OSHA 29 CFR 1910.38 — Emergency Action Plans

OSHA 29 CFR 1910.38 is the federal regulation requiring employers to maintain a written Emergency Action Plan. It specifies six minimum plan elements, operational requirements for alarm systems and employee training, and the conditions under which a plan must be reviewed with affected employees. For healthcare-adjacent organizations in the AOG client base, a written EAP is mandatory — there are no size exceptions in practice.

Last reviewed: April 2026  |  Source: eCFR, 29 CFR 1910.38

Every written EAP under OSHA 1910.38 must include, at minimum, the following six elements:

# Element CFR Citation
1 Means of reporting fires and other emergencies 29 CFR 1910.38(c)(1)
2 Evacuation procedures and emergency escape route assignments 29 CFR 1910.38(c)(2)
3 Procedures for employees who remain to operate critical operations before evacuating 29 CFR 1910.38(c)(3)
4 Procedures to account for all employees after evacuation 29 CFR 1910.38(c)(4)
5 Rescue and medical duties for employees performing them 29 CFR 1910.38(c)(5)
6 Names or job titles of persons who can be contacted for additional information 29 CFR 1910.38(c)(6)

Two additional operational requirements apply under 1910.38(d) and (e): a maintained employee alarm system with distinctive signals for each purpose, and designated, trained employees to assist in safe and orderly evacuation.

Applicability — Who Must Have an EAP

An employer must maintain an Emergency Action Plan whenever any OSHA standard in 29 CFR Part 1910 requires one. Several 1910 standards trigger this requirement, including Process Safety Management of Highly Hazardous Chemicals (1910.119), Hazardous Waste Operations and Emergency Response (1910.120), Portable Fire Extinguishers (1910.157) for employers with fire extinguisher programs, and Grain Handling Facilities (1910.272).

The written-plan threshold is the practical rule that governs most employers:

Employers with 11 or more employees must have a written EAP. Employers with 10 or fewer employees may communicate the plan orally. 29 CFR 1910.38(b).

For healthcare-adjacent organizations — ambulatory surgery centers, urgent care chains, behavioral health facilities, dialysis centers, and medical group practices — every target client exceeds the 10-employee threshold. Written EAPs are mandatory without exception.

The Six Required Elements

OSHA 1910.38(c) specifies the six minimum required elements below. “Minimum” is the regulatory floor. A plan missing any one element is non-compliant regardless of the quality of the remaining elements. Each element’s full requirements are expanded in the accordions below.

The plan must define the procedures employees follow to report a fire or any other emergency the plan addresses. The requirement is not limited to fire.

 

A compliant plan specifies:

 

  • The primary reporting method — 911, internal emergency number, or manual alarm pull
  • The sequence of notifications — who calls first, who notifies whom internally
  • What information to communicate when calling — facility name, address, nature of emergency, callback number
  • A backup reporting method if the primary method fails

 

The regulation does not mandate a specific method. It requires that whatever method the employer selects is documented, communicated to employees, and operationally functional.

The plan must define the policies, procedures, and escape route assignments that govern evacuation. Employees must know who orders an evacuation, under what conditions an evacuation is required, how to evacuate, and what routes to use.

 

A compliant plan specifies:

 

  • Who has authority to order an evacuation — identified by specific role, not generic “management”
  • The conditions that trigger each response type — full building evacuation, partial evacuation, or shelter-in-place
  • Escape route assignments by work area and position
  • Primary and secondary routes from each location in the facility
  • Exit diagrams posted throughout the facility
  • Actions employees take before and during evacuation — closing doors, shutting down equipment, communicating status

 

Route assignments must reflect the actual facility layout. A plan that says “use the nearest exit” without assigning routes to specific work areas does not satisfy this element.

Some employees may be required to remain at their stations temporarily before evacuating — to shut down equipment, secure hazardous materials, or prevent conditions that would create additional risk for emergency responders.

 

A compliant plan specifies:

 

  • Identification of critical operations that require controlled shutdown before evacuation
  • Specific procedures for each critical shutdown — who performs it, in what sequence, how long it should take
  • Clear criteria for when the employee leaves regardless of shutdown status
  • Identification of which employees are assigned these roles

 

For healthcare-adjacent facilities, this element commonly applies to medical gas shutoffs, controlled substance security, patient monitoring equipment, imaging equipment, and HVAC systems. Generic language such as “shut down equipment as appropriate” does not satisfy this element.

After an evacuation, the employer must have a procedure to confirm that all employees have evacuated safely. This is among the most operationally important elements and among the most commonly underdeveloped in real plans.

 

A compliant plan specifies:

 

  • Designated assembly areas — specific, identified locations, not generic “away from the building”
  • Designation of evacuation wardens responsible for each area or work zone
  • A specific accountability method — headcount, roster check, or roll call
  • A procedure for reporting missing employees to emergency responders
  • A process for accounting for visitors and contractors not on the regular employee headcount

 

Headcount procedures must be operational, not just documented. A warden assigned a roster must know where the roster is, have access to it during an evacuation, and know what to do if someone is unaccounted for.

The plan must identify any employees who have assigned rescue or medical duties during an emergency. OSHA acknowledges that most small organizations rely on local public resources — fire department, EMS, hospital — for these functions rather than assigning them to employees.

 

A compliant plan specifies one of the following:

 

  • If rescue or medical duties are assigned to employees — the specific roles, required training, and equipment provided
  • If the organization relies on external first responders — explicit documentation that this is the plan and that no employees are assigned rescue duties

 

Pre-incident coordination with local fire and EMS is good practice and commonly documented as part of this element, though it is not a regulatory requirement under 1910.38.

 

For clinical facilities, it is important to distinguish between routine clinical scope of practice and emergency response expectations. Clinical training is not the same as emergency medical response in a facility-wide crisis. The plan should define what clinical staff are and are not expected to do during an emergency before first responders arrive.

The plan must include the names, titles, departments, and phone numbers of employees who can be contacted for additional information about the plan or for explanation of any employee’s duties under the plan.

 

A compliant plan specifies:

 

  • A primary contact — the person responsible for the EAP and its maintenance
  • A contact for each major plan section when responsibilities are distributed
  • Both a name and a job title for each contact
  • Current phone numbers, kept current as a maintenance obligation

 

The regulation requires both names and titles. Listing names alone creates a document that becomes inaccurate every time a person leaves the organization. Listing titles alone leaves emergency responders without a specific person to call. Both are required.

Additional Operational Requirements

In addition to the six plan elements above, 1910.38 imposes two separate operational requirements that apply regardless of the plan’s written content.

Employee Alarm System — 29 CFR 1910.38(d)

The employer must install and maintain an employee alarm system. The alarm must use a distinctive signal for each purpose it serves, and it must comply with the requirements in 29 CFR 1910.165.

In practice, this means each type of emergency response — fire, hazmat, lockdown, shelter-in-place — must have a recognizable, distinct alarm signal. Employees must be able to distinguish signals and know the action associated with each. The alarm system must be tested and maintained on an ongoing basis.

Training — 29 CFR 1910.38(e)

The employer must designate and train a sufficient number of employees to assist in the safe and orderly evacuation of other employees.

Designation alone does not satisfy the requirement. Designated employees must be trained specifically for the role they perform — evacuation wardens, accountability leads, critical-operations shutdown personnel. Training must be documented.

Review and Update Triggers — 29 CFR 1910.38(f)

The employer must review the Emergency Action Plan with each employee covered by the plan under four specific conditions:

Trigger Requirement
The plan is first developed Review with all employees before the plan takes effect
An employee is initially assigned to a job Review with that employee at the time of assignment
An employee's responsibilities under the plan change Review the relevant sections with that employee
The plan is changed for any reason Review updated sections with all affected employees

The review obligation is continuous. Any personnel change, facility change, or procedural update that affects the plan triggers a re-training obligation for the employees the change affects.

What OSHA Does Not Require Under 1910.38

The following are common additions to EAPs that are good practice but are not mandates under this specific standard. Other OSHA standards, CMS regulations, or Joint Commission requirements may impose these obligations on certain facilities.

  • Specific scenario coverage beyond the six required elements — active threat, severe weather, utility failure, cyber incidents
  • A specific document format or structure
  • Annual drills or exercises — these are addressed under other regulatory frameworks, notably the CMS Emergency Preparedness Rule and Joint Commission Emergency Management standards
  • A minimum plan length or level of detail beyond what is required to satisfy the six elements

Enforcement and Penalties

OSHA does not conduct random inspections. An inspection may be triggered by a reported fatality or catastrophe (defined as three or more hospitalized workers), an employee complaint, a referral from another agency, or a programmed inspection targeting high-hazard industries with elevated injury and illness rates.

For healthcare-adjacent workplaces, OSHA enforcement commonly focuses on:

  • Workplace violence prevention — addressed under the enforcement directive CPL 02-01-058 for high-violence industries including healthcare
  • Ergonomic hazards related to patient handling
  • Bloodborne pathogen exposure controls under 29 CFR 1910.1030
  • Emergency action plan deficiencies — typically cited when an incident occurs and the plan is found to be missing required elements or untrained staff

Penalty Ranges — 2025

Current OSHA maximum penalty amounts per violation:

Violation Type Penalty Range
Other-than-serious $0 to $16,550
Serious $1,190 to $16,550
Repeat (same citation within 5 years) Up to $165,514
Willful $11,524 to $165,514

A missing or deficient EAP is typically cited as a serious violation, not an other-than-serious violation, because the absence of a functional plan creates real potential for injury or death in an emergency. When multiple elements are missing or deficient, each may be cited separately.

According to an analysis of FY2022 OSHA enforcement data by Compliancy Group, the average OSHA fine assessed in healthcare settings for EAP-related deficiencies is approximately $4,900 per citation.

Source

Primary source: 29 CFR 1910.38, Emergency Action Plans, U.S. Department of Labor, Occupational Safety and Health Administration. Accessible via the Electronic Code of Federal Regulations at ecfr.gov.

View 29 CFR 1910.38 on eCFR.gov

Related Regulatory References

The following related standards affect AOG client emergency preparedness obligations and will be added to the Regulatory Library as each is built:

  • CMS Emergency Preparedness Rule (42 CFR §482.15 and related — healthcare facility requirements)
  • Joint Commission Emergency Management Standards (revised July 1, 2024)
  • Texas Health and Safety Code Chapter 331 (workplace violence prevention, healthcare)
  • OSHA 29 CFR 1910.165 — Employee Alarm Systems
  • OSHA 29 CFR 1910.157 — Portable Fire Extinguishers

Document Control

Last reviewed: April 2026 Next scheduled review: April 2027 Reference page owner: Adams Operations Group