OSHA compliance for medical practices means meeting the Occupational Safety and Health Administration (OSHA) standards that protect your employees from on-the-job hazards. For a medical or dental office, it comes down to a short list of rules: a written Bloodborne Pathogens exposure control plan, a Hazard Communication program for your chemicals, annual employee training, the right personal protective equipment, and prompt reporting of any serious workplace injury. Any practice with even one employee is covered.
OSHA is only one piece of the regulatory picture — practices also need to navigate Stark Law and Anti-Kickback compliance when structuring referrals and financial arrangements.
The stakes are concrete. In 2026, OSHA penalties reach $16,550 per serious violation and $165,514 for a willful or repeated violation, and a single needlestick or chemical exposure can trigger an inspection. This guide walks through exactly which OSHA standards apply to a medical office, what each one requires, how recordkeeping rules differ for small physician practices, and a step-by-step OSHA compliance checklist you can put to work this week.
What is OSHA compliance for a medical practice?
OSHA compliance is the ongoing work of identifying workplace hazards and following the federal safety standards that address them. The legal foundation is the General Duty Clause, Section 5(a)(1) of the Occupational Safety and Health Act, which requires every employer to provide a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm. On top of that general duty, specific OSHA standards spell out detailed requirements for the hazards a clinical setting actually presents: blood and body fluids, sharps, hazardous chemicals, and more.
OSHA protects employees, not patients, so the rules apply the moment your practice hires its first staff member. In roughly half the country, an OSHA-approved State Plan enforces standards that are at least as strict as the federal version, so a practice should confirm whether it answers to federal OSHA or a state agency. Either way, the building blocks of OSHA compliance are the same, and they fold naturally into the broader medical practice compliance program that already governs your HIPAA and billing obligations. Practices that see out-of-network or self-pay patients also fall under the No Surprises Act’s billing-transparency rules.
Which OSHA standards apply to medical practices?
Most medical and dental offices answer to the same core set of OSHA standards. The table below summarizes the ones that apply to nearly every practice, along with the regulation number and what each requires.
| OSHA standard | Regulation | What it requires |
|---|---|---|
| Bloodborne Pathogens | 29 CFR 1910.1030 | Written exposure control plan, hepatitis B vaccine, sharps controls, PPE, post-exposure follow-up, annual training |
| Hazard Communication | 29 CFR 1910.1200 | Chemical inventory, safety data sheets, GHS labels, written program, training |
| Personal Protective Equipment | 29 CFR 1910.132 | Hazard assessment, employer-provided PPE, training on fit and use |
| Access to Medical and Exposure Records | 29 CFR 1910.1020 | Employee access to exposure and medical records; long-term retention |
| Emergency Action and Exit Routes | 29 CFR 1910.38 / .37 | Written emergency action plan; marked, unobstructed exits |
| Ionizing Radiation (if applicable) | 29 CFR 1910.1096 | Controls, monitoring, and signage where X-ray equipment is used |
Two standards do the heaviest lifting in a clinical setting: Bloodborne Pathogens and Hazard Communication. The General Duty Clause also covers emerging risks that lack a dedicated standard, most notably workplace violence, which OSHA has flagged as a serious and growing hazard in health care.
What does the Bloodborne Pathogens Standard require?
The Bloodborne Pathogens Standard (29 CFR 1910.1030) is the center of OSHA compliance for any practice where staff can be exposed to blood or other potentially infectious materials. It requires a written Exposure Control Plan that lists the job roles and tasks with exposure risk and the controls that reduce it. The plan must be reviewed and updated at least once a year, and whenever new procedures or devices change the risk.
The standard then layers on specific protections:
- Engineering and work-practice controls such as sharps-disposal containers and safer needle devices to cut the risk of needlesticks.
- Personal protective equipment (gloves, gowns, masks, eye protection) provided at no cost to staff.
- Hepatitis B vaccination offered free of charge to every employee with occupational exposure, within 10 working days of assignment.
- Post-exposure evaluation and follow-up after any needlestick or splash, at no cost to the employee.
- Labels and signs on regulated waste, contaminated equipment, and biohazard containers.
- Annual training for all staff with potential exposure, plus a sharps injury log.
OSHA’s Bloodborne Pathogens resource details the full requirement. For a practice that also safeguards patient privacy, the discipline mirrors your HIPAA compliance work: a written plan, documented training, and an audit trail that proves you followed it.
What is required under Hazard Communication (HazCom)?
The Hazard Communication Standard (29 CFR 1910.1200) gives employees the right to know about the hazardous chemicals they work around, from disinfectants and sterilants to developer solutions and compressed gases. A compliant HazCom program is a core part of OSHA compliance and has four parts:
- A written HazCom program describing how your practice handles labeling, data sheets, and training.
- A current inventory of every hazardous chemical kept on site.
- A safety data sheet (SDS) for each chemical, in the standardized 16-section format, accessible to staff during every shift.
- Labels on every container, including secondary bottles, showing the product name, hazard pictograms, a signal word, and precautionary statements under the Globally Harmonized System (GHS).
Staff must be trained on the program at hire and whenever a new chemical hazard is introduced. Missing or inaccessible safety data sheets are one of the most common findings in a medical-office inspection, and they are also one of the easiest gaps to close.
Does a small medical practice have to keep OSHA injury logs?
This is where OSHA compliance gets a little friendlier for small offices. Routine injury-and-illness recordkeeping (the OSHA 300 Log, the 300A annual summary, and the 301 incident report) is partially exempt for two groups. First, any employer with 10 or fewer employees at all times during the prior calendar year is exempt. Second, OSHA’s list of partially exempt industries specifically includes Offices of Physicians (NAICS 6211), Offices of Dentists (6212), and Offices of Other Health Practitioners (6213).
The phrase “partially exempt” is doing real work. It removes the routine 300-Log paperwork, but it does not remove three obligations that still apply to every practice:
- You must still report serious incidents to OSHA (covered in the next section).
- You must keep records that other standards require, such as the Bloodborne Pathogens sharps injury log and hepatitis B vaccination records.
- Under the Access to Records standard (29 CFR 1910.1020), you must keep employee exposure records for 30 years and medical records for the length of employment plus 30 years.
OSHA can also lift the exemption in writing for a specific survey. Treat it as relief from one form, not a pass on safety.
How do you report a serious workplace injury to OSHA?
Reporting is mandatory for every employer, exempt or not, and the clock is short. Under 29 CFR 1904.39 you must notify OSHA of:
- A work-related fatality within 8 hours of learning about it, if it occurs within 30 days of the incident.
- A work-related in-patient hospitalization, amputation, or loss of an eye within 24 hours, if it occurs within 24 hours of the incident.
You can report by phone to the nearest OSHA Area Office, by calling 1-800-321-OSHA (6742), or through the online form at osha.gov. An in-patient hospitalization means a formal admission for care or treatment; an emergency-room visit for observation or testing alone is not reportable. Building the 8-hour and 24-hour rule into your written emergency procedures keeps a stressful moment from becoming a second violation.
What are the penalties for OSHA non-compliance?
OSHA penalties are adjusted for inflation each year. The maximum amounts below took effect after January 15, 2026, and apply per violation, so several findings in a single inspection add up quickly.
| Violation type | 2026 maximum penalty |
|---|---|
| Serious | $16,550 per violation |
| Other-than-serious | $16,550 per violation |
| Failure to abate | $16,550 per day past the deadline |
| Posting requirement | $16,550 per violation |
| Willful or repeated | $165,514 per violation |
Beyond the dollar figure, citations are public, raise your insurance costs, and can disrupt patient care while you abate the hazard. The good news is that the violations OSHA cites most often in medical offices, such as a missing exposure control plan, inaccessible safety data sheets, untrained staff, or an unlabeled biohazard container, are inexpensive to fix and entirely within your control. You can confirm the current figures on the official OSHA penalties page.
What OSHA training does a medical practice need, and how often?
Training is the thread that runs through every OSHA standard, and it is the single most common gap in a small practice. At a minimum, plan for:
- Bloodborne pathogens training at hire and every year after for any employee with exposure risk.
- Hazard Communication training at hire and whenever a new chemical hazard appears.
- PPE and emergency-action training appropriate to each role.
- Refresher training whenever you add a new procedure, device, or piece of equipment.
Document every session with the date, topics, and attendees, including part-time and temporary staff. Because training touches everyone you employ, it is worth coordinating OSHA training with onboarding and your wider medical practice staffing process so no new hire slips through the cracks. A new practice should build OSHA compliance in from day one rather than retrofitting it later, which is why it belongs on any checklist for how to start a medical practice.
OSHA compliance checklist for medical practices
Use this nine-point OSHA compliance checklist to audit your own office. Each item maps directly to a requirement above.
- Written Exposure Control Plan on file and reviewed within the last 12 months.
- Hepatitis B vaccine offered to all at-risk staff, with signed acceptance or declination forms.
- Sharps safety: puncture-resistant containers, safer-needle devices, and a sharps injury log.
- PPE stocked, accessible, and provided at no cost to employees.
- Written HazCom program with a current chemical inventory.
- Safety data sheets for every chemical, reachable by staff on every shift.
- GHS labels on all primary and secondary containers.
- Documented training at hire and annually, with attendance records.
- The OSHA workplace poster (“Job Safety and Health: It’s the Law”) displayed where employees can see it.
Run this list at least once a year. Most practices can close every open item in a few focused afternoons, and the cost of doing so is a fraction of a single serious citation. Folding the annual review into your budgeting also keeps safety from competing with other priorities when you work to reduce medical practice overhead costs.
How Practice Management Consultancy helps with OSHA compliance
Most physician-owners do not have time to track six federal standards on top of running a practice. Practice Management Consultancy works with medical and dental offices to build and maintain OSHA compliance that holds up under inspection: a current Exposure Control Plan and HazCom program, a realistic annual training calendar, and the documentation that proves both. Because our team has run real clinics, we treat OSHA compliance as one piece of the broader compliance and consulting work that keeps a practice operating cleanly, alongside credentialing, payer contracting, and HIPAA.
If you are not sure where your practice stands, a focused compliance review is the fastest way to find and close the gaps before OSHA does. Contact our team to talk through your current setup.
Frequently asked questions about OSHA compliance for medical practices
Does OSHA apply to a small medical or dental office?
Yes. OSHA covers any practice with at least one employee. Very small offices get a break on routine injury-log paperwork, but the Bloodborne Pathogens and Hazard Communication standards, employee training, and injury reporting all still apply.
How often is OSHA training required?
Bloodborne pathogens training is required at hire and at least once every year. Hazard Communication training is required at hire and whenever a new chemical hazard is introduced. Document the date, topics, and attendees each time.
What are the most common OSHA violations in medical offices?
The frequent findings are a missing or outdated Exposure Control Plan, inaccessible safety data sheets, untrained or undocumented staff, unlabeled biohazard or chemical containers, and a missing OSHA workplace poster.
How much can OSHA fine a medical practice?
In 2026 the maximum is $16,550 per serious violation and $165,514 per willful or repeated violation. Penalties are assessed per violation, so several findings in one inspection can add up.
Is HIPAA compliance the same as OSHA compliance?
No. HIPAA protects patient health information, while OSHA compliance protects employee safety. A complete medical practice compliance program addresses both, along with billing and credentialing requirements.
