Pharmacy Health and Safety Policy: OSHA Rules, Training, and Records

A pharmacy health and safety policy is the written document that tells your staff, and any federal inspector who walks through the door, exactly how your pharmacy controls the hazards that come with dispensing drugs. At a minimum it has to address the Occupational Safety and Health Act’s General Duty Clause, DEA controlled substance security, hazardous drug and chemical handling, bloodborne pathogen exposure, emergency response, training, incident reporting, and record retention. Skip any of those and you are exposed to five-figure fines per violation, loss of your DEA registration, or worse.

What the Written Policy Has to Contain

Section 5(a)(1) of the OSH Act, the General Duty Clause, requires every employer to provide “a place of employment which is free from recognized hazards that are causing or are likely to cause death or serious physical harm.”¹ That one sentence is the hook OSHA uses to hold pharmacies accountable for hazards that no specific standard covers.

The clause does not dictate the format of your policy. In practice, OSHA inspectors look for three things: documented procedures covering each hazard category, a specific person assigned to oversee compliance, and accessibility so any employee can read the policy on request. A policy that lives in the pharmacist-in-charge’s head will not survive an inspection. Name the responsible person by title, write down the procedures, and keep the binder or file where staff can reach it during any shift.

Controlled Substance Security, Records, and Disposal

DEA regulations require every pharmacy to maintain effective controls against theft and diversion. The Administrator evaluates your overall security by looking at building type, the type of vault or safe in use, and the adequacy of your operating procedures.²

One point trips up new operators. The vault or DEA-approved safe requirement for Schedule I and II substances applies to manufacturers and distributors, not to pharmacies. Under 21 CFR 1301.75, a pharmacy has two lawful options for Schedule II through V drugs: store them in a securely locked, substantially constructed cabinet, or disperse them throughout the stock of non-controlled substances in a way that obstructs theft or diversion.³ Many pharmacies pick dispersal, so nothing on the shelf signals where the high-value inventory sits. Either works if the overall system is effective.

Every pharmacy must keep controlled substance inventory records and related documentation for at least two years from the date the record was created, and those records have to be available for DEA inspection and copying during business hours.⁴ Sloppy recordkeeping is one of the most common triggers for enforcement action.

Expired or unwanted controlled substances cannot go in the trash. Disposal must render the substance permanently non-retrievable, meaning it can never be converted back into a usable controlled substance. Most pharmacies transfer unwanted inventory to a registered reverse distributor. A pharmacy may also destroy controlled substances on-site if the method meets the non-retrievable standard, and the destruction is documented on DEA Form 41.⁵ Breakage or spillage you can account for is not a reportable “loss,” but document it internally.

Hazardous Drugs and Chemicals

Pharmacies handle two overlapping categories of dangerous substances, and your written policy has to address both.

Hazard Communication

OSHA’s Hazard Communication Standard (29 CFR 1910.1200) requires you to maintain Safety Data Sheets for every hazardous chemical in the workplace and make them readily accessible to employees during every shift.⁶ Electronic access counts as long as employees can reach the information immediately. HazCom training is required at initial assignment and whenever a new hazard enters the workplace. There is no automatic annual retraining requirement under this standard, though many pharmacies retrain yearly as a best practice.

Drugs in solid final dosage form intended for direct patient administration, such as tablets and capsules dispensed to consumers, are exempt from HazCom labeling and SDS requirements. That exemption disappears the moment you crush, compound, or otherwise manipulate a tablet, because the drug is no longer in its final form and workers now face inhalation or skin-contact risk.

USP 800

USP General Chapter 800 governs how hazardous drugs are received, prepared, administered, and transported, and it applies to community and compounding pharmacies alike.⁷ Your policy must include written procedures for handling hazardous drugs, documented risk assessments for each drug and dosage form, PPE requirements, spill kit availability, and deactivation and decontamination steps.

The definition of “hazardous drug” comes from NIOSH, which classifies a drug as hazardous if it causes cancer, reproductive harm, organ damage, genetic effects, or has a structure and toxicity profile mimicking an existing hazardous drug.⁸ The NIOSH list is advisory on its own, but USP 800 pulls it into enforceable practice standards. Review the list periodically and update your handling procedures when NIOSH adds drugs.

Bloodborne Pathogens and the Exposure Control Plan

If your employees could contact blood or other potentially infectious materials, including through vaccination services, blood products, or used sharps, OSHA’s Bloodborne Pathogens Standard (29 CFR 1910.1030) applies. The centerpiece is a written Exposure Control Plan designed to eliminate or minimize exposure through engineering controls, work practice controls, and PPE.⁹

The plan must be reviewed and updated at least annually, and sooner whenever tasks, procedures, or employee positions change in ways that affect exposure. Every immunization protocol change or staffing shift should trigger a review.

Core requirements to build into the plan:

Gloves, gowns, eye protection, and other PPE provided at no cost whenever engineering controls alone cannot eliminate exposure risk.
Contaminated sharps placed in closable, puncture-resistant, leakproof containers that are labeled or color-coded. Bending, recapping, or breaking contaminated needles is prohibited unless the employer can demonstrate no alternative exists.
The full Hepatitis B vaccination series offered within 10 working days of an employee’s initial assignment to tasks with occupational exposure, at no cost to the employee.¹⁰
After any exposure incident, a confidential medical evaluation and follow-up, including documentation of the route of exposure, identification of the source individual when feasible, and blood testing of the exposed employee.

Emergency Plans, Fire Prevention, and Workplace Violence

Every employer needs an emergency action plan. If your pharmacy has more than 10 employees, the plan must be written, kept on-site, and available for employee review; pharmacies with 10 or fewer may communicate it orally.¹¹ It has to cover fire reporting, evacuation routes and exit assignments, procedures for anyone who stays to shut down critical operations, a method for accounting for all employees after evacuation, and a contact person for questions.

A separate written fire prevention plan is also required at the same 10-employee threshold and must address fire hazards, storage of flammable materials, and maintenance of fire suppression equipment.¹²

Workplace violence risk is elevated in pharmacies because of the controlled substances on the shelves. There is no standalone OSHA workplace violence standard, but OSHA enforces the General Duty Clause against employers who ignore foreseeable violence hazards. The agency’s pharmacy-specific guidance recommends a formal Workplace Violence Prevention program with management commitment, employee participation, worksite analysis, and training on recognizing and de-escalating potentially violent situations.¹³ Recommended controls include plexiglass barriers at the payment window, improved lighting and video surveillance, panic buttons or alarm systems, card-key access, and adequate staffing on every shift. A pharmacy that ignores these entirely and then experiences a violent incident is exactly where OSHA reaches for the General Duty Clause.

Training Schedules

Pharmacy safety training is not one program. Different standards impose different schedules, and confusing them is a common compliance failure.

Bloodborne pathogens: training at initial assignment and at least annually thereafter, with each annual session occurring within one year of the previous one.¹⁴
Hazard Communication: training at initial assignment and whenever a new chemical hazard is introduced. No automatic annual retraining, but any new cleaning product or pharmaceutical chemical triggers the obligation.⁶
Emergency action plans: training when the plan is developed, when an employee is initially assigned, and whenever responsibilities or the plan itself change.

Bloodborne pathogen training records must include the dates, a summary of the content, the names and qualifications of the trainers, and the names and job titles of all attendees. Keep those records for three years from the date of training.¹⁴

Incident Reporting and Whistleblower Protection

Your policy must spell out how employees report injuries, near-misses, and hazards internally. Beyond that, federal law imposes hard deadlines for reporting to OSHA. Report a work-related employee death within 8 hours, and report a work-related inpatient hospitalization, amputation, or loss of an eye within 24 hours.¹⁵ Missing the window can generate additional citations on top of whatever caused the incident.

Employees who report safety concerns are protected under OSHA’s whistleblower provisions. If an employer retaliates, the worker can file a complaint with OSHA. Filing deadlines vary by statute, ranging from 30 to 180 days after the retaliatory action.¹⁶ Your written policy should state plainly that retaliation for good-faith safety reporting is prohibited.

Record Retention Timelines

Different records carry very different retention rules, and mixing them up is where pharmacies get into trouble.

DEA controlled substance records: at least 2 years from the date of the inventory or record.⁴
Bloodborne pathogen training records: 3 years from the date of training.¹⁴
OSHA injury and illness logs (Form 300): 5 years following the end of the calendar year the records cover.
Employee exposure records: at least 30 years.¹⁷
Employee medical records: duration of employment plus 30 years. Exception: for employees who worked less than one year, records need not be retained past termination if they are provided to the employee at that time.¹⁷

The 30-year requirements surprise a lot of owners. If an employee handles cytotoxic drugs or works where exposure monitoring occurs, those records must be preserved for decades, potentially long after the employee leaves and even after the pharmacy changes ownership.

Penalties for Noncompliance

The financial exposure is real and has grown with recent inflation adjustments. OSHA penalties, based on the most recently published figures:

Serious or other-than-serious violation: up to $16,550 per violation.¹⁸
Willful or repeated violation: up to $165,514 per violation.¹⁸
Failure to abate: up to $16,550 per day beyond the correction deadline.¹⁸

DEA penalties for controlled substance recordkeeping violations reach $19,246 per violation under the most recent inflation-adjusted figures.¹⁹ More serious Controlled Substances Act violations, such as failures related to security or distribution controls, can reach $82,950 per violation. Beyond fines, serious or repeated violations can result in suspension or revocation of your DEA registration, which effectively ends your ability to dispense controlled substances. State pharmacy boards then layer their own penalties on top, including license suspension, mandatory corrective action plans, and probationary periods that can run for years.

1
Occupational Safety and Health Administration. OSH Act of 1970 – Duties
2
eCFR. 21 CFR 1301.71 – Security Requirements Generally
3
eCFR. 21 CFR 1301.75 – Physical Security Controls for Practitioners
4
eCFR. 21 CFR 1304.04 – Maintenance of Records and Inventories
5
Drug Enforcement Administration. Disposal Q&A – DEA Diversion Control Division
6
eCFR. 29 CFR 1910.1200 – Hazard Communication
7
United States Pharmacopeia. General Chapter – Hazardous Drugs – Handling in Healthcare Settings
8
National Institute for Occupational Safety and Health. NIOSH List of Hazardous Drugs in Healthcare Settings, 2024
9
Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens
10
Occupational Safety and Health Administration. OSHA Factsheet – Hepatitis B Vaccination Protection
11
Occupational Safety and Health Administration. 29 CFR 1910.38 – Emergency Action Plans
12
Occupational Safety and Health Administration. 29 CFR 1910.39 – Fire Prevention Plans
13
Occupational Safety and Health Administration. Hospitals – Pharmacy – Workplace Violence
14
eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens
15
Occupational Safety and Health Administration. Recordkeeping
16
Occupational Safety and Health Administration. OSHA Online Whistleblower Complaint Form
17
eCFR. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
18
Occupational Safety and Health Administration. OSHA Penalties
19
eCFR. 28 CFR Part 85 – Civil Monetary Penalties Inflation Adjustment