OSHA handbook: Requirements and a free template for practices

An OSHA handbook is the written safety reference a practice hands its staff, built on the federal standards the Occupational Safety and Health Administration enforces.

It sets out hazard controls, bloodborne pathogen procedures, protective equipment, training, and how injuries get recorded. The template below gives you that structure ready to fill in with your own procedures.

OSHA publishes two free handbooks of its own, and this guide points you to both. The rest of it covers what actually binds a healthcare employer. One point is worth settling before anything else. Most outpatient practices keep no routine injury log, whatever their headcount.

Key takeaways

An OSHA handbook is a practice’s own written safety reference, built from the federal standards OSHA enforces on every employer with staff.

Coverage and recordkeeping are separate questions. Every practice with employees is covered, but most outpatient practices keep no routine injury log.

Physician offices, dental offices, other health practitioner offices, outpatient care centers, and medical laboratories are partially exempt from Form 300 at any size.

Four standards carry most healthcare citations: bloodborne pathogens, personal protective equipment, the General Duty Clause, and recordkeeping.

Practice management software like Pabau keeps training dates, signed acknowledgments, and incident records in one place, so an inspection request takes minutes to answer.

What an OSHA handbook covers

An OSHA handbook translates federal rules into instructions your staff can follow on a Tuesday morning. It names the hazards present in your building, says who is exposed to each one, and sets out the control in place. It also records what training each role needs and how an employee reports an injury or an unsafe condition.

The obligation behind it comes from the Occupational Safety and Health Act of 1970. Every covered employer has to provide working conditions that are free from recognized hazards. A written handbook is how a practice demonstrates that it has identified those hazards and acted on them.

There is no federal requirement to produce a single document called an OSHA handbook. What is required are the underlying pieces. An exposure control plan, a hazard assessment, training records, and reporting procedures all have to exist and stay current. Collecting them into one handbook is simply the easiest way to keep them current and to show an inspector the whole picture at once.

Which practices the rules actually apply to

Every practice with at least one employee is covered by OSHA, whatever its size. Coverage and recordkeeping are two separate questions, and they are easy to run together. Hazard control, protective equipment, bloodborne pathogen procedures, and training bind a two-person practice exactly as they bind a twenty-person one.

Routine injury and illness recordkeeping is the part that varies. Employers with 10 or fewer employees are partially exempt from keeping Form 300 and posting Form 300A. Several healthcare industry classes are partially exempt as well, and headcount makes no difference to them.

The exempt list sits in 29 CFR 1904 Subpart B, Appendix A, and covers five healthcare classes. They are physician offices, dental offices, other health practitioner offices, outpatient care centers, and medical and diagnostic laboratories.

A 40-person dermatology group in one of those classes keeps no routine log. It still has to produce records when OSHA or the Bureau of Labor Statistics asks for them in writing, and severe-injury reporting is unaffected.

Some obligations track the work rather than the industry class. Med spas and aesthetic practices that inject fall squarely under the bloodborne pathogen standard. Physical and occupational therapy practices have to control ergonomic and patient-handling hazards.

Behavioral health practices manage workplace violence risk, but no federal OSHA standard covers it as of 2026. The proposed rule sits in long-term status, so OSHA cites violence hazards under the General Duty Clause instead. Several states have written their own rules, California among them, and those are enforceable in their own right.

The four standards that carry most healthcare citations

Four standards account for the bulk of what inspectors write up in a healthcare setting. They apply regardless of practice size or specialty.

The recurring failures are narrow and specific:

• No written bloodborne pathogen exposure control plan
• No documented hazard assessment for the premises
• Protective equipment that staff cannot reach when they need it
• Training that happened but was never written down

Each one is cheap to fix before an inspection and expensive to explain during one.

Recordkeeping forms, deadlines and retention

Where the logs do apply, the clock is short. Form 300, the injury and illness log, has to be completed within seven calendar days of learning about a recordable case. Form 301, the incident report for that same case, runs on the same seven-day deadline.

Form 300A summarizes the prior year’s cases. Under 29 CFR 1904.32 it must be posted somewhere employees can see it no later than February 1, and it stays up through April 30. The completed forms are then kept for five years after the year they cover.

Seven days is easy to miss when the person who witnessed the incident is not the person who keeps the log. Compliance management software gives the deadline an owner and a reminder rather than leaving it to memory.

Exempt practices are not excused from writing incidents down. Workers’ compensation, your insurer, and any later OSHA inquiry all start from a contemporaneous account of what happened. A standard incident report form keeps those accounts consistent between the front desk and the treatment room.

Training staff, and proving that you did

Bloodborne pathogen training is mandatory for every employee with occupational exposure. It has to happen at hire and then once a year, and undocumented training counts for nothing during an inspection. Record the date, the topics covered, the trainer, and the names of everyone who attended.

Staff also need training on the protective equipment their role uses, on how hazards are identified, and on how to report an incident. None of it requires a paid external course. Your own clinical lead can deliver it, as long as the session is written down afterward.

Most practices already run a separate annual privacy session. Scheduling safety training alongside HIPAA training for employees means one calendar entry and one signed acknowledgment sheet covering both.

Where training records live matters more than the format. Staff management software attaches the completion date to the employee rather than to a shared drive, and flags a refresher before it lapses. A spreadsheet works too, until the person maintaining it leaves.

Finding and controlling the hazards in your building

A hazard assessment is a walk through your own premises with a pen. In a healthcare setting the recurring entries are:

• Sharps injuries and bloodborne pathogen exposure
• Ergonomic strain from patient handling or repetitive treatment positions
• Chemical exposure from disinfectants, sterilants and anesthetics
• Slips and falls near sinks and sterilization areas

Write down each hazard, who is exposed to it, and the control you have in place. Then apply the hierarchy of controls, which puts elimination and substitution above protective equipment. Safety-engineered sharps remove the needle-stick hazard at source. Telling staff to be careful does not.

Emergencies belong in the same assessment. Fire, severe weather, a power failure mid-treatment, and a medical emergency in the waiting room each need a named route. Each also needs a named person. An OSHA emergency action plan template covers that ground and sits naturally alongside your handbook.

Where to get the official OSHA publications

OSHA publishes two free guides worth keeping on file. All About OSHA explains the agency’s remit, worker rights, employer responsibilities, inspections, and the recordkeeping system. It is the reference to reach for when someone asks what OSHA can and cannot do.

The Small Business Safety and Health Handbook is the more practical of the two. It walks a small employer through building a safety program, finding hazards, choosing controls, and training staff. Both are free PDFs from osha.gov, and neither is a substitute for a handbook written around your own premises.

Writing the version your own staff will use

Start from the downloadable template above and make it specific. Name your rooms, your equipment, and the roles that carry exposure risk. A handbook that says “staff must use appropriate PPE” helps no one. One that names which gloves live in which drawer, for which procedure, does.

Five sections do most of the work:

• Your bloodborne pathogen exposure control plan
• Your hazard assessment, dated and signed
• Protective equipment rules, listed by role
• The training schedule and who delivers each session
• The incident reporting procedure, naming the person who owns it

Walk new hires through it during onboarding and revisit it at the annual training session. Keep a signed acknowledgment from every employee. If OSHA ever investigates an injury at your practice, that signature is the evidence that safety expectations were communicated before the incident, not after it.

Set a quarterly review date and give one person the job. Check four things. Training is current and the hazard assessment still matches the building. Protective equipment is stocked and reachable, and every incident since the last review has been written up. This does not need an HR department, only a named owner and a recurring calendar entry.

How Pabau keeps OSHA documentation audit-ready

In most practices the evidence is scattered. Training certificates sit in an email folder, the hazard assessment is a Word file on somebody’s desktop, and incident notes are handwritten. None of it is wrong, but assembling it under an inspector’s deadline costs an afternoon nobody has.

Practice management software like Pabau keeps that evidence attached to the people and the events it belongs to. Each staff member’s record carries their training dates, certifications, and signed acknowledgments. Policy documents live in one place with a version history, so you can show which handbook was in force on a given date.

Automated reminders handle the deadlines that slip. Annual bloodborne pathogen refreshers and your own quarterly review sit on the same calendar as the rest of the practice’s work. So does the February 1 Form 300A posting, where it applies. Every Pabau subscription includes these features, so nothing here depends on the plan you are on.

Keep OSHA documentation inspection-ready

Pabau holds staff training dates, signed acknowledgments, and incident records against the people they belong to, with reminders before a refresher lapses. Pull the evidence an inspector asks for in minutes.

Book a demo

Conclusion

The handbook is the easy part. Download the template and spend an afternoon making it specific to your rooms and your roles. What you end up with will stand up in an inspection. What it cannot do on its own is stay current.

Find out first whether routine recordkeeping applies to you. A partially exempt practice that has kept a Form 300 out of caution can stop. One that assumed exemption on headcount alone may have been wrong about it. That single check changes what the rest of the year looks like.

After that, the work is maintenance: one named owner, a quarterly review, and training dates that live somewhere other than a shared drive. Practices that avoid citations rarely do more than that. They just do it on a schedule. Book a demo to see how Pabau keeps training records, acknowledgments, and incident reports ready for the day someone asks.

Continue your research

Writing up injuries as they happen? Incident report form template gives every member of staff the same fields to complete, whoever witnessed it.

Auditing your records before someone else does? Medical chart audit explains how to run an internal review and what to sample.

Securing patient data as well as worker safety? EHR security covers the access controls and audit trails behind a compliant record system.

Frequently asked questions

Downloads, inspections and penalties