A workplace medical emergency protocol is the written plan that tells everyone in your building what to do when someone is hurt or suddenly ill, and it has to satisfy OSHA’s medical services rule while still working under real pressure. A plan that only checks compliance boxes tends to fail the moment a coworker actually collapses. The version that holds up layers the federal requirements onto practical logistics, so trained responders, equipment, and paramedics converge on the patient without anyone guessing their role.
What the Written Plan Has to Contain
Start with people. Name every internal response lead, list their direct extensions, and give a backup contact method. These are the employees trained to run the scene until paramedics arrive. Beyond 911, include poison control (1-800-222-1222), the nearest trauma center, and a non-emergency police line for situations that need law enforcement but aren’t life-threatening.
Then equipment. Map the exact location of every AED and first aid kit, ideally on a floor plan with the equipment zones highlighted. Anyone should be able to find an AED in a panic, not just the trained leads. Photographs of the hallway and room numbers near each device help new hires and visitors who don’t know the building.
AEDs need upkeep that many organizations quietly neglect. Someone should look at each device at least monthly. Electrode pads dry out and typically expire in two to four years; batteries last two to five. If the status indicator shows a problem or either component has passed its date, the device may not work when it counts. Assign a specific person to track expirations rather than assuming somebody will notice.
Finally, consider voluntary medical disclosures. If employees are willing to share information about severe allergies, seizure disorders, or similar conditions, collect it and store it where response leads can reach it quickly. That data is sensitive and the ADA’s handling rules are strict, so keep it in a secured file separate from personnel folders.
OSHA’s Medical Services and First Aid Standard
The core federal rule is 29 CFR 1910.151. It has three requirements. Employers must ensure medical professionals are available for advice on workplace health matters. If no hospital, clinic, or infirmary is near the worksite, at least one employee must be trained to give first aid. And adequate first aid supplies must be readily available.1eCFR. 29 CFR 1910.151 – Medical Services and First Aid
The regulation uses “near proximity” without defining it. OSHA’s best practices guide references a three-to-four-minute window in the context of AED use and cardiac arrest survival, and many safety professionals use that as a practical benchmark for whether a facility qualifies as “near” enough.2Occupational Safety and Health Administration. Fundamentals of a Workplace First-Aid Program If your worksite is more than a few minutes from a hospital, the safe move is to have trained first aid providers on every shift.
The same standard requires eyewash stations or body-flushing equipment wherever workers might be exposed to corrosive materials.3Occupational Safety and Health Administration. 1910.151 – Medical Services and First Aid It’s one of the most frequently cited violations in manufacturing and chemical-handling facilities, and it’s entirely preventable.
Penalties for Getting It Wrong
A serious violation of 1910.151 can cost up to $16,550 per instance under the current schedule, and a willful or repeated violation can reach $165,514.4Occupational Safety and Health Administration. OSHA Penalties OSHA adjusts these ceilings for inflation every January. Violations found during a single inspection stack, so a worksite missing trained responders, adequate supplies, and an eyewash station can see penalties well into six figures.
What Belongs in the First Aid Kit
The regulation calls for adequate supplies but doesn’t list contents. Most employers follow the voluntary consensus standard ANSI/ISEA Z308.1, which OSHA references as guidance. That standard divides kits into two classes. Class A covers basic workplace injuries like cuts, burns, and eye irritation. Class B contains everything in a Class A kit in greater quantities, plus a splint and a tourniquet, and is meant for larger or higher-risk environments. Choose based on headcount, hazard type, and distance to professional care.
The rule doesn’t explicitly require checking expiration dates on supplies, but an inspector who finds a kit stocked with expired bandages and dried-out antiseptic wipes is unlikely to call those supplies “adequate.” Periodic inspections are a practical necessity even without a spelled-out schedule.
Bloodborne Pathogen Obligations for Your Responders
Anyone you designate to provide first aid will eventually encounter blood. That triggers a separate OSHA standard, 29 CFR 1910.1030, which requires employers to protect workers from bloodborne diseases like hepatitis B and HIV. If your protocol names internal response leads, this standard almost certainly applies to them.
The centerpiece is a written Exposure Control Plan. It has to identify every job classification with potential contact with blood or infectious materials, describe how the employer will minimize exposure, and set out procedures for responding to an exposure incident. The plan must be reviewed and updated at least annually and be accessible to affected employees.5eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens
Employers must also offer the hepatitis B vaccination series at no cost to every employee with occupational exposure. For first aid responders, the vaccine must be offered within 10 days of their assignment to that role. Employees can decline, but they have to sign a written declination form, and if they change their minds later the employer still has to provide the vaccine free.6Occupational Safety and Health Administration. Hepatitis B Vaccination Protection Fact Sheet
On the equipment side, response leads need PPE before they touch a patient: disposable gloves and a pocket mask or resuscitation bag for CPR, at minimum. Store these alongside first aid kits so nobody has to hunt for them during an actual emergency.
Training and Certification
OSHA requires first aid training for designated responders but doesn’t mandate a specific renewal schedule. The agency’s best practices guide recommends CPR and AED retraining at least once a year, and a 2023 letter of interpretation confirmed that no general-industry standard sets a mandatory refresher frequency.7Occupational Safety and Health Administration. Frequency of Refresher Training for First Aid and CPR In practice, though, most certifying organizations set their own expiration dates, and those effectively control the timeline.
The American Heart Association’s Heartsaver courses are the most widely used training track for non-healthcare workplaces. The Heartsaver First Aid CPR AED course, sometimes called “Heartsaver Total,” is built to meet OSHA requirements and covers adult CPR, AED operation, choking response, and common first aid scenarios. Completion cards are valid for two years.8American Heart Association. Heartsaver CPR, AED and First Aid Watch one detail: the “Heartsaver Basic” version generally does not meet workplace regulatory requirements, so make sure you’re enrolling employees in the full course.
Training typically runs $70 to $125 per person for a group session, though prices vary by provider and region. For larger teams it’s often cheaper to certify an in-house instructor who can train new hires on-site. Track every employee’s certification date in a central spreadsheet or HR system. Letting certifications quietly lapse is one of the most common compliance failures inspectors find, and it’s entirely avoidable.
How the Response Actually Runs
When an emergency happens, the first step is scene safety. A responder who rushes in without checking for ongoing hazards, whether electrical equipment, chemical spills, or structural instability, can become a second patient. Once the scene is safe, the internal communication chain activates. Many organizations use a dedicated emergency radio channel or a specific internal phone code that bypasses normal administrative lines.
Two things need to happen at once. The response lead begins patient care while another person calls 911 with the building’s exact street address, floor and room number, and the nature of the emergency. Dispatchers work with precise information. “Unconscious male, not breathing, Building C loading dock, north entrance” gets a better response than “someone collapsed in the warehouse.”
The step most protocols include on paper but bungle in practice is guiding the ambulance in. Station someone at the primary entrance with the security badges or keys needed to bypass electronic locks, gates, or elevators along the route. Paramedics losing two or three minutes circling a parking lot or waiting for a locked door is depressingly common, and it’s preventable with one designated guide.
Keep bystanders clear. Well-meaning coworkers crowding around the patient slow everything down and raise the stress level. Assign someone to manage foot traffic and redirect people away from the scene.
Liability and Good Samaritan Protection
Employees sometimes hesitate to help during a medical emergency because they worry about being sued if something goes wrong. Every state has some form of Good Samaritan law that limits civil liability for people who voluntarily provide emergency care without expecting compensation. These laws generally protect against ordinary negligence but do not shield someone whose conduct rises to gross negligence or willful misconduct. Who qualifies for protection and what standard of care is expected vary by state.
For AED use, federal law adds a separate layer. Under 42 U.S.C. ยง 238q, any person who uses or attempts to use an AED on someone experiencing a perceived medical emergency is immune from civil liability for the resulting harm. The same immunity extends to the person or organization that acquired the device, provided they notified local emergency responders of the AED’s placement, properly maintained and tested it, and trained the employee who used it.9Office of the Law Revision Counsel. 42 USC 238q – Informed Consent Exemptions for Studies Involving Minimal Risk The immunity disappears if the harm was caused by willful misconduct, gross negligence, or reckless indifference to the victim’s safety.
Here’s the piece protocols create for the employer: designating employees as emergency responders takes on responsibility for their training and their actions. If those employees are poorly trained or unsupervised, the organization bears the liability for their mistakes. Careful selection, documented training, and clear operational guidelines are how you manage that exposure.
Naloxone in the Plan
The opioid crisis has pushed naloxone, the overdose reversal drug commonly sold as Narcan, into workplace planning. As of 2026, proposed federal legislation called the Workplace Overdose Reversal Kits (WORK) to Save Lives Act would direct OSHA to issue guidance for employers on incorporating naloxone into emergency preparedness plans and would require federal agencies to stock it. The bill has not been enacted, and OSHA has not issued mandatory naloxone requirements for general industry.
Even without a mandate, safety organizations are pushing to treat naloxone like an AED or fire extinguisher, as standard emergency equipment regardless of whether the workforce has obvious opioid risk factors. Work is underway to include naloxone in the next revision of the ANSI/ISEA Z308.1 first aid kit standard. Construction, warehousing, transportation, and other industries with higher overdose rates may want to move before regulations catch up.
Reporting and Records After the Call
Once the patient is with paramedics, the administrative work begins. Create an internal incident report that captures the timeline: when the emergency was first noticed, when 911 was called, what care was given, and when paramedics departed. This record protects the organization in any later dispute and feeds the protocol review.
If the emergency involved a work-related injury or illness that required medical treatment beyond basic first aid, the employer must log it on the OSHA 300 form. The same applies to any case involving loss of consciousness, days away from work, restricted duties, or job transfer. The entry has to be made within seven calendar days of learning the case qualifies as recordable.10Occupational Safety and Health Administration. OSHA Forms for Recording Work-Related Injuries and Illnesses
Privacy Cases on the 300 Log
Some injuries and illnesses qualify as privacy concern cases, and the employee’s name must be replaced with “privacy case” on the log. Those include injuries to intimate body parts, injuries resulting from sexual assault, mental illnesses, HIV or hepatitis infections, needlestick injuries involving contaminated blood, and any case where the employee voluntarily requests anonymity.11Occupational Safety and Health Administration. 1904.29 – Forms The employer still has to keep a separate confidential list linking case numbers to names for government inquiries.
Medical Records: ADA, Not HIPAA
A common misconception is that HIPAA governs medical records an employer creates or collects during a workplace emergency. It generally does not. HIPAA applies to covered entities like health plans, healthcare clearinghouses, and healthcare providers who process electronic transactions, not to employers acting as employers.12Occupational Safety and Health Administration. Recording Injuries and Illnesses of Temporary Workers Versus HIPAA Requirements
The Americans with Disabilities Act is what applies. Any medical information an employer collects, whether from a health screening, a voluntary disclosure, or an emergency incident, must be stored on separate forms in separate medical files, apart from the standard personnel record. Access is limited to supervisors who need to know about work restrictions, first aid personnel who may need to provide emergency treatment, and government officials investigating compliance.13Office of the Law Revision Counsel. 42 USC 12112 – Discrimination Unauthorized disclosure of these records can trigger EEOC complaints and civil lawsuits.
The After-Action Review
Don’t let the incident report sit in a file. Within a week or two of the event, pull the response leads and anyone in the communication chain together for a debrief. Walk through the timeline and find where things stalled. Was the AED easy to find? Did the person who called 911 know the building’s exact address? Did the entrance guide have the right security badge? Small failures compound during emergencies, and the only way to catch them is to review what actually happened rather than what the protocol assumed would happen. Update the written plan based on what the review reveals.