The OSHA bloodborne pathogens standard, codified at 29 CFR 1910.1030, requires every employer whose workers face a reasonably anticipated risk of contact with blood or other infectious materials to build a written safety program around that hazard: a documented exposure control plan, engineering controls like safer needles, personal protective equipment at no cost, free Hepatitis B vaccination, initial and annual training, biohazard waste handling, and confidential post-exposure medical care. The rule has been in place since 1991 and was substantially updated in 2000 after Congress passed the Needlestick Safety and Prevention Act.
Who Must Comply
The standard applies to any employer with employees who have “occupational exposure” — reasonably anticipated contact with blood or infectious body fluids through the skin, eyes, mouth, or a puncture wound during job duties.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens Healthcare workers, lab technicians, paramedics, firefighters, funeral service workers, tattoo artists, and housekeeping staff in medical facilities are all common examples.
The reach goes further than most employers assume. A factory supervisor trained to render first aid as a secondary duty counts as having occupational exposure if the employer knows they routinely provide it, even when first aid is not in the job description.2Occupational Safety and Health Administration. Applicability of the Bloodborne Pathogens Standard to Employees Who Render First Aid as a Collateral Duty There is one narrow concession for these “collateral duty” first aiders: failing to offer the Hepatitis B vaccine up front is treated as a de minimis violation and generally not cited, provided the employer offers vaccination and training after any actual exposure.
Covered materials are broader than blood alone. The standard reaches cerebrospinal, synovial, pleural, pericardial, peritoneal, and amniotic fluid, semen, vaginal secretions, saliva in dental procedures, any fluid visibly contaminated with blood, and any situation where the fluid cannot be identified. Unfixed human tissue, HIV and Hepatitis B cultures, and infected research animals are also covered.3eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens When in doubt, treat the material as infectious.
About half the states run their own OSHA-approved plans, which must be at least as protective as the federal rule, so the requirements below apply nationwide.
The Written Exposure Control Plan
The exposure control plan is the operational core of compliance. Every covered employer must maintain one in writing, keep it accessible to employees during their shifts, and review it at least annually.3eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens OSHA inspectors ask to see this document first.
The plan must include an exposure determination that lists every job classification with occupational exposure, broken down by task. This list is built without factoring in whether workers use PPE, because the point is identifying every role where exposure could occur if protections failed.
The plan also spells out how each requirement is carried out at that specific worksite: how vaccinations are offered, how exposure incidents are handled, how contaminated laundry moves through the facility, which engineering controls are in place. The annual review must specifically evaluate whether newer, safer technology has become commercially available for handling contaminated sharps, and it must document the employer’s consideration and implementation of those devices.
Sharps Injury Log
Alongside the exposure control plan, employers must maintain a sharps injury log recording every percutaneous injury from a contaminated sharp. Each entry lists the type and brand of device, the department or work area, and a description of how the incident happened, with the injured worker’s identity protected.3eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens Employers exempt from OSHA’s general injury-and-illness recordkeeping under 29 CFR Part 1904 are also exempt from this log.
Engineering Controls and Safer Sharps
Needlestick injuries drove the 2000 update to the standard. Under the Needlestick Safety and Prevention Act (Public Law 106-430), employers must evaluate, select, and use engineering controls that eliminate or minimize exposure to contaminated sharps.4Occupational Safety and Health Administration. Needlestick Safety and Prevention Act and the Requirement to Include Safety-Engineered Sharps Devices in Pre-Packaged Surgical Kits or Trays That includes retractable needles, self-sheathing scalpels, and needleless IV systems. The obligation applies to every procedure using sharps, including instruments supplied in pre-packaged surgical kits — if a safer alternative exists, the employer must make it available.
The annual plan review must document the employer’s evaluation of new devices. If no safer device exists for a particular procedure, that conclusion must be documented as well.5Occupational Safety and Health Administration. Evaluation of Safer Medical Devices and the Use of Therapeutic Radiopharmaceuticals
Employers must also solicit input from non-managerial, frontline workers who actually use these devices. OSHA does not prescribe a specific method — safety committee meetings, surveys, suggestion boxes, or pilot testing all work — but employees must be made aware the opportunity exists. Workers’ failure to respond is not itself a violation.6Occupational Safety and Health Administration. Solicitation of Non-Managerial Employee Input for the Selection of Sharps Devices
Personal Protective Equipment
Where engineering controls cannot eliminate exposure, the employer must provide appropriate PPE at no cost. The standard lists gloves, gowns, lab coats, face shields, masks, eye protection, and ventilation devices like pocket masks and resuscitation bags, but the list is illustrative rather than exhaustive.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens Equipment counts as “appropriate” only if it keeps blood and infectious material away from the worker’s skin, eyes, mouth, clothing, and undergarments under normal conditions of use.
The employer is responsible for cleaning, laundering, repairing, replacing, and disposing of PPE. Workers cannot be sent home to launder contaminated gear. Damaged or defective equipment must be replaced immediately.7Occupational Safety and Health Administration. General Requirements – 1910.132
Handwashing facilities must be readily accessible. When they aren’t feasible, such as in an ambulance en route to a call, the employer must supply antiseptic hand cleaner with clean towels or antiseptic towelettes as a temporary substitute, and workers must wash with soap and running water at the first opportunity.
Hepatitis B Vaccination
Every worker with occupational exposure must be offered the Hepatitis B vaccine series within 10 working days of initial assignment, at no cost. The offer comes after the employee has received initial bloodborne pathogen training. Employees who have already completed the series, have documented immunity, or have a medical contraindication are exempt.
Workers can decline the vaccine, but the refusal is formal. Anyone declining must sign the specific declination statement mandated by OSHA, which acknowledges the risk and confirms the worker knows they can change their mind and receive the vaccine at no charge later.8Occupational Safety and Health Administration. Hepatitis B Vaccine Declination (Mandatory) The wording of that form is prescribed by federal rule — one of the few places OSHA specifies exact language. An employee who initially declines is entitled to the full series at employer expense any time later during their employment.
All medical evaluations, laboratory tests, and follow-up procedures required by the standard are provided at no cost and must be performed by or under the supervision of a licensed healthcare professional.
Handling and Labeling Biohazardous Waste
Regulated waste — liquid or semi-liquid blood or infectious material, items caked with dried blood that could release it during handling, contaminated sharps, and pathological waste — must go into containers that are closable, leak-proof, labeled or color-coded, and sealed before movement.9Occupational Safety and Health Administration. Disposal of Blood and Other Potentially Infectious Materials Contaminated sharps require puncture-resistant containers that stay upright during use and remain easily accessible.
Labels are fluorescent orange with the biohazard symbol in a contrasting color. Inner containers inside a properly labeled outer container don’t need separate labels.
Training: Content, Timing, and Records
Training must happen at initial assignment to a task with potential exposure, and at least annually after that. Additional training is required before any duty change that creates new exposure. All training is provided during working hours at no cost.
Required topics include:
- A general explanation of bloodborne diseases, their symptoms, and how they transmit at work.
- The employer’s specific exposure control plan and how employees can obtain a copy.
- How to recognize tasks that involve potential exposure.
- Use and limitations of engineering controls, work practices, and PPE, including selection, donning, doffing, and decontamination.
- Hepatitis B vaccine information, including efficacy, safety, and its no-cost availability.
- What to do after an exposure incident, who to contact, and the follow-up the employer must provide.
- The meaning of biohazard labels, color-coding, and other markings used at the facility.
Training must be tailored to the literacy level and language of the attendees and must address the actual hazards at that worksite rather than delivering generic content. Sessions must be interactive: workers need a live opportunity to ask questions of someone knowledgeable about the material as it applies to their duties. A video played without a knowledgeable person available does not satisfy the standard. OSHA does not require the trainer to hold a specific credential — the test is whether they can answer real questions about the workers’ actual duties.
Training records must include the session date, a summary of the content, the trainers’ names and qualifications, and the names and job titles of everyone who attended. These records are kept for three years from the session date.
Responding to an Exposure Incident
Speed matters after an exposure. The worker reports the incident to the employer as soon as possible, which triggers a confidential medical evaluation and follow-up at no cost. Prompt reporting matters because post-exposure prophylaxis works best when started quickly.
The employer documents the route of exposure and the circumstances, and identifies the source individual when feasible. The source individual’s blood is tested — with consent where law requires it — and the results are shared with the exposed worker. If the source is already known to be infected, repeat testing isn’t needed.
The employer must give the evaluating healthcare professional a copy of 29 CFR 1910.1030, a description of the exposed worker’s relevant duties, documentation of the route and circumstances of exposure, and the worker’s Hepatitis B vaccination status and relevant medical records. The employee receives a copy of the healthcare professional’s written opinion within 15 days of the evaluation.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens That written opinion is deliberately limited: it tells the employer whether vaccination was recommended and whether the worker received it, and nothing more about the worker’s medical findings.
Temporary Workers and Multi-Employer Sites
When a staffing agency places a temporary worker at a host facility, both employers share compliance responsibility. Neither can fully offload its duties by contract.10Occupational Safety and Health Administration. Temporary Worker Initiative Bulletin No. 6 – Bloodborne Pathogens Duties usually divide this way:
- The staffing agency handles generic bloodborne pathogen training, offers the Hepatitis B vaccine, provides post-exposure medical evaluation and follow-up, and keeps medical and training records.
- The host employer provides site-specific training equivalent to what its own employees receive, supplies PPE, maintains engineering controls and safe work practices on site, and confirms with the agency that vaccinations and recordkeeping are in order.
The host cannot assume the agency handled everything. OSHA expects reasonable verification, especially on vaccination and post-exposure follow-up. If an exposure happens at the host site, both employers must coordinate quickly so the worker gets required medical care without delay.
Recordkeeping Timelines
The standard imposes two very different retention periods, and mixing them up is a common mistake.
Training records are kept for three years from the session date. Medical records — vaccination records, exposure incident documentation, and post-exposure evaluations — must be maintained for the duration of employment plus 30 years.3eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens The long retention exists because diseases like Hepatitis C can take decades to present, and workers may need their exposure history long after leaving. Medical records are confidential and cannot be disclosed without written employee consent, except as law requires.
Both categories must be made available to employees, their representatives, and OSHA on request.
Penalties for Noncompliance
OSHA adjusts penalty amounts each January for inflation. As of January 2025, a serious violation of the bloodborne pathogens standard carries a maximum penalty of $16,550, and a willful or repeated violation can reach $165,514.11Occupational Safety and Health Administration. OSHA Penalties Those figures will be revised again in January 2026.
A single inspection often produces multiple citations — no written plan, missing training records, no vaccine documentation, mislabeled waste containers — and each is cited separately. Actual fines take account of employer size, good faith, and violation history, but the exposure adds up quickly when systemic gaps are found in one visit.