Most business owners I talk to make the same mistake. They Google "OSHA requirements," find a federal standard, slap together a safety program based on what they read, and assume they're covered.
Then they get a visit from a state inspector enforcing a standard they've never heard of. A standard that doesn't exist at the federal level. A standard that carries penalties they weren't budgeting for.
And suddenly that Google search looks pretty expensive.
Here's the reality nobody tells you at the Chamber of Commerce mixer: **there is no single "OSHA" in America.** There are, effectively, 29 different occupational safety and health agencies operating across 50 states and four territories. Which one has jurisdiction over your business depends entirely on where your employees physically work — not where your company is headquartered, not where you're incorporated, and certainly not where you'd prefer to be regulated.
Let me walk you through the entire landscape so you actually know what you're dealing with.
How Federal OSHA Actually Works
The Occupational Safety and Health Administration sits inside the U.S. Department of Labor. It was created by the OSH Act of 1970 — signed by Nixon, for those keeping score — and its mission is straightforward: set and enforce workplace safety standards for private-sector employers.
Federal OSHA operates through a regional structure:
- **10 Regional Offices** covering the entire country
- **85 Area Offices** that handle inspections and enforcement at the local level
- **National Office** in Washington, D.C., which develops standards, sets policy, and oversees the whole operation
The chain of command runs: Area Office → Regional Office → National Office → Assistant Secretary of Labor for Occupational Safety and Health → Secretary of Labor.
When a federal OSHA compliance officer shows up at your door, they're working out of one of those 85 area offices. They conduct inspections based on complaints, referrals, fatalities, planned programs targeting high-hazard industries, and follow-up visits. The citations they issue carry the force of federal law, and the penalties are set by federal statute — currently up to $16,131 per serious violation and $161,323 per willful or repeat violation (2024 figures, adjusted annually for inflation per the Federal Civil Penalties Inflation Adjustment Act of 2015).
That's the federal side. Clear enough.
Now here's where it gets complicated.
The State Plan Program: "At Least as Effective"
Section 18 of the OSH Act gave states the option to run their own occupational safety and health programs — provided those programs are "at least as effective" as the federal program. This isn't optional window dressing. States that operate approved plans must demonstrate they have:
- Standards that are at least as protective as federal OSHA standards
- Adequate enforcement capability (inspectors, legal staff, funding)
- Right of entry for inspections
- Prohibition against advance notice of inspections
- Employee protection against retaliation (whistleblower provisions)
- A state agency designated to administer the program
Federal OSHA doesn't just approve a state plan and walk away. There's an ongoing monitoring relationship. Each state plan undergoes annual Federal Annual Monitoring and Evaluation (FAME) reports, and OSHA can withdraw approval if a state fails to maintain effectiveness. States receive up to 50% of their program operating costs from federal OSHA under Section 23(g) grants — which gives the feds meaningful leverage.
The key phrase is **"at least as effective."** States can meet federal standards. Or they can exceed them. Many do. And that's where the compliance landmines are buried for employers who assume "OSHA" means one thing everywhere.
The 22 Federal OSHA States
These states do NOT operate their own plans. Federal OSHA has direct jurisdiction over all private-sector (and in most cases, state and local government) workplaces:
- Alabama
- Arkansas
- Colorado
- Delaware
- Florida
- Georgia
- Idaho
- Kansas
- Louisiana
- Massachusetts
- Mississippi
- Missouri
- Montana
- Nebraska
- New Hampshire
- North Dakota
- Ohio
- Oklahoma
- Pennsylvania
- Rhode Island
- South Dakota
- West Virginia
- Wisconsin
- Texas
*Note: Some lists count 22, others vary slightly depending on how territories and hybrid states are categorized. The District of Columbia, Guam, and American Samoa also fall under federal jurisdiction.*
In these states, you're dealing with federal standards, federal inspectors, and federal penalties. Period.
The 25 State Plan States (and Territories)
These states operate their own OSHA-approved programs covering **both private-sector and state/local government employees.** Each has its own agency, its own inspectors, and — critically — its own standards that may exceed federal requirements.
| State | Administering Agency |
|-------|---------------------|
| Alaska | Alaska Occupational Safety and Health (AKOSH) |
| Arizona | Arizona Division of Occupational Safety and Health (ADOSH) |
| California | Division of Occupational Safety and Health (Cal/OSHA) |
| Hawaii | Hawaii Occupational Safety and Health (HIOSH) |
| Indiana | Indiana Occupational Safety and Health Administration (IOSHA) |
| Iowa | Iowa Division of Labor, IOSH |
| Kentucky | Kentucky Occupational Safety and Health Program (KOSH) |
| Maryland | Maryland Occupational Safety and Health (MOSH) |
| Michigan | Michigan Occupational Safety and Health Administration (MIOSHA) |
| Minnesota | Minnesota Occupational Safety and Health Administration (MNOSHA) |
| Nevada | Nevada Occupational Safety and Health Administration (NV OSHA) |
| New Jersey | New Jersey Public Employee Occupational Safety and Health (PEOSH) / Private covered by federal — *Note: NJ is a hybrid for public employees only* |
| New Mexico | New Mexico Occupational Health and Safety Bureau (NMOHSB) |
| North Carolina | North Carolina Occupational Safety and Health Division (NC OSH) |
| Oregon | Oregon Occupational Safety and Health Division (Oregon OSHA) |
| Puerto Rico | Puerto Rico Occupational Safety and Health Administration (PR OSHA) |
| South Carolina | South Carolina Department of Labor, Licensing and Regulation (SC OSHA) |
| Tennessee | Tennessee Occupational Safety and Health Administration (TOSHA) |
| Utah | Utah Occupational Safety and Health Division (UOSH) |
| Vermont | Vermont Occupational Safety and Health Administration (VOSHA) |
| Virginia | Virginia Occupational Safety and Health Program (VOSH) |
| Washington | Washington Department of Labor and Industries (L&I / WISHA) |
| Wyoming | Wyoming Occupational Health and Safety Department (WY OSHA) |
Plus the U.S. Virgin Islands and the territory plans.
Each of these agencies sets its own inspection priorities, has its own penalty structures (which must meet or exceed federal levels), and can adopt standards that go beyond anything federal OSHA requires.
The 4 Hybrid States: Public Sector Only
Four jurisdictions operate state plans that cover **only state and local government employees.** Private-sector employers in these states fall under federal OSHA:
- **Connecticut** — Connecticut Department of Labor, CONN-OSHA
- **Illinois** — Illinois Department of Labor, Illinois OSHA (ILOSH)
- **New York** — New York Department of Labor, PESH (Public Employee Safety and Health)
- **U.S. Virgin Islands** — Virgin Islands Department of Labor, VIDOSH
If you're a private employer in Connecticut, Illinois, or New York, you answer to federal OSHA. If you're a municipal government, a school district, or a state agency in those jurisdictions, you answer to the state plan.
This distinction matters enormously for contractors who do work for both private and public clients. You could literally be subject to different enforcement agencies depending on the job site.
The States That Will Make You Sweat: Stricter-Than-Federal Deep Dive
"At least as effective" is the floor, not the ceiling. Several state plan states have built entire regulatory frameworks that go well beyond federal standards. If you operate in any of these states, you need to understand exactly how.
California — Cal/OSHA
Cal/OSHA is the gold standard for state-level enforcement — if by "gold standard" you mean the most aggressive, most detailed, and most penalty-heavy program in the country. A few highlights:
- **Heat Illness Prevention (Title 8, Section 3395):** California adopted a comprehensive heat illness prevention standard in 2005 — nearly two decades before federal OSHA finalized its own heat rule. Employers must provide water, shade, training, acclimatization procedures, and emergency response plans when temperatures exceed 80°F. An enhanced set of protections kicks in at 95°F. Federal OSHA still relies on the General Duty Clause for heat-related enforcement.
- **Workplace Violence Prevention (SB 553, effective July 1, 2024):** California now requires virtually all employers to maintain a written Workplace Violence Prevention Plan, maintain a violent incident log, and provide employee training. This goes far beyond any federal standard — federal OSHA has no general industry workplace violence standard.
- **Aerosol Transmissible Diseases (Title 8, Section 5199):** California's ATD standard predates the COVID-19 pandemic and is far more prescriptive than federal OSHA's respiratory protection and bloodborne pathogen standards for healthcare and related industries.
- **Injury and Illness Prevention Program (Title 8, Section 3203):** California requires every employer to have a written IIPP. Federal OSHA has no equivalent general requirement — the federal Safety and Health Program Management Guidelines are voluntary.
- **Penalties:** Cal/OSHA's maximum penalties for willful violations reach $178,625 per violation (2024), exceeding the federal cap.
Michigan — MIOSHA
Michigan's program includes several standards without federal equivalents:
- **Part 74, Firefighting (Construction Safety):** Standards specific to firefighting operations in construction environments.
- **Part 430, Hazardous Work in Laboratories:** Goes beyond the federal Laboratory Standard (29 CFR 1910.1450) in several areas.
- **Ergonomics:** MIOSHA has maintained ergonomic guidelines and enforcement initiatives that outlasted the rescinded federal ergonomics standard (which Congress killed via the Congressional Review Act in 2001).
- **Process Safety Management:** MIOSHA has been notably aggressive in PSM enforcement, particularly after high-profile incidents.
Oregon — Oregon OSHA
Oregon OSHA operates some of the most employee-protective standards in the country:
- **Heat Illness Prevention (OAR 437-002-0156):** Adopted permanent rules in 2022, requiring employers to implement heat illness prevention measures at 80°F with enhanced protections at 90°F. Includes mandatory rest breaks, access to shade and water, acclimatization protocols, and emergency medical plans.
- **Wildfire Smoke (OAR 437-002-1081):** Oregon adopted a permanent wildfire smoke standard in 2022 — the first state to do so. Employers must monitor air quality, provide filtering facepiece respirators at AQI 101, and take additional protective measures as AQI increases. Federal OSHA has no wildfire smoke standard.
- **Agricultural Standards:** Oregon's agricultural worker protections exceed federal standards in areas including field sanitation, housing, and transportation.
- **Penalty Structure:** Oregon can assess penalties up to $70,000 for serious violations and $70,000 for willful violations, but has historically assessed penalties more consistently than many other state plans.
Washington — L&I / WISHA
The Washington Industrial Safety and Health Act (WISHA), administered by the Department of Labor and Industries, is another heavyweight:
- **Ergonomics (WAC 296-62-051):** Washington maintained its ergonomics rule after voters upheld it — one of the only states with a mandatory ergonomics standard.
- **Outdoor Heat Exposure (WAC 296-62-095):** Washington's permanent heat rule, adopted in 2008 and updated in 2023, was one of the first in the nation. Triggers at 80°F for most workers, with enhanced requirements at 90°F and 100°F. Requires drinking water, shade, acclimatization, and training.
- **Wildfire Smoke (WAC 296-62-085):** Like Oregon, Washington adopted a permanent wildfire smoke rule requiring monitoring and respirator provisions when PM2.5 concentrations exceed specified thresholds.
- **Recordkeeping:** Washington's injury and illness reporting timelines differ from federal OSHA's. Employers must report workplace fatalities within 8 hours and inpatient hospitalizations, amputations, or losses of an eye within 24 hours — matching federal requirements — but state-specific reporting forms and processes apply.
- **Penalties:** Washington's penalty structure exceeds federal minimums, and L&I has a reputation for thorough, well-documented inspections.
Multi-State Employer Implications
Here's where most compliance programs fall apart. If you operate in more than one state, you don't get to pick the regulatory regime you prefer. **The rules that apply are determined by the physical location of each worksite.**
That means:
- Your warehouse in Texas follows federal OSHA standards
- Your office in California follows Cal/OSHA standards (including the IIPP, workplace violence prevention plan, and heat illness prevention — even in an office context)
- Your construction crew in Washington follows L&I/WISHA standards
- Your franchise location in New York follows federal OSHA for private employees
You cannot maintain a single national safety program and assume compliance. You can build a *baseline* national program that meets federal standards, but you must then layer state-specific requirements on top for every state plan jurisdiction where you have workers.
Practically speaking, this means:
- **Identify jurisdiction per worksite.** Not per headquarters, not per state of incorporation.
- **Map state-specific standards** that exceed federal for each location.
- **Maintain state-specific written programs** where required (California's IIPP, Workplace Violence Prevention Plan, Heat Illness Prevention Plan — these are all separate written documents).
- **Train to the stricter standard.** If your California employees get heat illness training and your Texas employees don't, you've got a compliance gap in Texas (under the General Duty Clause) and a lawsuit risk everywhere.
- **Report to the correct agency.** Fatality and hospitalization reports go to the state plan agency in state plan states, and to federal OSHA in federal states. Reporting to the wrong agency doesn't count.
Standards That Commonly Differ Between Federal and State Plans
Beyond the state-specific deep dives above, here are the areas where state plan states most frequently diverge from federal OSHA:
| Standard Area | Federal OSHA | Common State Plan Variations |
|---------------|-------------|------------------------------|
| **Heat Illness** | No specific standard (General Duty Clause enforcement) | CA, OR, WA, MN, CO have specific heat standards with defined temperature triggers |
| **Workplace Violence** | No general industry standard | CA requires written WVPP for all employers (SB 553); several states have healthcare-specific requirements |
| **Injury Reporting Timelines** | Fatality: 8 hours; Hospitalization/amputation/eye loss: 24 hours | Some state plans require faster reporting or have additional reportable events |
| **Injury Prevention Programs** | Voluntary guidelines only | CA, HI require written IIPP/safety programs for all employers |
| **Ergonomics** | No standard (rescinded 2001) | WA has mandatory ergonomics rule; CA and OR have enforcement through other mechanisms |
| **Wildfire Smoke** | No standard | OR and WA have permanent wildfire smoke standards |
| **Penalty Amounts** | Set by federal statute, adjusted annually | State plans must meet or exceed; CA penalties significantly exceed federal levels |
| **Right to Know / HazCom** | GHS-aligned HazCom 2012 | Some states have additional notification or posting requirements |
What Protekon Delivers Nationally
This is exactly the kind of jurisdictional complexity that buries small and mid-size businesses. You're not a Fortune 500 company with a team of EHS attorneys in every state. You're running a business — possibly in multiple states — and you need to know what applies to you, right now, without spending 40 hours reading regulatory code.
That's what Protekon does.
**Jurisdiction mapping.** We identify which OSHA authority — federal, state plan, or hybrid — governs each of your worksites. No guesswork, no assumptions.
**Standard-by-standard gap analysis.** We don't just tell you "California is stricter." We show you exactly which standards exceed federal requirements and what your written programs need to include.
**Multi-state compliance programs.** We build your baseline federal program, then layer state-specific requirements for every jurisdiction where you operate. One coherent system, not a pile of contradictory binders.
**Ongoing monitoring.** State plans adopt new standards, update penalty structures, and change enforcement priorities. We track all of it so you don't have to subscribe to 25 different state agency newsletters.
**Audit-ready documentation.** Whether the inspector walking through your door is a federal OSHA compliance officer out of the Dallas area office or a Cal/OSHA inspector from the San Francisco district office, your documentation is current, complete, and jurisdiction-specific.
The bottom line: **compliance is not a Google search. It's a system.** You need to know which rules apply at every location where your people work, and you need written programs that satisfy the strictest applicable standard.
Protekon builds that system for you. Managed compliance, not managed confusion.
---
*Sources: OSHA.gov, "State Plans" (osha.gov/stateplans); 29 USC 667, Section 18 of the OSH Act; California Code of Regulations, Title 8; Oregon Administrative Rules 437-002; Washington Administrative Code 296-62; Michigan Administrative Code, Construction Safety Standards Part 74; Federal Register, Annual Adjustment of Civil Monetary Penalties (2024); OSHA Federal Annual Monitoring and Evaluation Reports (FAME).*
