How to Achieve OSHA Compliance in Your Medical Practice

Author Nicole Statley at Healthcare Compliance Pros

OSHA compliance is more than keeping policies in a binder. It involves daily safety practices that help protect employees from preventable injuries and exposures. In medical practices, common risk areas include blood and body-fluid exposure, sharps injuries, hazardous chemicals, personal protective equipment (PPE), and injury reporting.

This guide outlines practical steps medical practices can use to support OSHA compliance in 2026. State-plan states may have additional requirements, so confirm the rules that apply in the state where your practice operates.

Important disclaimer: This article is general educational guidance and is not legal advice. OSHA obligations depend on a practice's services, workforce, hazards, state requirements, and specific circumstances. Seek qualified legal, clinical, or safety guidance when needed.

Understanding OSHA and Its Importance for Medical Practices

OSHA regulates workplace safety and health for many private-sector medical offices, clinics, laboratories, and outpatient facilities. In a medical setting, compliance means identifying hazards, using appropriate controls, training employees, and maintaining required documentation.

Noncompliance can create both employee-safety and financial risks. For penalties assessed after January 15, 2026, OSHA lists a maximum penalty of $16,550 for serious or other-than-serious violations, up to $165,514 for willful or repeat violations, and up to $16,550 per day for failure to abate.

Medical practices often face workplace risks that general office settings do not, including:

• Blood and other potentially infectious materials (OPIM)
• Needle sticks and contaminated sharps
• Disinfectants, sterilants, laboratory chemicals, and cleaning agents
• Splash, aerosol, and eye or face exposure risks
• Tasks requiring properly selected PPE

Step 1: Assess Your Practice's Current OSHA Compliance

Begin with a documented self-audit. Walk through clinical and nonclinical areas, including reception, exam rooms, procedure rooms, laboratory spaces, medication areas, housekeeping storage, break rooms, and waste staging locations.

Focus on actual work practices, not just written policies. A policy may say that PPE is available, but the walkthrough should confirm that it is accessible where employees need it and that staff know how to use it.

Initial OSHA Self-Audit Checklist

• Identify job titles with reasonably anticipated exposure to blood or OPIM.
• Confirm that the practice has a written, practice-specific Exposure Control Plan.
• Verify that the Exposure Control Plan has been reviewed at least annually and after changes to tasks, procedures, or job classifications.
• Check that hazardous chemical containers are labeled and Safety Data Sheets (SDSs) are available during every shift.
• Confirm that the PPE hazard assessment is documented in writing.
• Review PPE availability, sizing, use, disposal, and replacement procedures.
• Verify employee training records, including dates, topics, instructor information, and attendance.
• Review injury, exposure, sharps, and OSHA recordkeeping processes.
• Confirm leadership knows who will respond if OSHA arrives for an inspection.

Employers with employees who have occupational exposure to blood or OPIM must maintain a written Exposure Control Plan. The plan should be reviewed and updated at least annually and whenever changes affect occupational exposure.

Practical example: During the annual Exposure Control Plan review, the practice must solicit and document input from non-managerial employees responsible for direct patient care who may be exposed to contaminated sharps. Staff input can help identify issues such as inconvenient sharps-container placement, equipment that is difficult to use, or procedures that create avoidable exposure risk.

Step 2: Identify Key OSHA Standards for Medical Practices

Bloodborne Pathogens

The Bloodborne Pathogens Standard, 29 CFR 1910.1030, applies when employees have reasonably anticipated occupational exposure to blood or OPIM. It covers exposure control planning, universal precautions, engineering and work-practice controls, PPE, hepatitis B vaccination, post-exposure evaluation and follow-up, training, and recordkeeping.

Your Exposure Control Plan should identify:

• Job classifications with occupational exposure
• Tasks and procedures that create exposure risk
• Engineering controls, such as safety-engineered sharps and accessible sharps containers
• Work-practice controls, such as hand hygiene and safer handling procedures
• PPE requirements for specific tasks
• Exposure-incident reporting and post-exposure follow-up procedures

Employers must make the hepatitis B vaccination series available to employees with occupational exposure after required bloodborne-pathogens training and within 10 working days of initial assignment, unless an exception applies. After an exposure incident is reported, the practice must make confidential medical evaluation and follow-up immediately available to the exposed employee.

When occupational exposure exists, employers must provide appropriate PPE at no cost to employees. Depending on the task, PPE may include gloves, gowns, masks, face shields, and eye protection.

Hazard Communication

The Hazard Communication Standard, 29 CFR 1910.1200, applies to hazardous chemicals in the workplace. In a medical practice, hazardous chemicals may include disinfectants, cleaning agents, laboratory reagents, sterilants, and maintenance products.

A written Hazard Communication Program should include:

• A current hazardous-chemical inventory
• Procedures for container labeling
• A process for employee access to SDSs
• Employee information and training
• Procedures for new chemicals and non-routine tasks

Employees must be able to access SDSs during their work shift. Training should occur when an employee begins work involving hazardous chemicals and when a new chemical hazard is introduced.

2026 Hazard Communication Update

OSHA's updated Hazard Communication Standard has phased compliance dates. For substances, chemical manufacturers, importers, and distributors had to comply with modified requirements by May 19, 2026. Employers must update alternative workplace labels, written Hazard Communication Programs, and employee training as needed for newly identified hazards by November 20, 2026. Requirements for mixtures have later compliance dates: November 19, 2027, for manufacturers, importers, and distributors, and May 19, 2028, for employer updates when needed. Medical practices should maintain an accurate chemical inventory, monitor supplier labels and SDSs, and update internal procedures when new hazard information applies.

Personal Protective Equipment

PPE is an important safety measure in healthcare, but it should not replace safer equipment or work practices. OSHA requires employers to assess the workplace for hazards that require PPE, select appropriate protective equipment, communicate those selections to employees, and certify the assessment in writing.

Employees who use PPE should receive training on:

• When PPE is required
• Which PPE is required
• How to put on, remove, adjust, and wear PPE
• The limitations of PPE
• Proper care, maintenance, useful life, and disposal

Employees should demonstrate that they understand how to use required PPE before performing work that requires it.

Recordkeeping and Reporting

Not every small medical practice must routinely keep OSHA injury and illness logs. Employers with 10 or fewer employees at all times during the prior calendar year are generally partially exempt, unless OSHA or the Bureau of Labor Statistics directs otherwise. Some industries may also qualify for a partial exemption.

However, covered employers must report certain severe work-related events to OSHA:

• A work-related fatality within 8 hours
• A work-related in-patient hospitalization, amputation, or loss of an eye within 24 hours

Practices required to maintain OSHA injury and illness records must also maintain a confidential sharps injury log for percutaneous injuries from contaminated sharps.

Step 3: Implement OSHA Policies in Daily Work

Policies are only useful when staff can follow them during a busy workday. Assign each compliance task to a specific role, set a schedule, keep evidence of completion, and establish a process for escalating unresolved issues.

Compliance activity	Suggested owner	Documentation to retain
Annual Exposure Control Plan review	Practice manager and clinical lead	Dated plan and review notes
Chemical inventory update	Facilities or safety coordinator	Inventory and SDS index
PPE hazard assessment	Safety coordinator	Written assessment certification
New-hire OSHA training	HR and clinical educator	Attendance and competency record
Sharps safety review	Clinical lead	Review notes or committee documentation
Quarterly safety walkthrough	Compliance lead	Checklist and corrective-action log

A corrective-action log can help the practice track hazards from identification through resolution. Record the issue, location, responsible person, due date, evidence of completion, and follow-up verification.

This documentation helps demonstrate that the practice identified concerns, assigned responsibility, corrected problems, and verified the fix.

Healthcare Compliance Pros can help practices customize policies, audit tools, training trackers, and corrective-action processes to fit their services, staffing model, and workflow. Templates should be tailored to the practice rather than used without review.

Step 4: Train Staff Effectively

Employees with occupational exposure to blood or OPIM must receive bloodborne-pathogens training at initial assignment and at least annually thereafter. Additional training is required when new or modified tasks or procedures affect occupational exposure.

Training should reflect each employee's job duties. Front-desk employees may need a different level of training than medical assistants, nurses, laboratory personnel, or environmental-services staff.

Practical Training Structure

• New hires: General clinic safety, hazard reporting, chemical and SDS access, emergency contacts, and role-specific exposure risks
• Clinical staff: Bloodborne pathogens, sharps safety, PPE competency, exposure reporting, and post-exposure procedures
• Employees using chemicals: Hazard communication, labels, SDSs, spill response, and required PPE
• Annual refresher training: Changes in procedures, incidents, audit findings, new equipment, and new chemical hazards

Use a training attendance log that includes the date, topic, instructor, employee name, signature or electronic attestation, and competency results when applicable.

Attendance alone is not enough. Observe whether staff can safely perform relevant tasks, use PPE correctly, locate SDSs, and explain how they would report an exposure incident.

Step 5: Audit, Correct, and Monitor

Schedule short quarterly walkthroughs and a more detailed annual compliance review. Conduct audits in the actual work environment. Inspect sharps containers, confirm that PPE is readily available, check for expired or inaccessible supplies, review chemical labels, and ask staff how they would report an exposure.

When an issue is found:

1. Make the immediate hazard safe.
2. Document the finding.
3. Determine the underlying cause, such as missing supplies, unclear responsibility, insufficient training, or an impractical workflow.
4. Assign corrective action and a completion deadline.
5. Verify that the correction was completed in the work area.
6. Update policies or training if the finding identifies a broader system issue.

This process helps turn OSHA compliance into an ongoing safety practice instead of a once-a-year project.

Step 6: Prepare for an OSHA Inspection

An OSHA inspection generally includes an opening conference, a walkaround inspection, employee interviews, and a closing conference. During the opening conference, the compliance officer explains the purpose and scope of the inspection.

During the walkaround, the employer may select a representative to accompany the OSHA compliance officer. An authorized employee representative may also participate, and OSHA may allow additional representatives when they would aid the inspection without interfering with it.

Prepare an inspection toolkit containing:

• Current Exposure Control Plan
• Written Hazard Communication Program and chemical inventory
• SDS access instructions
• PPE hazard assessment certification
• Staff training records
• Sharps injury log, when applicable
• OSHA injury and illness records, when required
• Corrective-action logs
• Leadership, legal counsel, and safety or compliance contact information

If OSHA issues a citation, respond promptly. Employers generally have 15 working days after receiving a citation to comply, request an informal conference, or contest the citation. Requesting an informal conference does not extend the contest deadline.

Resources, Tools, and Templates for 2026

A practical OSHA compliance toolkit may include:

• OSHA self-audit checklist
• Exposure Control Plan template
• Hazard Communication Program template
• Chemical inventory and SDS tracker
• PPE hazard assessment form
• Training attendance and competency log
• Quarterly safety walkthrough form
• Corrective-action tracker
• OSHA inspection document index

OSHA provides model materials that can serve as a starting point for Exposure Control Plans and Hazard Communication Programs. Practices should customize these materials to reflect their specific services, hazards, and staff responsibilities.

Frequently Asked Questions About OSHA and Medical Practices

Does every medical practice need an Exposure Control Plan?

A practice needs a written Exposure Control Plan when employees have occupational exposure to blood or OPIM. The plan must be reviewed at least annually and updated when relevant tasks, procedures, or job classifications change.

How often must clinic staff receive OSHA training?

Employees with occupational exposure need bloodborne-pathogens training at initial assignment and at least annually. Additional training is required when new or modified tasks or procedures affect exposure. Hazard Communication training is required at initial assignment and when a new chemical hazard is introduced.

Are small medical practices exempt from OSHA recordkeeping?

Employers with 10 or fewer employees at all times during the prior calendar year are generally partially exempt from routine OSHA injury and illness recordkeeping unless otherwise notified. This does not remove the obligation to report qualifying work-related fatalities, in-patient hospitalizations, amputations, or losses of an eye.

What must be reported to OSHA?

A work-related fatality must be reported within 8 hours. A work-related in-patient hospitalization, amputation, or loss of an eye must be reported within 24 hours.

What is the biggest OSHA compliance mistake medical practices make?

A common mistake is treating compliance as documentation only. Policies and training records are important, but they need to match actual clinic operations. The strongest compliance programs make sure employees have the right PPE, can access SDSs, follow safe sharps practices, receive relevant training, and use a documented process to address hazards.

Sources

U.S. Department of Labor, Occupational Safety and Health Administration. OSHA Penalties: 2026 Maximum Penalty Amounts. https://www.osha.gov/penalties

U.S. Department of Labor, Occupational Safety and Health Administration. 29 CFR 1910.1030: Bloodborne Pathogens. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.1030

U.S. Department of Labor, Occupational Safety and Health Administration. Bloodborne Pathogens: Quick Reference Guide. https://www.osha.gov/bloodborne-pathogens/quick-reference

U.S. Department of Labor, Occupational Safety and Health Administration. Bloodborne Pathogens and Hazard Communications: Model Plans and Programs. https://www.osha.gov/sites/default/files/publications/OSHA3186.pdf

U.S. Department of Labor, Occupational Safety and Health Administration. 29 CFR 1910.1200: Hazard Communication. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.1200

U.S. Department of Labor, Occupational Safety and Health Administration. Hazard Communication Standard Rulemaking. https://www.osha.gov/hazcom/rulemaking

U.S. Department of Labor, Occupational Safety and Health Administration. Hazard Communication Standard, 2026 Enforcement Guidance. https://www.osha.gov/sites/default/files/enforcement/directives/CPL-02-02-079_0.pdf

U.S. Department of Labor, Occupational Safety and Health Administration. 29 CFR 1910.132: Personal Protective Equipment, General Requirements. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.132

U.S. Department of Labor, Occupational Safety and Health Administration. OSHA Recordkeeping Requirements. https://www.osha.gov/recordkeeping

U.S. Department of Labor, Occupational Safety and Health Administration. 29 CFR 1904.39: Reporting Fatalities, Hospitalizations, Amputations, and Losses of an Eye. https://www.osha.gov/laws-regs/regulations/standardnumber/1904/1904.39

U.S. Department of Labor, Occupational Safety and Health Administration. 29 CFR 1904.1: Partial Exemption for Employers With 10 or Fewer Employees. https://www.osha.gov/laws-regs/regulations/standardnumber/1904/1904.1

U.S. Department of Labor, Occupational Safety and Health Administration. Employer Rights and Responsibilities Following an OSHA Inspection. https://www.osha.gov/publications/fedrites

U.S. Department of Labor, Occupational Safety and Health Administration. Inspections Fact Sheet. https://www.osha.gov/sites/default/files/publications/FACTSHEET-INSPECTIONS.pdf

U.S. Department of Labor, Occupational Safety and Health Administration. 29 CFR 1903.8: Representatives of Employers and Employees. https://www.osha.gov/la