A respiratory protection program, required by OSHA under 29 CFR 1910.134, is the written system an employer must run wherever workers wear respirators: hazard evaluation, respirator selection, medical evaluation, fit testing, training, cartridge change schedules, and program evaluation. Respirators are the last resort, used when engineering controls cannot bring the air below safe limits.
The order matters and plants get it backwards. A worker cannot simply be handed an N95 and sent into a dusty room. Before a tight-fitting respirator ever touches a face, the standard requires a medical evaluation and a fit test, and behind those sits a written program with a named administrator. Skip the sequence and the respirator can give a false sense of protection that is more dangerous than none. This post lays out the required elements and the order they go in, using the standard as the reference. It is educational, not legal advice.
When is a respirator actually required?
Only after engineering controls have been tried and cannot do the job. OSHA 1910.134 is explicit that the primary means of controlling airborne hazards is engineering controls, ventilation, enclosure, substitution, and that respirators are used when those controls are not feasible or while they are being installed. That is the hierarchy of controls again: a respirator does not clean the air, it filters the slice one worker breathes, and only if it fits and is worn correctly. So the first question is never "which respirator," it is "can we ventilate or enclose this instead." When the answer is no, or not yet, the respirator program begins. This is the same logic that puts a PPE program and its equipment at the bottom of the controls hierarchy.
What are the required elements of the program?
OSHA requires a written program with worksite-specific procedures, administered by a trained program administrator. Here are the elements, in the order a worker actually moves through them.
- Written program and administrator. A worksite-specific written program with a named administrator qualified to run it and evaluate its effectiveness.
- Hazard evaluation and respirator selection. Identify and, where possible, measure the airborne hazard, then select a NIOSH-certified respirator adequate for that hazard and its concentration.
- Medical evaluation. Before fit testing or use, a physician or other licensed health care professional determines whether the worker can safely wear a respirator, using at least the standard's medical questionnaire.
- Fit testing. For tight-fitting facepieces, a qualitative or quantitative fit test before first use, whenever the facepiece changes, and at least annually.
- Training and use procedures. Training on why the respirator is needed, its limitations, how to check the seal, and procedures for use in routine and emergency situations.
- Maintenance, cartridge change schedule, and program evaluation. Cleaning, storage, inspection, a change-out schedule for cartridges, and regular evaluation of whether the program is working in the field.
Why must medical evaluation come before fit testing?
Because wearing a respirator is work for the body, and not everyone can do it safely. A tight-fitting respirator adds breathing resistance and heat load, and for a worker with certain heart or lung conditions that stress is itself a hazard. So OSHA requires a physician or other licensed health care professional to clear the worker first, using at least the medical questionnaire in Appendix C, before any fit test or use. Fit testing a worker who is not medically cleared puts the cart before the horse: you would be sealing a mask to the face of someone who may not be able to wear it. The clearance comes first, at no cost to the worker, and it repeats when conditions or health change.
How does respirator fit testing work?
Fit testing proves that a specific make, model, and size of tight-fitting facepiece actually seals to a specific worker's face. It comes in two forms. A qualitative fit test (QLFT) is pass or fail, based on whether the worker can taste or smell a challenge agent such as a bitter or sweet aerosol; it is allowed for half-mask respirators up to a certain protection level. A quantitative fit test (QNFT) uses an instrument to measure actual leakage and produce a numeric fit factor. Either way, a worker must pass a fit test before first use, again whenever the facepiece make, model, style, or size changes, and at least once a year. Facial changes that affect the seal, significant weight change, dental work, scarring, trigger a new test. And a tight-fitting respirator cannot seal over facial hair that crosses the sealing surface, no matter how well it fit clean-shaven.
Whichever method you use, the record is what OSHA checks: the name of the worker, the specific make, model, and size that was tested, the test method used, the date it was performed, and the pass result. An annual fit test that happened but was never written down is, for enforcement purposes, a fit test that did not happen. Keep the fit-test record with the medical clearance, because the two together are what prove a worker is cleared to wear the exact respirator they are wearing today. A worker fit tested on one model but issued a different one on the floor is not actually protected, and the paperwork will not save you: the test has to match the exact make, model, style, and size of the respirator actually in use that day.
What about voluntary respirator use?
Sometimes a worker wants to wear a respirator even though the exposure does not require one. OSHA allows this but does not leave it unmanaged, because even a voluntary respirator can create a hazard, breathing resistance, or trapped heat. For voluntary use of filtering facepieces (dust masks), the employer must at minimum provide the worker the information in Appendix D, which explains safe voluntary use. For voluntary use of any other respirator, the employer must also provide a medical evaluation and ensure the respirator is cleaned, stored, and maintained so it does not itself become a hazard. "It's just a dust mask, wear it if you want" is close to compliant only for true filtering facepieces, and only with Appendix D in hand.
How do you keep the program working?
A respiratory program decays when the paperwork and the floor drift apart: fit tests lapse, cartridges get changed on habit instead of a schedule, and new hires wear last year's assigned model. Tie the program to triggers. Re-fit-test on the annual clock and on any facial change; base the cartridge change-out schedule on objective data, not on when the mask "smells like it's time"; and re-run the medical evaluation when health changes. Route respirator problems, a seal that failed, a cartridge that broke through, into near-miss reporting and let a job safety analysis flag which tasks put airborne hazards above the line in the first place. Dust-heavy tasks that also carry a fire or explosion risk belong in your combustible dust program too, and oxygen-deficient or IDLH atmospheres pull in confined space entry rules with their own respirator requirements.
What do the numbers say?
The standard and its reach, from primary sources:
- The full program requirement, including selection, medical evaluation, and fit testing, is OSHA 29 CFR 1910.134; the mandatory fit-test methods are in Appendix A and the voluntary-use notice is Appendix D.
- Respiratory protection sits consistently among OSHA's most-cited general-industry standards, commonly for a missing written program, no medical evaluation, or no fit testing, per OSHA enforcement data at osha.gov.
- NIOSH certifies the respirators the standard requires and publishes selection guidance; see the NIOSH National Personal Protective Technology Laboratory.
The common thread in those citations is sequence: a respirator in use before the medical evaluation, the fit test, or the written program that is supposed to stand behind it. Get the order right and the rest of the program has something to hold onto.
In practice, respiratory programs live across disconnected records: medical clearances with an outside clinic, fit-test cards in a drawer, cartridge schedules in someone's head, so "is this worker current on both medical and fit for the model they're wearing today" is genuinely hard to answer. Harmony is an AI-native layer that connects machines, software, and paperwork into one operational layer, with no rip-and-replace. Medical-clearance dates, fit-test records, and cartridge schedules become structured, searchable data, and AI search returns cited answers across them, so respirator status is a question you ask, not a drawer you open. It is the everyday shape of connected worker technology and it is not a safety-compliance product. Harmony's digital workflows move those records and handoffs into that structure; the CLS case study shows the pattern. Pair the program with a solid PPE hazard assessment so airborne hazards get caught at the task, where the respirator decision really starts.