How to Implement an OSHA Recordkeeping Compliance Plan

How to get started, stay organized, and present your records to OSHA

Photo portrait of Jonathan Klane

If you’re responsible for a clinical lab, you’re likely concerned about inspections from a regulator, auditor, or supervisor. Often in inspections, first appearances are everything, and demonstrating that you’re organized impresses inspectors, improving your chances of passing the inspection.

Apart from first appearances, this article provides practical tips and advice for clinical labs about how to implement an Occupational Safety and Health Administration (OSHA) recordkeeping compliance game plan.

Terms to know and differentiate

Knowing the OSHA-related terms and the context of each one, including any subtleties or differences between them, is critical. 

Regulations or standards are enforced requirements. Typical words are “shall,” “must,” “mandatory,” or “required,” indicating that something isn’t optional. 

A guidance is a good idea or suggestion—it’s not a legal requirement enforced by OSHA or other organizations. A guidance typically uses words like “should,” “non-mandatory,” “best practice,” “can,” or “may.”

Recordkeeping is a process by which data that needs to be recoverable later is archived within an accessible system. For example, if you train staff, you must create records of their training and be able to find important information on each learner, course, etc. when needed.

Documenting is the process of recording the bits of data that occur but otherwise have no official record. This could be a hazard assessment that was performed verbally, an incident analysis in the form of a lab diagram, or an annual staff-wide notification of their OSHA rights.

Reporting is transmitting information to another party. For certain situations, reporting can involve providing OSHA with information within a specific time frame of their occurrence or when you learn of the incident if there is a delay. Workplace fatalities, employee injuries requiring admittance to a hospital, and amputations in the workplace require reporting within eight hours, while loss of an eye must be reported within 24 hours. For example, if your lab tech goes to the hospital for suspected chemical exposure or a needlestick on Tuesday at noon but isn’t admitted until 6:00 pm, and you learn of it at 8:00 pm, you have until Wednesday at 4:00 am to report it to OSHA (eight hours from 8:00 pm the evening before).

In addition, clinical leaders need to understand the difference between an OSHA recordable (noting an injury on your OSHA 200 log) and an OSHA reportable (calling OSHA to tell them of an injury or death), as the difference between these two forms of reporting can have a significant impact on the organization.

Types of OSHA and related records

Your lab’s operations require that you develop and implement several OSHA or lab safety plans, policies, and programs. They’re covered in the next section (e.g., hazard communication, lab safety, bloodborne pathogens, etc.). Their names matter less than their contents and how well you’re implementing them.

OSHA and common sense dictate that you assess all lab hazards and mitigate them as appropriate according to best practices. These hazard mitigation steps and corrective actions need to be documented and recorded. One way to do this is using a spreadsheet with column heads for the following:

Type of hazard(s)

Location

Dates

Action

Follow up

Notes

Regularly updating this kind of spreadsheet will help you track your progress and impress an inspector.

Training is an ongoing process that can easily escape our ability to record every detail. Often, the aspects recorded seem obvious—trainee, date, topic, and if they passed. But much more should be recorded as it can be helpful during lab inspections or when you experience a claim. For example, think about answering the following:

  • What topics and content were covered during training? 
  • Did the employee sign a confirmation that they attended? 
  • What were the learning objectives and how was the learning assessed?
  • Were there any changes made in the lab based on the training?

OSHA logs 300, 300A, and 301 are all required for workplaces with 10 or more employees: 

  • Form 300 (or 300 log) is the record of work-related injuries and illnesses. 
  • Form 300A (or 300A log) is the year end summary that must be posted for all lab staff to see for three months (February through April) of the following year. 
  • Form 301 is the Injury and Illness Incident Report that must be filled out for each qualifying incident.

OSHA regulations for clinical labs

OSHA regulations weren’t written exclusively for clinical labs. There are however general industry regulations that apply to non-production labs (clinical or otherwise). Most of the regulations that apply have to do with worker health. OSHA’s general industry standard (part 1910) has many subparts. The last one, subpart Z, is often called the “expanded health standards” and includes exposure to blood, chemicals, noise, and many specific substances (e.g., asbestos, formaldehyde, lead, methylene chloride, etc.). Here are the most important to be aware of:

Personal protective equipment (PPE)

Most labs know they must provide personal protective equipment (PPE) for staff (29 CFR 1910.132). But do you know what is required as part of the OSHA-mandated written certification and in your lab’s training? OSHA requires a written certification stating the workplace, who performed the PPE certification, the date performed, that the employer certifies the necessary PPE via a hazard assessment, and of course, which types of PPE are being certified for which operations or tasks. OSHA requires that PPE training must include when PPE is needed, what kind(s) of PPE to use, how to don, adjust, wear, and doff it, any limitations to the PPE use, and its proper care, maintenance, useful life, and disposal. To keep track of this information, some lab safety coordinators prefer a spreadsheet or table while others keep a separate record for each task or PPE type. Which method is best? Whichever one is more effective for your clinical lab’s operations, systems, and records.

Bloodborne pathogens (BBPs)

Another applicable regulation for clinical labs is Occupational Exposure to Bloodborne Pathogens (BBPs) (29 CFR 1910.1030). Though there has been a large focus on protecting staff from COVID-19, the need to protect lab staff from other pathogens, such as HIV and Hepatitis B Virus, or other potentially infectious material (OPIM) remains.

Hazard communication (right-to-know)

Hazard communication (commonly called hazcom or right-to-know) is also one of the most widely applicable OSHA regulations (29 CFR 1910.1200). Lab managers need to know how and when it applies to a lab’s operations regardless of the lab standard. Some examples include when hazardous chemicals are used in the workplace outside of the lab, such as maintenance workers or other staff who aren’t designated as lab workers. If so, hazcom records need to be maintained (e.g., the plan, safety data sheets [SDSs], training, a chemical inventory, etc.).

Access to medical and exposure records

One of the most frequently overlooked and least known OSHA regulations is access to medical and exposure records (29 CFR 1910.1020). It’s relatively simple to comply and maintain these records. You’re required to annually notify or remind employees that they have access to their own work-related medical records and to work-related exposure records that could apply to them (e.g., air samples collected to evaluate another worker’s exposure to hazardous substances like ethyl alcohol). Be sure to save copies of each year’s notice to employees.

Lab safety and chemical hygiene

Lab safety (29 CFR 1910.1450) seems obvious and is likely the dominant OSHA regulation for your lab unless you’re a production lab, in which case it doesn’t apply. You’ll need to maintain your chemical inventory, SDSs, any hazard assessments, training, chemical hygiene plan (CHP), incidents, exposures, etc. 

  • Your CHP is likely a comprehensive document. Updating it section by section is often the most straightforward way to maintain it. For example, work on your lab’s chemical inventory, then determine if any chemicals fall into other high hazard categories. 
  • SDSs are often in binders, in a folder, or on a system for easy access (OSHA requires SDSs be “readily available”).
  • Hazard assessments, incidents, and exposures are all events that are best documented on a form with relevant fields (e.g., day/time, what occurred, impact, factors, actions, resolution, etc.). 
  • Documentation of lab safety training should include training records, such as worker name and role, training date, topics covered, learner validation (e.g., quiz, exercise, game, etc.), initial or refresher, trainer name, etc. 

Toxic and hazardous substances (i.e., expanded health standards in 1910 subpart Z)

Even though the OSHA expanded health standards (subpart Z) (e.g., formaldehyde, methylene chloride, etc.) are superseded by the lab safety standard, subpart Z still requires lab leaders to maintain records for exposure assessments compared to a chemical’s action level (AL) and permissible exposure limit (PEL), and if the AL is exceeded, then any medical records must be included, despite the overall exemption.

Maintaining records

Three frequent questions on maintaining records include how long to keep them, whether to use electronic files or paper copies, and are there privacy issues. 

How long must labs maintain records?

Labs must maintain records up to 30 years post-employment. When an employee leaves, start the clock and set it for 30 years. This may seem like a long time, but it is designed to take long term or chronic disease latency periods (time from exposure to onset of disease) into consideration. 

Electronic files or paper copies?

As for the choice of electronic vs paper records, choose whichever format works best for your operation and system. Either can be lost. Paper archives can get moldy, burnt, or misplaced, while electronic records can be deleted, corrupted, or lost. Electronic backups on an external drive or a secured server or cloud service are important.

Are there privacy issues?

There are always privacy issues. The challenge is how to respect people’s medical privacy while maintaining employee health or medical records as required by OSHA. The actual medical record remains with the health care provider (e.g., doctor’s notes, test results, x-rays, etc.). However, the record of a medical assessment and its results can be maintained as an employee record (e.g., hearing test—no change noted, respirator fit test—passed, etc.). This can be as simple as including the date of a medical assessment in a spreadsheet, its relevant result, and a reference to the occupational clinic where the test was performed. Be sure to have records forwarded from one clinic to another over the years.

The key points about OSHA

You need a process. Whether you’re going it alone for a small lab or operation or using a systematizing software for larger lab operations, having a documented system in place is vital. It’s like a quality system that is sufficiently detailed for others to follow (like an inspector whom you wish to impress).

Having a game plan for maintaining OSHA records is a must, not an if. Starting and organizing are key elements to success. A step-by-step approach facilitates what seems complex. First, identify and gather your records. Next, create a process and system. Train others in your system. Perform routine checks or self-audits. Then, maintain it as needed and relax, because being ready for OSHA to walk in your lab’s door is worth the effort. Priceless.


Photo portrait of Jonathan Klane
Jonathan Klane, MSEd, CIH, CSP, CHMM, CIT

Jonathan Klane, MSEd, CIH, CSP, CHMM, CIT, is senior safety editor for Lab Manager. His environmental health & safety and risk career spans more than three decades in various roles as a consultant, trainer, professor, embedded safety director for two colleges of engineering, and now writing for Lab Manager and Today's Clinical Lab. He is a PhD candidate in human and social dimensions of science and technology at Arizona State University, where he studies risk perceptions and the effects of storytelling.