The Final PPE Rule: What Small Practices Must Provide to Staff for Free (29 CFR § 1910.132(h))

The final PPE payment rule in 29 CFR 1910.132(h) quietly reshaped the obligations of employers, including small healthcare practices, by clarifying that when PPE is required under an OSHA standard, the employer must pay for it, with only a few narrow exceptions. For clinics that run on thin margins, misunderstanding this rule can lead to unexpected OSHA citations, staff complaints, and back pay orders for years of improperly shifted PPE costs.

In a medical office, PPE is not just gloves and masks. It includes eye and face protection, fluid-resistant gowns, and sometimes respirators, depending on the hazards identified in the practice’s risk assessment. When these are required to comply with OSHA standards, the practice cannot pass those costs to employees except where 1910.132(h) specifically allows.

This article explains what 1910.132(h) requires, which PPE you must provide at no cost, where the few exceptions lie, and how to build a simple documentation system that shows OSHA you are meeting the rule. The goal is to turn PPE payment from a vague, ad hoc decision into a controlled, defensible process that protects staff, patients, and the clinic’s finances.

Many small practices quietly expect staff to buy their own shoes, scrubs, and sometimes even protective eyewear or specialty gloves. The assumption is often that “everyone in healthcare buys their own gear.” Under the OSHA PPE payment rule in 29 CFR 1910.132(h), that assumption is wrong whenever the item is PPE required by an OSHA standard.

The final PPE rule was designed to remove economic barriers to worker safety. For a small clinic, this means that decisions about who pays for what PPE are not just HR or budget issues. They are regulatory decisions that OSHA can audit, cite, and penalize.

For healthcare, the stakes are higher because many hazards are inherent to daily work, including blood and body fluids, infectious aerosols, and chemical disinfectants. That reality makes PPE a core part of your compliance posture. The question is not whether staff wear PPE, but whether the practice pays for the PPE OSHA considers mandatory, documents that payment, and maintains a policy consistent with 1910.132(h).

Understanding Legal Framework & Scope Under 29 CFR 1910.132(h)

The general PPE standard at 29 CFR 1910.132 requires employers to assess workplace hazards and provide appropriate PPE when engineering and administrative controls cannot eliminate the risks. Paragraph (h) addresses one critical question: who pays.

Key elements of 1910.132(h) for small practices include:

• When PPE is required to comply with any OSHA standard, the employer must provide it at no cost to employees.

• The rule identifies limited exceptions for items considered personal, every day, or usable off the job, such as:

• Non-specialty safety-toe footwear and non-specialty prescription safety eyewear that employees can use outside work.

• Everyday clothing such as long-sleeve shirts, long pants, street shoes, and other weather-related ordinary clothing.

• Certain logging boots in specific logging operations.

• Employers generally must pay to replace PPE that is damaged or worn out in the course of normal use, with an exception where the employee has lost or intentionally damaged the item.

• Employers cannot require employees to provide their own PPE, nor can they charge employees for PPE that is required by OSHA standards, even if employees prefer to use their own equipment.

For a healthcare clinic, this means you must pay for items such as:

• Disposable and reusable gloves used for protection against bloodborne pathogens and other infectious materials.

• Fluid-resistant gowns and aprons that protect against splashes and sprays.

• Face shields, goggles, and safety glasses used to protect against splashes or flying particles.

• Respirators used to protect against airborne hazards, where required by a hazard assessment and other OSHA standards.

Understanding where PPE payment is mandatory, and where exceptions apply, directly reduces the risk of OSHA citations, unbudgeted reimbursement for staff-purchased PPE, and disputes during inspections. A clear, written policy grounded in 1910.132(h) also reduces administrative friction by giving HR, finance, and clinical leadership a single rulebook for PPE decisions.

The PPE payment rule is enforced by OSHA within the U.S. Department of Labor, or by an OSHA-approved state plan agency where applicable. The same enforcement structure that applies to other OSHA standards applies here, including complaint-based inspections and programmed inspections in high-risk sectors.

Common triggers for review of a clinic’s PPE payment practices include:

• Employee complaints that they are required to buy PPE that is necessary to perform their job safely.

• OSHA inspections following workplace injuries, exposures, or infectious disease events, where inspectors observe PPE in use and question who pays.

• Broader inspections that review the clinic’s PPE hazard assessment, training, and equipment, during which invoices or policies might be requested.

• Referrals from other agencies or accrediting bodies that have identified concerns about PPE availability or employer responsibilities.

If OSHA determines that a practice has violated 29 CFR 1910.132(h) by failing to pay for required PPE, the agency can:

• Issue citations and monetary penalties.

• Require corrective actions that may include reimbursement of PPE costs to employees and policy revisions.

• Treat related noncompliance, such as lack of hazard assessment or training, as additional violations under 1910.132(a)–(f).

Small practices should recognize that PPE payment is not merely a technical detail. When inspectors encounter evidence that staff have been paying for required PPE, it can signal broader weaknesses in the practice’s safety culture and resource commitment, which may invite deeper scrutiny.

Even though this heading refers to HIPAA, the same survival mindset applies to OSHA PPE payment rules. The goal is to build simple, defensible controls that show you understand 29 CFR 1910.132(h), apply it consistently, and keep evidence.

Below are practical controls tailored to small practices, each tied directly to the PPE payment rule.

1. Create a PPE payment inventory tied to hazards and standards

• Implementation: List every PPE item used in your clinic, from exam gloves to protective eyewear and gowns. For each item, record the hazard it addresses, the OSHA standard that requires PPE, and whether the clinic or employee currently pays.

• Evidence to retain: A simple spreadsheet or table that includes columns for PPE type, applicable OSHA standard, payer (employer or employee), and justification under 1910.132(h)(1)–(4).

• Low-cost approach: Use a free spreadsheet platform and update it during regular staff meetings when new PPE types are introduced.

2. Write a PPE payment policy that mirrors 1910.132(h) language

• Implementation: Draft a short policy stating that the clinic pays for all PPE required by OSHA standards, except for the specific items OSHA allows employees to purchase, such as ordinary safety-toe shoes or everyday street clothing, and only where those items are not specialized PPE.

• Evidence to retain: The signed policy, acknowledgement forms from staff, and meeting minutes where the policy was introduced.

• Low-cost approach: Adapt policy templates from OSHA guidance and customize them to the clinic’s PPE inventory without buying expensive compliance software.

3. Tie purchasing and accounts payable directly to PPE obligations

• Implementation: Ensure all employer-paid PPE is purchased through the clinic’s usual ordering process, not through informal reimbursement. Tag purchase orders and invoices as “PPE” so you can quickly produce documentation that the clinic purchased required PPE at no cost to employees.

• Evidence to retain: Invoices, purchase orders, and budget lines that show the clinic consistently pays for PPE linked to OSHA standards.

• Low-cost approach: Use existing accounting software or manual codes to mark PPE purchases without creating a separate system.

4. Clarify and document the narrow exceptions you rely on

• Implementation: For each item that employees pay for, such as non-specialty safety footwear or everyday clothing, document why it meets an exception under 1910.132(h)(4), including the fact that the same item can be worn off the job and is not required to comply with a specific PPE standard.

• Evidence to retain: A short memo listing these employee-paid items and the specific paragraph of 1910.132(h) that justifies the exception.

• Low-cost approach: Draft this memo once and update only if new exceptions are added.

5. Establish a simple replacement and damage rule consistent with 1910.132(h)(5)

• Implementation: Define when the clinic will replace PPE due to normal wear and tear and under what circumstances employees may be asked to pay for lost or intentionally damaged PPE, consistent with 1910.132(h)(5).

• Evidence to retain: Policy language, incident reports when employees are charged for intentional damage, and logs showing regular replacement of worn PPE.

• Low-cost approach: Integrate this rule into your existing employee handbook to avoid producing a separate document.

6. Train supervisors and leads on who pays before they assign PPE

• Implementation: Hold a brief training where supervisors review the PPE inventory and payment policy, so they never tell staff to “go buy your own” when OSHA requires the clinic to pay.

• Evidence to retain: Training sign-in sheets, slides or handouts, and annual reminders to supervisors.

• Low-cost approach: Conduct this training as a 20-minute agenda item during a regular staff or safety meeting.

Together, these controls create a coherent story: you know what PPE is required, you know when you must pay, you have a policy that matches 1910.132(h), and your purchasing practices prove it. That is exactly the narrative you want during an OSHA inspection.

Case Study

A small outpatient clinic with twelve employees routinely handled minor procedures and used PPE such as gloves, face shields, and disposable gowns. Staff were told that they were responsible for buying their own goggles or safety glasses, and that the clinic would reimburse only if goggles were damaged during a specific incident.

An employee complained to OSHA after being splashed in the eye with blood while wearing personally purchased goggles that were scratched and difficult to see through. During the inspection, the OSHA compliance officer reviewed the clinic’s PPE practices and discovered:

• The clinic’s written procedures required eye protection during all procedures where splashes were possible, which meant eye protection was clearly PPE required by an OSHA standard.

• Staff roster and receipts showed that employees routinely purchased their own eye protection and were not reimbursed, even though the goggles were used exclusively at work.

• No written PPE payment policy existed, and supervisors believed that eye protection fell into the same category as “uniform items” that employees buy themselves.

OSHA cited the clinic under 29 CFR 1910.132(h) for failing to provide required PPE at no cost to employees, and issued additional citations related to training and hazard assessment. The clinic agreed to a settlement that required:

• Reimbursing current employees for documented PPE purchases over the previous year.

• Implementing a new PPE payment policy, inventory, and training plan.

• Demonstrating that eye and face protection was now purchased and supplied directly by the clinic.

If the clinic had implemented the controls described in the survival guide section, it would have identified eye protection as employer-paid PPE and aligned its purchasing and policy practices long before the incident. The case shows how a seemingly minor cost-shifting practice can result in regulatory findings, back pay costs, and reputational damage when OSHA becomes involved.

Consistently working through this checklist helps ensure that the clinic’s day-to-day purchasing and staffing decisions stay aligned with the PPE payment standard and that there is a clear record to show OSHA if questions arise.

Common Audit Pitfalls to Avoid Under 29 CFR 1910.132(h)

There are recurring mistakes that small practices make when applying the PPE payment rules. Anticipating them makes it easier to prevent citations and staff disputes.

• Treating all clothing and accessories as “uniforms” and shifting costs to staff when in reality some items are required PPE, such as fluid-resistant gowns used only in clinical areas. This conflicts with 1910.132(h)(1) because the employer must pay for PPE required by OSHA standards. The practical consequence is potential OSHA citations and retroactive reimbursement obligations.

• Assuming that because safety shoes or eyewear could be worn off the job, they always count as exceptions. 1910.132(h)(4) allows exceptions only for non-specialty items that are not required by a PPE standard for the job. Misusing this flexibility can result in OSHA finding that the clinic has improperly shifted PPE costs.

• Failing to align replacement practices with 1910.132(h)(5) and charging employees for worn-out PPE. OSHA views normal wear and tear replacements as employer-paid; charging employees can lead to findings that PPE was effectively not provided at no cost.

• Allowing staff to use personally owned PPE without confirming it meets OSHA requirements and without clarifying that the clinic would otherwise pay. Under 1910.132(h)(6), employers may allow voluntary employee-owned PPE but cannot avoid payment obligations or reduce their responsibility to ensure adequacy.

• Maintaining no documentation trail for PPE purchases and payment decisions, leaving the clinic unable to demonstrate compliance during an inspection. While the standard does not explicitly require specific documentation formats, lack of records makes it difficult to rebut employee allegations or inspector concerns.

Addressing these pitfalls with clear policies, training, and purchasing practices significantly reduces compliance risk under 29 CFR 1910.132(h) and demonstrates to OSHA that the clinic takes the PPE payment rule seriously.

PPE payment compliance is easier when it is embedded into how the practice operates rather than treated as a one-time project. That requires visibility, ownership, and reinforcement.

Leadership should designate a single PPE program lead, often the practice manager or safety officer, who is accountable for the PPE inventory, payment policy, and training cadence. Their role is to coordinate among clinical, HR, and finance staff so that everyone applies 1910.132(h) the same way.

Training should be brief but regular. During new hire orientation, staff should hear that the clinic pays for required PPE and how to request replacements. Once a year, the clinic can refresh this message, highlight any changes in PPE, and remind supervisors not to ask employees to buy required PPE out of pocket.

Simple monitoring metrics can include the number of PPE purchase orders per quarter, any staff complaints related to PPE costs, and completion rates for PPE training. When these metrics are reviewed at leadership meetings, the practice can catch emerging issues before they turn into OSHA complaints or morale problems.

The final PPE rule at 29 CFR 1910.132(h) answers a deceptively simple question: who pays for PPE when it is required by OSHA standards. For small healthcare practices, the answer is that the clinic almost always must pay, with only narrow exceptions. Getting this wrong exposes the practice to OSHA citations, back pay liabilities, and avoidable strain in staff relationships.

By understanding the framework of 1910.132(h), mapping PPE items to hazards and standards, and documenting payment decisions, small practices can turn PPE from a hidden risk into a visible, controlled compliance success.

Immediate next steps for a small clinic include:

1. Build a simple PPE inventory that lists each item, its hazard, the applicable OSHA standard, and whether the clinic or employee pays, then adjust any entries that conflict with 1910.132(h).

2. Draft or update a concise PPE payment policy that closely tracks the language and structure of 1910.132(h), including the limited exceptions, and have all staff acknowledge it.

3. Align purchasing and accounting processes so that invoices clearly show employer payment for required PPE, and set a schedule for periodic internal reviews of PPE costs and practices.

Recommended compliance tool: A shared PPE policy and inventory file stored with your safety documentation and reviewed at least once a year.

Advice: Ask one direct question at your next leadership meeting: “Can we prove today that the clinic pays for all OSHA-required PPE” and use the answer to launch your PPE payment cleanup.

• 29 CFR 1910.132 Personal Protective Equipment
  

• OSHA: Personal Protective Equipment

• “PPE in General Industry” guidance (New Mexico Dept. of Labor) referencing § 1910.132(h)