The employer is responsible for preparing emergency action plans. Under federal workplace safety regulations, the obligation to develop, maintain, and communicate an emergency action plan (EAP) falls squarely on the employer, not on individual employees or outside agencies. This applies to every workplace where an OSHA standard requires an EAP, regardless of industry.
What OSHA Requires From Employers
OSHA regulation 29 CFR 1910.38 spells out the employer’s duties clearly. The employer must create the plan, keep it in writing, store it at the workplace, and make it available for employees to review. The one exception: employers with 10 or fewer employees can communicate the plan orally instead of putting it in writing.
Several additional OSHA standards, including those covering hazardous waste operations and certain chemical exposures, separately require employers to develop emergency action plans containing the same core elements. In every case, the legal duty sits with the employer.
What the Plan Must Include
At a minimum, an emergency action plan must cover six elements:
- Emergency reporting procedures: How employees report fires and other emergencies.
- Evacuation procedures: Escape routes and assignments for getting people out safely.
- Critical operations procedures: Steps for employees who need to shut down equipment or manage essential systems before evacuating.
- Employee accounting: A method for confirming everyone is safe after an evacuation.
- Rescue and medical duties: Procedures for any employees assigned to perform these tasks.
- Contact information: Names or job titles of people employees can reach for more details about the plan.
These are minimums. Many workplaces need to go further based on their specific hazards, building layout, or the number of people on site.
Who Actually Writes the Plan
While the legal responsibility belongs to the employer, the practical work of creating an EAP typically falls to someone in a safety, facilities, or operations role. In larger organizations, a dedicated safety officer or emergency management coordinator leads the effort. In smaller businesses, the owner or a general manager often handles it directly. Human resources departments sometimes take ownership as well, since the plan intersects with employee onboarding and training requirements.
Regardless of who drafts the document, the employer remains legally accountable for its completeness, accuracy, and communication to every covered employee.
Training and Review Obligations
Creating the plan is only the first step. The employer must also designate and train employees to help with safe, orderly evacuations. Beyond that, the employer must review the emergency action plan with each employee at three specific points:
- When the plan is first developed or when an employee starts a new job
- When an employee’s responsibilities under the plan change
- When the plan itself is updated
OSHA does not set a fixed calendar for routine reviews, but any time the plan changes, every affected employee must be walked through the updates. The employer also has to maintain a functioning alarm system that uses a distinct signal employees can recognize.
Healthcare and Other Regulated Facilities
In healthcare settings, the responsibility extends beyond OSHA. The Centers for Medicare and Medicaid Services (CMS) requires all 21 types of Medicare and Medicaid providers and suppliers to comply with separate emergency preparedness regulations. Hospitals, nursing homes, and skilled nursing facilities each have their own certification requirements for emergency planning.
CMS sets stricter timelines than OSHA for keeping plans current. Most healthcare facilities must review and update their emergency plans, policies, and communication protocols at least every two years. Long-term care facilities face an annual review requirement. If policies are significantly updated, staff must be retrained on the changes.
Coordination With Outside Agencies
For facilities that handle hazardous materials, federal law adds another layer. Under the Emergency Planning and Community Right-to-Know Act (EPCRA), facility owners and operators must appoint a representative to participate in local emergency planning and provide information when requested by their Local Emergency Planning Committee (LEPC). State and regional emergency management agencies, along with FEMA, publish planning guides and offer coordination support, but the core duty to prepare and share information belongs to the facility.
Penalties for Noncompliance
Failing to prepare or maintain an emergency action plan carries real financial consequences. Under EPCRA, refusing to provide requested emergency planning information to a local planning committee can result in penalties of up to $25,000 per day. Both the EPA and state or local emergency planning bodies can take enforcement action, including filing civil suits in federal court.
OSHA separately enforces its own EAP requirements through workplace inspections. Citations for missing or inadequate plans fall under the agency’s standard penalty structure, which varies based on the severity and whether the violation is classified as willful or repeated. The bottom line: the cost of not having a plan consistently exceeds the effort of creating one.