Records OSHA asks for, in order
| # | Record | Frequency |
|---|---|---|
| 1 | Exposure Control Plan (ECP) — written, current, and accessible to staff | Reviewed and updated annually + when tasks/procedures change |
| 2 | BBP training records for every clinical staff member — initial training within 10 working days of assignment, then annually | Annual |
| 3 | Hepatitis B vaccination records for every clinical staff member, plus signed declination forms where applicable | Once per staff, declination on file |
| 4 | Sharps injury log — must be maintained even if empty | Maintained continuously, 5-year retention |
| 5 | Sharps container handling log and the contracts with your medical-waste collector (Stericycle, MedPro, Daniels, etc.) | Pickup-by-pickup, contracts current |
| 6 | Post-exposure incident records — even if no incidents, the procedure must be documented | As incidents occur, 30-year retention for medical records |
| 7 | PPE training and supply records — gloves, gowns, eyewear, face shields appropriate to tasks | Initial + annual |
| 8 | Engineering controls evaluation — annual review of safer medical devices (safety needles, retractable lancets) with input from frontline staff | Annual, documented |
| 9 | Decontamination and cleaning log for surfaces and reusable equipment | Per procedure / shift |
| 10 | SDS sheets for every chemical agent used in cleaning and decontamination | Updated when products change |
The Exposure Control Plan in detail
The ECP is the spine. OSHA expects a written plan that includes:
- Identity of the clinic, address, and the responsible person (typically the owner or office manager)
- An exposure determination — a list of all job classifications in which staff may have occupational exposure to blood or other potentially infectious materials
- The specific tasks and procedures within each classification that involve exposure
- The methods of compliance — universal precautions, engineering controls, work-practice controls, PPE, housekeeping
- HBV vaccination program description and declination procedure
- Post-exposure evaluation and follow-up procedure
- Communication of hazards (training, labels, signage)
- Recordkeeping procedures
- Annual review date and signature
A generic template ECP that doesn't reflect the actual clinic — staff names, real procedures, real equipment — is worse than no ECP. Inspectors notice immediately. Customize.
Training records — what counts
BBP training must occur within 10 working days of initial assignment to a job with potential exposure, and at least annually thereafter. Training records must include:
- Date of training
- Summary of training contents
- Name and qualifications of the trainer
- Names and job titles of attendees
- Signatures of attendees
A certificate from a vendor (Stericycle Steri-Safe, MedPro, an online training service) is acceptable if it contains the elements above. A blanket "we trained everyone in 2024" attestation is not.
Sharps injury log — what to record
Even if no needlestick has occurred, the sharps injury log must exist as a blank, dated record ready to be filled in. When an incident occurs, the log entry includes:
- Type and brand of the device involved
- Department or work area where the incident occurred
- An explanation of how the incident occurred
The injured worker's name is recorded but the log is maintained in a manner that preserves their privacy.
The "we have Stericycle" misconception
Many Texas clinics assume their medical-waste vendor's compliance toolkit is enough. Stericycle's Steri-Safe Platinum tier even includes a "No Fine. No Fail" guarantee — but the guarantee covers OSHA bloodborne-pathogens citations only and only where the clinic has actually implemented Steri-Safe's program correctly. The vendor's portal is the storage layer; the clinic still has to do the training, the ECP review, the sharps log, and the incident-response procedure. Many small clinics treat Steri-Safe as a "set it and forget it" subscription, and that's where citations come from.
What an OSHA inspection looks like
A typical small-clinic OSHA inspection — whether triggered by a complaint, a referral from another agency, or a programmed inspection — opens with the compliance officer asking for the records on the checklist above. The officer typically interviews 2–4 staff members, observes a procedure if scheduled, and inspects the physical environment (sharps containers, PPE supplies, signage).
Most citations are written for documentation deficiencies, not clinical practice. A clinic that produces the checklist records cleanly often closes the inspection with no findings or with informal recommendations only.
Frequently asked
Does my clinic need an ECP if we don't have employees, only independent contractors?
OSHA's BBP standard applies to "employees" — but the definition is broad and contested. Many Texas clinics that classify clinicians as 1099 contractors are still treated as covered employers for OSHA purposes, especially where the clinic provides the equipment, the patient flow, and the supervision. Consult your healthcare attorney on the specific classification. The defensible practice is to maintain the ECP and training program regardless.
How long must records be retained?
Training records: 3 years from the training date. Sharps injury log: 5 years. Medical records of exposed employees: 30 years from termination of employment. ECP: current version plus historical versions for at least 3 years.
Can the medical waste vendor's records substitute for ours?
For waste-pickup manifests, yes. The vendor's pickup receipts are the chain-of-custody record OSHA expects. For training, ECP, and incident records, no — those are clinic-side and must be maintained on premises and producible on inspection.
What's the difference between a serious finding and a willful finding?
A serious finding indicates a violation that could cause death or serious physical harm and where the employer knew or should have known. A willful finding indicates intentional disregard or plain indifference to OSHA requirements. Penalty ranges in 2026: serious starts at $16,550 per instance; willful starts at $16,550 and can reach $165,514 per instance.
How ProofOps Medical helps with OSHA documentation
ProofOps centralizes BBP training records, ECP versions, sharps logs, incident records, vaccination records,
and waste-vendor manifests into one digital file. Our agents track expiration dates and surface missing
records before the inspector arrives. Stericycle and MedPro pickup receipts auto-route to your dedicated
proof@ inbox and get classified automatically.
Get a free Texas documentation audit — we'll review what's publicly visible plus a brief intake on your clinic and send a one-page PDF showing where your OSHA-side documentation gaps are. No card. 24-hour turnaround.
Informational, not legal advice. For inspection-specific guidance, consult your OSHA consultant or healthcare attorney. Cite/source: 29 CFR 1910.1030, Occupational Safety and Health Administration.