meet a hazardous chemical only in non-routine, isolated instances aren't covered. Neither is a store-bought product used as directed, no more often or longer than a consumer would.

The plan turns the blood list into practice. Beyond the exposure determination, it sets out how and when you meet each part of the standard. That covers universal precautions, safer sharps and other controls, protective equipment, the hepatitis B vaccine, follow-up after an exposure, training and records. Keep a copy where every employee can reach it.

Three requirements need their own written record:

• A review at least once a year, and whenever tasks or positions change, that documents the safer medical devices you considered and adopted.
• Input on safer devices and work practices from non-managerial staff who give direct patient care and risk sharps injuries. Note in the plan that you asked.
• The hepatitis B vaccine, free and within 10 working days of starting exposed work, after training on it. Anyone who declines signs the declination statement in the standard.

Walk every room and check purchase records, then list each hazardous chemical by the product name on its safety data sheet. Keep a data sheet for each one where staff can reach it on every shift. Electronic access is fine if nothing stands between an employee and the sheet.

Label workplace containers too. A spray bottle of diluted disinfectant left in an exam room needs the product name and its hazards. A container one person fills and uses up right away does not.

A 2024 revision of the standard² means updated data sheets may name hazards your staff haven't been trained on. Where needed, update workplace labels, the written program and training for those newly identified hazards by November 20, 2026 for single substances, and by May 19, 2028 for mixtures.

Give each program its own column instead of one "safety training" due date. A yearly hazard communication refresher does no harm, but the federal standard ties that training to new chemical hazards, not to the calendar.

Bloodborne pathogens training must be free, held during working hours and suited to your staff's language and literacy. The trainer must know the subject as it applies to your office and take questions, so a video alone falls short. Keep vaccination and exposure follow-up records confidential for the length of employment plus 30 years.

If you already track licenses and CPR cards, add both programs to the same training compliance tracker.

Many employers with more than 10 employees must keep OSHA's injury and illness log⁵, but some industries are exempt. The partially exempt list⁶ includes offices of physicians, dentists and other health practitioners, outpatient care centers, and medical and diagnostic laboratories (NAICS 6211 to 6215). The exemption ends if OSHA, the Bureau of Labor Statistics or a state agency asks you in writing to keep records.

That answer settles the sharps injury log too: the bloodborne pathogens standard requires it only of employers who must keep the injury log. Exempt or not, you must report a work-related death to OSHA within 8 hours, and an in-patient hospitalization, amputation or lost eye within 24 hours. Your plans, training and vaccine duties stay the same either way.

The template on this page has the two written programs, training outlines and four tracking sheets. Open it in River and it runs both determinations from your roster, then drafts the plans when you ask. Track the review dates with your other renewals on a small business compliance calendar.