Workplace emergencies, from chemical releases and fires to severe weather and active threats, demand responses that are fast, coordinated, and practiced. Under federal law, multiple overlapping regulations govern how organizations plan, train, and respond: OSHA's Emergency Action Plan standard (29 CFR 1910.38), HAZWOPER (1910.120), Process Safety Management (1910.119), and EPA's Risk Management Program (40 CFR Part 68) each impose distinct requirements depending on the hazards present. This guide breaks down what each regulation requires, where they overlap, and how EHS emergency planning software helps organizations manage the complexity.
The Regulatory Complexity of Emergency Preparedness
Emergency preparedness is not governed by a single standard. Depending on the hazards at your facility, multiple overlapping regulations may apply simultaneously, each with distinct plan elements, training requirements, and review cycles.
This intricate set of requirements demands an integrated approach that paper-based methods cannot accommodate. Emergency planning software provides a centralized platform to manage plans, training, drills, and compliance deadlines across all applicable frameworks.
OSHA 1910.38: The Emergency Action Plan Foundation
The Emergency Action Plan (EAP) standard at 29 CFR 1910.38 is the foundational emergency preparedness regulation for general industry. It does not apply universally; rather, it becomes mandatory when another OSHA standard triggers it, including 1910.119 (PSM), 1910.120 (HAZWOPER), 1910.157 (portable fire extinguishers), 1910.272 (grain handling), and several substance-specific standards. Even so, OSHA strongly recommends all employers maintain an EAP regardless of whether one is legally required.
Six Mandatory EAP Elements
- Emergency Reporting Procedures — Documented methods for reporting fires and other emergencies, including internal notification chains and when to call 911
- Evacuation Procedures and Exit Route Assignments — Specific evacuation routes with exit assignments by work area, including procedures for high-rise buildings and areas with limited egress
- Critical Operations Procedures — Designated employees authorized to remain behind to shut down critical plant operations before evacuating
- Employee Accountability — A system to account for all employees after evacuation through headcounts at designated assembly points
- Rescue and Medical Duties — Procedures for employees assigned to perform rescue operations or provide emergency medical treatment
- Emergency Contacts — Names or job titles of every employee who can be contacted for plan information
The plan must be written and kept at the workplace for employee review, with one notable exception: employers with 10 or fewer employees may communicate the plan orally. An employee alarm system with a distinctive signal complying with 1910.165 is also required.
The construction counterpart at 29 CFR 1926.35 mirrors these requirements but faces unique challenges. Construction sites change constantly as new floors, excavations, and staging areas shift the layout, making plan updates and multi-employer coordination especially critical.
HAZWOPER: Five Tiers of Emergency Response Training
The Hazardous Waste Operations and Emergency Response standard at 29 CFR 1910.120 (with its construction counterpart at 1926.65) establishes a tiered framework for emergency response to hazardous substance releases. The standard draws a critical distinction between emergency responses (uncontrolled releases requiring response from outside the immediate area) and incidental releases (limited spills controllable by employees in the immediate area). Only emergency responses trigger full HAZWOPER compliance.
Employers who evacuate all employees and do not permit anyone to assist in handling an emergency need only an EAP under 1910.38. But employers whose personnel actively respond must develop a written emergency response plan addressing 11 mandatory elements, including pre-emergency planning and coordination with outside parties, personnel roles, emergency recognition and prevention, safe distances and places of refuge, site security, decontamination procedures, and emergency medical treatment.
First Responder Awareness Level
Personnel who witness or discover a release and notify authorities. No minimum hour requirement, but they must demonstrate competency. Observe and report only; no defensive or offensive action is permitted.
First Responder Operations Level
Initial responders who perform defensive containment from a safe distance. Requires a minimum of 8 hours of training plus awareness-level competencies. Defensive actions only, such as closing valves or containing spills without approaching the release point.
Hazardous Materials Technician
Responders who approach the release point to stop it. Requires 24 hours of training plus operations-level competencies, with specialized PPE and monitoring equipment.
Hazardous Materials Specialist
Advanced responders who support technicians with substance-specific knowledge and serve as liaisons with federal, state, and local authorities. Requires 24 hours of training plus technician-level competencies.
On-Scene Incident Commander
Personnel who assume strategic control of the incident scene and implement the Incident Command System (ICS). Requires 24 hours of training plus operations-level competencies.
All tiers require annual refresher training or demonstrated competency. Employers must issue written training certificates, and medical surveillance under 1910.120(q)(9) covers HAZMAT team members and specialists, requiring exams prior to assignment, at least every 12 months, at termination or reassignment, and after emergency incidents. Medical records must be retained for the duration of employment plus 30 years.
Process Safety Management: Emergency Planning for Highly Hazardous Chemicals
The PSM standard at 29 CFR 1910.119 applies to processes involving any of 137 listed highly hazardous chemicals at or above threshold quantities (such as chlorine at 1,500 pounds or anhydrous ammonia at 10,000 pounds) or flammable liquids and gases at 10,000 pounds or more.
PSM Emergency Planning Requirements
The emergency planning requirement at 1910.119(n) requires employers to establish an EAP per 1910.38 for the entire plant, not just the covered process, and must include procedures for handling small releases. PSM emergency planning operates on three practical tiers:
- Evacuation-only EAP covering all employees at minimum
- Small-release procedures defining what constitutes a "small release" and establishing response steps
- HAZWOPER escalation — if plant personnel actively respond to significant releases, those activities fall under 1910.120(q), triggering full emergency response plan requirements, training tiers, and medical surveillance
PSM training requires initial instruction emphasizing emergency operations including shutdown, with refresher training at least every three years. Compliance audits must occur at least every three years, and the two most recent audit reports must be retained. Common violations include establishing an EAP only for the process area rather than the entire plant, omitting small-release procedures, failing to communicate the EAP to contract employees, and failing to determine whether employee response actions trigger HAZWOPER compliance.
EPA Risk Management Program: Community Protection Under 40 CFR Part 68
EPA's Risk Management Program applies to stationary sources with more than threshold quantities of any of approximately 140 regulated substances (77 toxic, 63 flammable). Approximately 12,000 facilities nationwide are covered, and roughly 131 million people live within three miles of an RMP facility. The program operates on three tiers:
RMP Program Tiers
- Program 1 — No public receptors within worst-case distance, no accidents in five years, coordinated local response
- Program 2 — Streamlined prevention for facilities not eligible for Program 1 or 3
- Program 3 — Essentially mirrors OSHA PSM; required for facilities in NAICS codes like petroleum refining and chemical manufacturing
Emergency response program elements under 40 CFR 68.95 include procedures for informing the public and local agencies about releases, first-aid and emergency medical documentation, emergency response procedures, emergency equipment use and testing, employee training, and procedures for plan review and update. All facilities must coordinate with local emergency planning committees (LEPCs) and local fire departments. RMP plans must be reviewed and resubmitted to EPA at least every five years, with interim updates triggered by process changes, new substances exceeding thresholds, or reportable accidents. Civil penalties can reach $121,275 per violation per day.
OSHA Fire Brigades and the Proposed Emergency Response Standard
The fire brigades standard at 29 CFR 1910.156 applies only to fire brigades, industrial fire departments, and private fire departments that an employer voluntarily establishes. OSHA does not require employers to create fire brigades, but once one exists, the standard mandates a written organizational statement, training at least annually for all members (quarterly for interior structural firefighting), physical capability requirements, positive-pressure SCBA with minimum 30-minute service life, and protective clothing meeting NFPA 1971 equivalency.
OSHA published a proposed rule in February 2024 to replace the 1980-era fire brigades standard with a comprehensive Emergency Response standard covering firefighters, EMS personnel, and technical rescue teams, incorporating more than 22 NFPA standards by reference. The comment period closed in July 2024, but the rulemaking is now frozen under a January 2025 regulatory freeze and is unlikely to advance in the near term. The existing standard remains in full effect.
Voluntary Standards: NFPA 1660, NIMS, and ISO 22301
NFPA 1660 (2024)
NFPA consolidated three predecessor standards (NFPA 1600, 1616, and 1620) into NFPA 1660, the Standard for Emergency, Continuity, and Crisis Management. Endorsed by the 9/11 Commission and recognized by DHS/FEMA, it establishes a comprehensive program framework covering hazard identification and risk assessment, business impact analysis, resource management, communications and warning systems, training and exercises, and continuous improvement through post-incident analysis.
NFPA 101 (Life Safety Code)
Adopted in some form by all 50 states, NFPA 101 drives occupancy-specific emergency planning with fire drill frequency requirements varying by building type: quarterly on each shift for healthcare and educational occupancies, at least every six months for commercial buildings.
National Incident Management System (NIMS)
NIMS provides the nationwide template for multi-agency coordination. Private-sector organizations are strongly encouraged to adopt the Incident Command System (ICS). FEMA offers a free tiered training sequence: IS-100 and IS-700 for all responders, IS-200 for supervisors, ICS-300 and IS-800 for mid-level managers, and ICS-400 for senior command staff.
ISO 22301
The international framework for business continuity management, built on business impact analysis (BIA) identifying recovery time objectives, recovery point objectives, and maximum tolerable periods of disruption for critical processes.
State-Level Requirements Beyond Federal OSHA
Twenty-seven states plus two territories operate OSHA-approved State Plans, each required to be at least as effective as federal OSHA but permitted to exceed federal requirements. California's Injury and Illness Prevention Program (IIPP) under Title 8 CCR Section 3203 is the most significant departure, requiring every California employer to maintain a written safety program with eight mandatory elements. California also requires a written EAP for employers with more than 10 employees, has a permanent wildfire smoke protection standard triggered at AQI 151 or higher for PM2.5, and enacted the nation's first heat illness prevention standard for outdoor workers in 2006. Washington State and Oregon have similarly adopted wildfire smoke and seasonal heat exposure rules that often exceed federal standards.
Best Practices That Push Beyond Regulatory Minimums
Regulations establish the compliance floor, but effective preparedness requires going further. Programs should begin with a site-specific hazard assessment covering natural disasters, fire and explosions, chemical releases, active shooter scenarios, medical emergencies, utility failures, pandemics, bomb threats, and cyber incidents affecting physical safety.
Evacuation and Shelter-in-Place Planning
Designate primary and secondary routes, post color-coded floor plans, assign one warden per 20 employees (per OSHA Publication 3088), use buddy systems for persons with disabilities, and pre-designate shelter locations with HVAC shutdown procedures for chemical releases and severe weather.
Multi-Channel Communication
Deploy mass notification spanning SMS, voice, email, push notifications, PA systems, digital signage, and two-way radio with two-way acknowledgment for real-time accountability. Build network redundancy through parallel pathways, automatic failover, backup power, and multiple carrier relationships.
Drill Frequency and Variety
Conduct fire evacuation drills at least twice per year (quarterly for high-risk facilities), tabletop exercises semi-annually, full-scale exercises annually, and active shooter exercises annually per CISA guidance. Mix announced and unannounced drills at different times of day and across shifts.
After-Action Discipline
Use the FEMA HSEEP methodology for exercise evaluation, conduct hot washes immediately after exercises, and assign SMART corrective actions (Specific, Measurable, Achievable, Relevant, Time-bound) with an owner, target completion date, and tracking to resolution.
Business Continuity Integration
Emergency response protects lives; business continuity restores operations. Conduct business impact analysis to identify recovery time and recovery point objectives for critical processes. FEMA data shows that up to 40 percent of businesses affected by disasters never reopen.
Ecesis Emergency Preparedness Software
Emergency Planning
Create and manage emergency action plans with version control.
After-Action Reporting
Capture drill findings, assign corrective actions, and track to closure.
Training Management
Track HAZWOPER tiers, refresher deadlines, and certifications.
Compliance Calendar
Consolidate EAP reviews, drill schedules, and RMP deadlines.
Incident Management
Document emergency incidents with real-time data capture.
Mobile App
Access emergency plans and report incidents from the field.
