Under OSHA’s Bloodborne Pathogens Standard at 29 CFR 1910.1030, employers covered by federal recordkeeping rules must maintain a sharps injury log that records every percutaneous injury from a contaminated sharp. OSHA sharps injury log requirements set three mandatory fields for each entry — the type and brand of the device, the department or work area where the injury occurred, and a description of how it happened — and require the log to be kept in a way that protects the injured worker’s identity.1eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens
Who Has to Keep the Log
The log requirement applies only to employers already required to keep injury and illness records under 29 CFR Part 1904.1eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens Two exemptions matter. Employers with ten or fewer employees at all times during the previous calendar year are exempt from routine OSHA recordkeeping, and so are employers in the low-hazard industries listed in Appendix A to Subpart B of Part 1904.2Occupational Safety and Health Administration. 1904 Subpart B Appendix A – Partially Exempt Industries
That produces a result many people in healthcare do not expect: stand-alone doctors’ offices and dentists’ offices are often classified in exempt industries and are not required to keep a sharps injury log.3Occupational Safety and Health Administration. Frequently Asked Questions – Sharps Injury Log Hospitals, outpatient care centers, clinical laboratories, and larger medical facilities generally do not qualify for those exemptions and must maintain the log.
An exemption from the log does not remove the underlying duties in the Bloodborne Pathogens Standard. Exempt employers still have to maintain an Exposure Control Plan, offer hepatitis B vaccinations, and provide post-exposure evaluation and follow-up.
What Each Entry Must Contain
The regulation sets a floor of three fields. Employers can record more, but not less.4eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens – Section: Sharps Injury Log
- The type and brand of device involved. If the injury came from a retractable safety syringe made by a specific manufacturer, that specific product goes in the record. Recurring injuries tied to one product model are the signal the log is designed to surface.
- The department or work area where the injury occurred. A cluster in phlebotomy points to a different problem than injuries scattered across a whole facility.
- A description of how the injury occurred. “Needle stick during disposal” is too thin. “Nurse sustained needle stick while activating safety mechanism on a 22-gauge syringe; mechanism failed to lock” gives a safety committee something to act on.
The description should note whether the device had a safety feature and whether that feature was engaged before the injury. Thin entries are a routine finding during OSHA inspections because they defeat the log’s function as a hazard-identification tool.
Confidentiality
The log must be maintained so that it protects the confidentiality of the injured worker.4eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens – Section: Sharps Injury Log An employer’s internal copy can include names, but any version shared with a safety committee, an employee representative, or an OSHA compliance officer must have personal identifiers removed first.5Occupational Safety and Health Administration. Sharps Injury Logs Are Intended to Track Departments, Devices, and/or Procedures Causing Injuries, Not Injured Employees Names, social security numbers, and anything else that could reasonably identify a specific person have to be redacted.
The log also cannot disclose post-exposure test results or treatment information. A worker who fears that reporting a needle stick will expose their HIV or hepatitis status to coworkers has every reason to stay quiet, and the log stops working.
The Separate OSHA 300 Log Entry
The sharps injury log is a separate document from the OSHA 300 Log, but a contaminated sharps injury has to be recorded on both. Under 29 CFR 1904.8, every work-related needlestick or cut from a sharp object contaminated with another person’s blood or other potentially infectious material is recordable on the OSHA 300 Log.6Occupational Safety and Health Administration. 29 CFR 1904.8 – Recording Criteria for Needlestick and Sharps Injuries A cut from a clean, unused scalpel does not trigger the sharps injury log at all, though it can still be recordable under other criteria if it requires medical treatment.
On the 300 Log, the employee’s name may not appear. The case is entered as a privacy case, with identifying information kept on a separate confidential list.6Occupational Safety and Health Administration. 29 CFR 1904.8 – Recording Criteria for Needlestick and Sharps Injuries Some employers treat the sharps injury log as a substitute for the 300 Log entry. It isn’t. Both are required.
Retention and Access
OSHA’s general recordkeeping rule requires employers to keep the OSHA 300 Log, the annual summary, and related incident report forms for five years after the end of the calendar year they cover.7eCFR. 29 CFR 1904.33 – Retention and Updating Because the sharps log requirement is tied to that framework, the same five-year period applies in practice.
Medical records related to bloodborne pathogen exposures are a different matter. Under 1910.1030(h)(1), those must be kept for the duration of employment plus 30 years. Employers who conflate the two obligations end up discarding records they were required to hold.
Employees, former employees, their personal representatives, and authorized employee representatives can access the OSHA 300 Log, including sharps injury records.8Occupational Safety and Health Administration. 29 CFR 1904.35 – Employee Involvement Department of Labor officials can inspect the records during compliance audits, and employers should be able to produce them within a few business days.
Penalties
Failing to maintain the log, or keeping one that is incomplete, is treated like any other OSHA violation. As of the most recent inflation adjustment effective January 15, 2025, a serious violation carries a maximum penalty of $16,550 per violation. Willful or repeated violations can reach $165,514 per violation.9Occupational Safety and Health Administration. OSHA Penalties These figures are adjusted annually for inflation.
Recordkeeping violations stack. In a single inspection an employer can be cited separately for an incomplete log, a missing log, a failure to record the injury on the OSHA 300 Log, and a failure to maintain privacy protections. An employer that receives a citation has 15 working days from receipt of the notice to file a written intent to contest with the OSHA Area Director.10Occupational Safety and Health Administration. 29 CFR 1903.17 – Employer and Employee Contests Before the Review Commission Missing that window makes the citation and penalty final.
State Plans Can Require More
About half of U.S. states and territories operate their own OSHA-approved occupational safety programs. State plans must be at least as protective as the federal standard, but they can go further. Some states have enacted their own bloodborne pathogen or sharps safety regulations that add more detailed reporting or shorter timelines for evaluating safety devices. If you operate in a state-plan state, check whether your state adds obligations on top of the federal baseline described here before treating this list as complete.