Definition
OSHA (Occupational Safety and Health Administration) is the federal agency responsible for ensuring safe and healthful working conditions for workers in the United States, including healthcare workers, by setting and enforcing workplace safety standards and providing training, outreach, and education.
Comprehensive Definition
OSHA is a federal agency within the U.S. Department of Labor, established by the Occupational Safety and Health Act of 1970 (29 U.S.C. § 651 et seq.). OSHA's mission is to ensure that employers provide workers with safe and healthful working conditions by setting and enforcing standards, and by providing training, outreach, education, and assistance. OSHA has jurisdiction over most private sector employers and their workers, as well as some public sector employers and workers in states without their own OSHA-approved state plans.
Healthcare is one of the most hazardous industries in the United States, and OSHA has developed specific standards and guidance for healthcare settings. The most significant OSHA standard for healthcare workers is the Bloodborne Pathogens Standard (29 CFR § 1910.1030), which establishes requirements for protecting workers from exposure to blood and other potentially infectious materials (OPIM). The standard requires employers to develop an Exposure Control Plan, implement engineering and work practice controls, provide personal protective equipment (PPE), offer hepatitis B vaccination to at-risk workers, provide post-exposure evaluation and follow-up, and train workers on bloodborne pathogen risks and controls.
The Hazard Communication Standard (29 CFR § 1910.1200), also known as HazCom or the "Right to Know" standard, requires employers to maintain Safety Data Sheets (SDS) for all hazardous chemicals in the workplace, label containers of hazardous chemicals, and train workers on chemical hazards. Healthcare settings use a wide range of hazardous chemicals — including disinfectants, sterilants, anesthetic gases, and chemotherapy drugs — that are subject to HazCom requirements.
The Respiratory Protection Standard (29 CFR § 1910.134) requires employers to establish a written respiratory protection program when respirators are necessary to protect workers from airborne hazards. In healthcare settings, this standard applies to workers who may be exposed to airborne infectious diseases (e.g., tuberculosis, COVID-19) or hazardous chemicals that require respiratory protection.
OSHA also enforces the General Duty Clause (Section 5(a)(1) of the OSH Act), which requires employers to provide a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm. The General Duty Clause is used to cite employers for hazards not covered by a specific OSHA standard, including workplace violence — a significant hazard in healthcare settings.
Why It Matters
OSHA compliance is a legal obligation for every healthcare employer, regardless of size. OSHA has the authority to inspect workplaces, issue citations, and impose penalties for violations. Penalties for serious violations can reach $16,131 per violation, and willful or repeated violations can result in penalties up to $161,323 per violation. Criminal penalties are available for willful violations that result in a worker's death.
Beyond the regulatory penalties, OSHA non-compliance creates significant liability exposure. Workers who are injured as a result of OSHA violations may have workers' compensation claims, and in some cases, personal injury claims. Healthcare employers who fail to protect workers from bloodborne pathogen exposure, chemical hazards, or workplace violence face both regulatory and civil liability.
For healthcare entrepreneurs, OSHA compliance must be built into the business from day one. The cost of implementing OSHA-compliant systems and processes — developing an Exposure Control Plan, providing PPE, training workers, maintaining SDS files — is modest compared to the cost of an OSHA citation, a workers' compensation claim, or a workplace injury lawsuit. OSHA compliance is also a workforce retention issue: workers who feel safe at work are more productive and less likely to leave.
Historical Background
OSHA was established by the Occupational Safety and Health Act of 1970, signed into law by President Nixon on December 29, 1970. The Act was a response to growing public concern about workplace injuries and deaths — in 1970, an estimated 14,000 workers were killed on the job each year, and millions more were injured. The Act established OSHA within the Department of Labor and gave it the authority to set and enforce workplace safety standards.
The Bloodborne Pathogens Standard was promulgated in 1991, following the emergence of HIV/AIDS and growing concern about healthcare worker exposure to bloodborne diseases. The standard was strengthened in 2001 by the Needlestick Safety and Prevention Act, which required employers to use safer needle devices and involve frontline workers in the selection of safety devices.
The COVID-19 pandemic significantly elevated OSHA's profile in healthcare. OSHA issued an Emergency Temporary Standard (ETS) for healthcare settings in June 2021, imposing specific requirements for COVID-19 protection in healthcare workplaces. The ETS was subsequently withdrawn, but OSHA has continued to develop a permanent infectious disease standard for healthcare settings.
Federal Regulations
The primary OSHA standards applicable to healthcare settings include:
Bloodborne Pathogens Standard: 29 CFR § 1910.1030. Requires an Exposure Control Plan, engineering and work practice controls, PPE, hepatitis B vaccination, post-exposure evaluation, and worker training.
Hazard Communication Standard: 29 CFR § 1910.1200. Requires SDS maintenance, container labeling, and worker training on chemical hazards.
Respiratory Protection Standard: 29 CFR § 1910.134. Requires a written respiratory protection program when respirators are necessary.
Personal Protective Equipment Standard: 29 CFR § 1910.132. Requires employers to assess the workplace for hazards and provide appropriate PPE.
General Duty Clause: Section 5(a)(1) of the OSH Act (29 U.S.C. § 654(a)(1)). Requires employers to provide a workplace free from recognized hazards.
Recordkeeping Standard: 29 CFR Part 1904. Requires employers with 10 or more employees to maintain records of work-related injuries and illnesses.
State Considerations
Twenty-two states and two territories operate their own OSHA-approved state plans, which must be at least as effective as federal OSHA. State plan states may have additional requirements beyond federal OSHA. California's Division of Occupational Safety and Health (Cal/OSHA) is among the most stringent state plans, with additional requirements for healthcare settings including an Aerosol Transmissible Diseases (ATD) standard that imposes specific requirements for protecting workers from airborne infectious diseases.
Washington State's Department of Labor & Industries (L&I) and Oregon's Occupational Safety and Health Division (Oregon OSHA) also have state-specific requirements for healthcare settings. Operators in state plan states must comply with both federal OSHA requirements and any additional state-specific requirements.
Common Mistakes
- Not having a written Exposure Control Plan — the Bloodborne Pathogens Standard requires a written ECP that is updated annually and accessible to all workers.
- Failing to offer hepatitis B vaccination to workers who have occupational exposure to blood or OPIM — this is a specific requirement of the Bloodborne Pathogens Standard.
- Not maintaining Safety Data Sheets for all hazardous chemicals in the workplace — SDS files must be readily accessible to workers during their shifts.
- Failing to train workers on bloodborne pathogen risks and controls at the time of initial assignment and annually thereafter.
- Not using safer needle devices — the Needlestick Safety and Prevention Act requires employers to use engineering controls (e.g., safety-engineered needles) to reduce needlestick injuries.
- Failing to maintain required OSHA injury and illness records (OSHA 300 Log) for workplaces with 10 or more employees.
Operator Insight
OSHA is one of those compliance areas that small healthcare operators tend to underestimate. They think OSHA is for factories and construction sites, not for a small clinic or med spa. That is wrong. OSHA applies to every employer, and healthcare is one of the industries OSHA scrutinizes most closely because of the inherent hazards — bloodborne pathogens, chemical exposures, needlestick injuries, and workplace violence. The Bloodborne Pathogens Standard is the most important OSHA requirement for most healthcare settings. If you have staff who handle blood, needles, or other potentially infectious materials, you need a written Exposure Control Plan, you need to offer hepatitis B vaccination, and you need to train your staff. These are not optional. An OSHA inspector who walks into your clinic and finds that you do not have an ECP or that your staff has not been trained will issue a citation on the spot. I also tell operators to think about OSHA compliance as a workforce investment, not just a compliance obligation. Workers who feel safe at work are more productive, more engaged, and less likely to leave. A needlestick injury or a chemical exposure is not just an OSHA violation — it is a human cost that affects your team and your culture. Build a safety culture from day one, and your OSHA compliance will follow naturally.
— AJ Pakpour, Healthcare Practice Startup & Strategy Expert
In Practice
A med spa opens with 8 employees, including 3 nurses who administer IV therapy and perform aesthetic procedures. Before opening, the owner develops a written Exposure Control Plan that identifies all tasks involving potential exposure to blood or OPIM, specifies the engineering controls and PPE to be used, and establishes procedures for post-exposure evaluation. All clinical staff are offered hepatitis B vaccination at no cost. A Hazard Communication program is established, with SDS files maintained for all disinfectants and chemical products used in the spa. All staff complete bloodborne pathogen training before their first day of patient contact, with annual refresher training documented. A primary care clinic with 15 employees receives an OSHA inspection following a worker complaint about needlestick injuries. The OSHA inspector finds that the clinic is using standard (non-safety-engineered) needles and that the Exposure Control Plan has not been updated in 3 years. The clinic receives citations for failure to use safer needle devices and failure to maintain a current ECP. The clinic pays the penalties, implements safety-engineered needles, updates the ECP, and retrains all clinical staff. The incident prompts the clinic to conduct a comprehensive OSHA compliance audit and implement a formal safety management program.
Frequently Asked Questions
References
Further Reading
Recommended Professional References
The following authoritative resources are recommended for healthcare professionals, clinic owners, compliance officers, and entrepreneurs working in this area. Links open official external websites.
Turn Knowledge Into Action
Apply what you just learned. Book a strategy session with AJ Pakpour — healthcare practice startup and strategy expert.
Book a Strategy Session