1910.1030 Bloodborne Pathogens: Exposure Plan, PPE, and Penalties

The OSHA 1910.1030 bloodborne pathogens standard requires any employer whose workers can reasonably be expected to contact blood or other infectious materials on the job to maintain a written Exposure Control Plan, supply protective equipment and Hepatitis B vaccinations at no cost, train exposed employees at hire and annually, and provide confidential medical follow-up after exposure incidents. Serious violations carry penalties up to $16,550 per citation, and willful or repeated violations up to $165,514.¹ The rule reaches far beyond hospitals, and most citations trace back to paperwork gaps rather than actual injuries.

Who Is Covered

Coverage depends on what you do, not what your title says. If your normal duties create a foreseeable chance of blood or infectious-material contact through your skin, eyes, mucous membranes, or a needlestick, the standard applies.² Frequency doesn’t matter. Rare exposure still counts if it’s foreseeable.

That’s why the rule covers nurses and phlebotomists alongside paramedics, police officers who handle evidence, correctional staff, embalmers, tattoo artists, funeral home workers, and janitors who clean clinical areas. “Potentially infectious materials” also runs broader than blood alone. It includes semen, vaginal secretions, cerebrospinal fluid, saliva during dental procedures, any body fluid visibly contaminated with blood, any situation where you can’t tell which fluid you’re dealing with, and unfixed human tissue or organs.³

The Written Exposure Control Plan

Every covered employer must have a written Exposure Control Plan. This is the first thing an OSHA inspector will ask to see, and its absence is the single most commonly cited violation of the standard.⁴

The plan must identify every job classification with occupational exposure, list the specific tasks in each of those jobs that create risk, and set out a schedule for how each compliance measure will be implemented.⁵ It also has to describe how exposure incidents will be evaluated when they happen. It must be accessible to workers on every shift.

The plan is not a one-time document. It has to be reviewed and updated at least once a year, and the update must reflect any new or changed tasks, changes in available technology, and the employer’s consideration and adoption of commercially available safer medical devices.⁶

Since the Needlestick Safety and Prevention Act took effect in 2001, employers must also solicit input from non-managerial employees who provide direct patient care about which engineering and work practice controls to use, and document that solicitation in the plan itself.⁷ Skipping that step is a frequent citation target.

Controls, Precautions, and PPE

The standard is built on universal precautions: treat all human blood and potentially infectious materials as if they carry disease. There are no exceptions for patients who look healthy or fluids that seem low-risk.

Engineering controls come first because they remove or isolate the hazard before a worker ever touches it. Self-sheathing needles, needleless IV connectors, and puncture-resistant sharps containers are the standard examples.⁸ Work practice controls fill in around them. Hands get washed with soap and running water immediately after gloves come off; when running water isn’t available, the employer supplies antiseptic cleanser and towels and the worker follows up with soap and water as soon as possible.²

One rule catches workplaces out repeatedly: contaminated needles must never be bent, sheared, or recapped by hand. The only exception is when the employer can show no alternative exists or a specific medical procedure requires recapping, and even then it has to be done with a mechanical device or a one-handed scoop technique.⁹

When controls don’t fully eliminate exposure, the employer must provide personal protective equipment at no cost. Gloves, gowns, lab coats, face shields, eye protection, whatever the task requires.² The employer keeps it clean, repairs or replaces it, and disposes of or launders it after use. Workers should never take contaminated PPE home.

Contaminated sharps go straight into containers that are closable, puncture-resistant, leak-proof on the sides and bottom, and either labeled with the biohazard symbol or color-coded red. Other regulated waste follows the same labeling and containment rules. Contaminated laundry gets bagged at the point of use and never sorted or rinsed there.³

Hepatitis B Vaccination

The employer must offer the Hepatitis B vaccination series, free of charge, to every employee with occupational exposure. The offer has to be made within ten working days of the employee’s initial assignment to a job involving exposure, and the vaccination itself must happen at a reasonable time and place under a licensed healthcare professional’s supervision.¹⁰ The employer pays for the vaccine, its administration, and any related blood tests. No cost passes to the worker.

An employee can decline, but only with a signed statement using the mandatory language in Appendix A of the regulation. That language makes clear the employee understands the ongoing risk and that the vaccine remains available free later if they change their minds.¹¹ Using a generic refusal form instead is a citable violation.

After an Exposure Incident

When an exposure happens, the employer must immediately provide the affected employee with a confidential medical evaluation at no cost. The evaluation starts with documenting how the exposure occurred and identifying the source individual, unless identification isn’t feasible or is prohibited by state or local law.⁹

If the source can be identified, their blood is tested for Hepatitis B and HIV once consent is obtained. Repeat testing isn’t required if the source’s infection status is already known. The exposed employee’s blood is also collected and tested with consent. If the employee agrees to the baseline draw but isn’t ready to consent to HIV testing, the sample must be preserved for at least 90 days so they can opt in later.⁹ The evaluation also covers post-exposure preventive treatment when medically appropriate, counseling, and evaluation of any reported illness.

The evaluating healthcare professional must send the employer a written opinion within fifteen days. That opinion is limited to whether Hepatitis B vaccination is recommended, whether the employee received it, and confirmation that the employee has been told about the results and any needed follow-up. Nothing else about the employee’s medical findings can appear in what goes to the employer.¹²

Training and Recordkeeping

Every employee with occupational exposure must be trained at initial assignment, at least annually after that, and whenever new tasks or procedures change their exposure risk.⁵ The curriculum is prescribed by the regulation: how bloodborne diseases spread and their symptoms, how to recognize biohazard labels and color coding, the specific controls in place at the facility, proper PPE use, and what to do if an exposure incident occurs. The trainer must be knowledgeable in the subject matter, and the session must include an interactive question-and-answer period.

Three separate records must be kept, each with its own retention rule:

A confidential medical record for each exposed employee, kept for the duration of employment plus thirty years. It includes vaccination status, exposure incident documentation, and the healthcare professional’s written opinion.¹³
Training records, kept for three years, showing the date, a summary of the content, the trainer’s name and qualifications, and the names and job titles of attendees.⁹
A sharps injury log recording every percutaneous injury from a contaminated sharp, with the type and brand of device, the department or work area, and a description of how the injury happened. The log must protect the injured worker’s identity.⁶

Medical records can’t be disclosed without the employee’s written consent, except to OSHA or NIOSH during an inspection or to the employee upon request. Failing to keep or provide access to these records can draw separate citations under 29 CFR 1910.1020.

Penalties for Noncompliance

OSHA adjusts its maximums each year for inflation. Under the schedule effective after January 15, 2025, a serious or other-than-serious violation carries a maximum penalty of $16,550 per citation, and a willful or repeated violation reaches $165,514.¹ A single inspection can generate multiple citations, so gaps in the plan, missing training records, and missing vaccination documentation can stack quickly.

OSHA enforcement data show the most-cited provisions are the failure to establish a written Exposure Control Plan, failure to provide training at no cost during working hours, failure to offer Hepatitis B vaccinations within ten days, failure to update the plan annually, and failure to solicit non-managerial employee input on safer devices.⁴ Most are documentation failures rather than actual injuries. The employers who get caught tend to be the ones who wrote a plan once and never went back to it.

1
Occupational Safety and Health Administration. OSHA Penalties
2
Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens
3
Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens
4
Occupational Safety and Health Administration. Bloodborne Pathogens – Enforcement
5
Occupational Safety and Health Administration. OSHA’s Bloodborne Pathogens Standard
6
eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens
7
Occupational Safety and Health Administration. Quick Reference Guide to the Bloodborne Pathogens Standard
8
Occupational Safety and Health Administration. Bloodborne Pathogens and Needlestick Prevention
9
eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens
10
Occupational Safety and Health Administration. Hepatitis B Vaccination Protection
11
Occupational Safety and Health Administration. Hepatitis B Vaccine Declination (Mandatory)
12
Occupational Safety and Health Administration. Bloodborne Pathogen Exposure Incidents
13
Occupational Safety and Health Administration. Employer’s Obligation to Maintain and Transfer Medical Records After the Retainment Period Has Passed