OSHA Bloodborne Pathogens: Engineering and Work Practice Controls

Under OSHA’s Bloodborne Pathogens Standard, engineering and work practice controls are the two required primary methods for protecting workers from exposure to blood and other potentially infectious materials. Engineering controls are physical devices that isolate or remove the hazard, such as sharps disposal containers, needleless systems, and safety-engineered needles. Work practice controls are behavioral rules that change how tasks are performed, such as handwashing after glove removal, the ban on recapping needles by hand, and written cleaning schedules. The standard, at 29 CFR 1910.1030, applies to every employer with even one worker who could reasonably contact human blood on the job.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens

Why Engineering and Work Practice Controls Come First

The standard sets a clear order. Engineering controls are the first line of defense because they don’t depend on a worker remembering a procedure in a stressful moment. The device itself prevents the exposure. Work practice controls sit next, because behavior can be trained and enforced. Personal protective equipment is the last layer, meant to catch what the first two miss.

Both categories operate on the principle of universal precautions: every sample of human blood or body fluid is treated as if it is infectious. When it’s difficult or impossible to tell whether a fluid is blood, saliva, or something else, workers must treat it as potentially infectious material. The regulation makes this a binding obligation, not a suggestion.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens Universal precautions eliminate the dangerous assumption that a patient with no known diagnosis or clean-looking blood poses no risk, and every control below is built on that assumption.

Engineering Controls the Standard Requires

Engineering controls are physical devices that remove workers from contact with the hazard. Three categories drive most compliance work.

Sharps Disposal Containers

Sharps containers must be puncture-resistant, leakproof on the sides and bottom, and labeled or color-coded with the biohazard symbol.2eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens They must stay upright during use and be replaced routinely so they never become overfilled. When a container is moved, it must be closed immediately before removal. If leakage during transport is possible, the container goes inside a second one that is also closable, leakproof, and labeled.

Placement is part of the control. Containers must be readily accessible and located as close as feasible to the area where sharps are used.3Occupational Safety and Health Administration. Protecting Yourself When Handling Contaminated Sharps In pediatric or psychiatric settings, containers may be placed on mobile carts to keep them out of patients’ reach while still keeping them accessible to workers. Containers must also be available in laundries and any other area where sharps might turn up unexpectedly.

Needleless Systems

Needleless systems deliver fluids through connectors or ports that eliminate the conventional needle altogether. Where the standard once tolerated needle use as unavoidable, needleless technology is now the default expectation for many procedures. Employers must integrate these systems into their supply chain whenever commercially available options exist.4Occupational Safety and Health Administration. Needlestick Safety and Prevention Act and the Requirement to Include Safety-Engineered Sharps Devices in Pre-Packaged Surgical Kits or Trays

Sharps With Engineered Sharps Injury Protections

When a needle is unavoidable, the device must have a built-in safety feature: a self-sheathing needle, a retractable tip, or a blunting mechanism that covers the sharp point after use. The safety mechanism has to be an integral part of the device rather than an external add-on, because a separate piece is too easy to skip under time pressure.4Occupational Safety and Health Administration. Needlestick Safety and Prevention Act and the Requirement to Include Safety-Engineered Sharps Devices in Pre-Packaged Surgical Kits or Trays

Work Practice Controls the Standard Requires

Work practice controls change how people perform tasks to reduce exposure. Even the best engineering control fails if workers routinely bypass it, which is why the two categories are inseparable.

Handwashing and Hygiene Restrictions

Handwashing is the single most emphasized work practice. Workers must wash their hands with soap and water immediately after removing gloves or other protective equipment. If skin contact with blood occurs, the affected area must be washed as soon as possible.5eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens When soap and water aren’t immediately available, an antiseptic hand cleanser or antiseptic towelettes can serve as a temporary measure, but a full wash must follow as soon as feasible.

The standard also bans eating, drinking, smoking, handling contact lenses, and applying cosmetics or lip balm in work areas where exposure to blood or infectious materials is possible.5eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens Food and drinks cannot be stored in refrigerators, freezers, cabinets, or on countertops where blood or infectious materials are kept. Hand-to-mouth contact is one of the easiest ways a pathogen gets from a contaminated surface into the body.

Handling Contaminated Needles

Recapping, bending, or removing contaminated needles is prohibited unless the employer can show no feasible alternative exists or a specific medical procedure requires it. In those limited situations, the worker must use a one-handed scoop technique or a mechanical recapping device. Never two hands.2eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens Shearing or breaking contaminated needles is flatly banned with no exceptions. These are the rules inspectors look at first during a compliance visit, because they map directly onto needlestick injury data.

Contaminated Laundry and Equipment

Contaminated laundry must be handled as little as possible and bagged or containerized right where it was used. No sorting, no rinsing at the point of use. Equipment contaminated with blood must be examined and decontaminated before servicing or shipping. When full decontamination isn’t feasible, a prominent label must identify which portions remain contaminated so downstream workers know the risk before they touch it.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens

Written Housekeeping and Decontamination Schedules

Employers must create and follow a written cleaning schedule that spells out how and when work surfaces, equipment, and floors will be decontaminated. The schedule has to account for the specific location, the type of surface, the type of contamination present, and the procedures being performed in that area.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens A blanket “wipe down everything at the end of the shift” policy doesn’t satisfy the standard. A phlebotomy station where blood draws happen all day needs a different schedule than an adjacent break room.

Regulated Waste

Work practice controls extend to how contaminated waste leaves the work area. The standard defines regulated waste broadly enough to catch items that don’t look obviously bloody:

  • Liquid or semi-liquid blood and other potentially infectious materials
  • Items that would release blood in a liquid or semi-liquid state if compressed
  • Items caked with dried blood capable of releasing it during handling
  • Contaminated sharps
  • Pathological and microbiological wastes containing blood or infectious materials

All regulated waste must go into closable, leakproof, labeled containers and be disposed of according to applicable federal, state, and local regulations.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens If the outside of a waste container becomes contaminated, it must be placed inside a second container that meets the same standards.

Annual Review of Engineering Controls

Engineering controls are not selected once and left alone. The Needlestick Safety and Prevention Act, signed into law in November 2000, added a requirement that many employers still trip over: an annual review of engineering controls.4Occupational Safety and Health Administration. Needlestick Safety and Prevention Act and the Requirement to Include Safety-Engineered Sharps Devices in Pre-Packaged Surgical Kits or Trays Each year, employers must evaluate whether newer, more effective devices have become available that could further reduce needlestick injuries and other sharps exposures. The review must be documented in the employer’s records.

Getting input from the people who actually use the equipment is part of the requirement. Employers must solicit feedback from non-managerial employees responsible for direct patient care who are exposed to sharps injuries. Those frontline workers participate in identifying, evaluating, and selecting safer devices, and the employer must document that solicitation in the Exposure Control Plan.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens Failing to document employee involvement is one of the more common citations during inspections.

OSHA does not require employers to run formal clinical efficacy trials on new devices. Less formal evaluations, such as product trials that gather user feedback, are enough to satisfy the standard. The final device selection should account for the clinical environment, the procedures being performed, the patient population, cost-effectiveness, and the preferences of the workers who will use the devices daily.6Association for Professionals in Infection Control and Epidemiology (APIC). Evaluating Sharps Safety Devices: Meeting OSHA’s Intent

Where Controls Live in the Exposure Control Plan

Both engineering and work practice controls must be documented in the employer’s written Exposure Control Plan, which is the first thing an OSHA inspector asks to see. The plan must include an exposure determination listing all job classifications with occupational exposure, procedures for evaluating exposure incidents, documentation of the annual device review, and proof that non-managerial frontline workers participated in selecting controls.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens The plan must be reviewed and updated at least annually and made accessible to all employees. OSHA publishes a Model Exposure Control Plan for smaller employers who don’t want to build one from scratch.7Occupational Safety and Health Administration. Model Exposure Control Plan

Data from the required sharps injury log feeds directly into the annual device review. Each log entry records the type and brand of device involved, the work area where the injury occurred, and a description of the incident, and the log must be retained for five years following the end of the calendar year it covers.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens Over time, patterns in the log reveal which devices are failing and which procedures generate the most injuries, which is what makes the annual review meaningful rather than a paper exercise.

Penalties for Missing Controls

OSHA can cite employers for violations of any provision of the standard, and the fines are substantial. As of January 2025, the maximum penalty for a serious violation is $16,550 per violation. Willful or repeated violations carry a maximum of $165,514 per violation, and failure to correct a cited violation can result in penalties of $16,550 per day beyond the abatement deadline.8Occupational Safety and Health Administration. OSHA Penalties These maximums are adjusted annually for inflation. Common bloodborne-pathogen citations include missing or outdated Exposure Control Plans, failure to document employee input in device selection, and sharps containers that are overfilled or inaccessible, all of which trace back to engineering and work practice control requirements.