Under OSHA’s Bloodborne Pathogens Standard, a source individual is any person, living or dead, whose blood or other potentially infectious materials may have caused a worker’s occupational exposure. The term appears in 29 CFR 1910.1030, and it matters because once an exposure happens, the employer has to identify that person, arrange testing for HIV and hepatitis B with proper consent, share the results with the exposed employee, and pay for everything.1eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens – Section: Definitions The clock starts immediately, and the steps are prescriptive.
Who Counts as a Source Individual
The definition is deliberately wide. It reaches anyone in any setting where a worker might contact blood or infectious materials, not only patients in a hospital. The standard names hospital and clinic patients, trauma victims, residents of nursing homes and hospices, clients in drug treatment and developmental disability facilities, and blood donors as examples.1eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens – Section: Definitions “Living or dead” is part of the language, so human remains and tissue samples qualify. So does an inmate in a correctional facility or a person encountered at an emergency scene.
The individual’s known health status when the incident happens has no bearing on whether they meet the definition. A person who appears perfectly healthy is still a source individual if their blood or infectious material caused the exposure.
Identifying the Source After an Exposure Incident
The employer’s first job after an exposure is to identify and document the source individual.2Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens In practice that means recording the person’s name and gathering enough information to arrange follow-up testing. Hospitals can usually pull this from facility records. Field settings such as emergency response often take more work.
Any relevant medical history regarding known infections should be noted if it’s available at the time. That information goes into the exposure incident report and gives the treating clinician a starting point for assessing the exposed worker’s risk.
When the Source Cannot Be Identified
Identification isn’t always possible. A needlestick from an unmarked syringe in laundry, an unlabeled blood sample, or a state or local law that blocks disclosure can each make identification infeasible.3Occupational Safety and Health Administration. Enforcement Procedures for the Occupational Exposure to Bloodborne Pathogens When that happens, the employer must document in writing why the source could not be identified. The exposed employee still gets a full post-exposure evaluation. The unknown status simply changes how the clinician approaches risk assessment and treatment.
Testing the Source Individual’s Blood
Once the source is identified, their blood must be tested as soon as feasible to determine HBV and HIV infectivity, after informed consent is obtained.2Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens One point catches employers out: the federal standard requires testing only for hepatitis B and HIV. It does not mention hepatitis C. Clinicians commonly add HCV screening as best practice, but that’s clinical judgment, not a regulatory command.
If the source is already known to carry HBV or HIV, the standard doesn’t require repeat testing for that known infection. If the source’s blood is already available for another reason, it must be tested for these pathogens when feasible.
When Consent Is Refused or Not Required
If state law requires consent and the source individual refuses, the employer must document in writing that consent could not be obtained.4Occupational Safety and Health Administration. Most Frequently Asked Questions Concerning the Bloodborne Pathogens Standard Where state or local law does not require consent, and the source’s blood is already available, it must be tested and results documented regardless. State laws vary considerably on when testing can proceed without consent, particularly for deceased individuals and certain emergency situations, so the governing state framework changes what happens next.
What the Exposed Worker Gets
Every medical evaluation, blood test, vaccination, and prophylaxis treatment tied to the exposure must be provided at no cost to the exposed employee.5eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens That includes baseline blood draws, follow-up testing, hepatitis B vaccine, and any post-exposure prophylaxis. The employer also pays for testing the source individual. All services must be available at a reasonable time and place and performed under the supervision of a licensed healthcare professional.
The exposed employee’s blood must be collected as soon as feasible after the incident, with the employee’s consent.2Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens That baseline sample establishes whether the worker already carried HBV or HIV before the exposure, which matters enormously if an infection surfaces later. An employee who consents to the draw but isn’t ready for HIV testing can have the sample preserved for at least 90 days. If the employee decides within that window to have it tested, the employer arranges the test as soon as feasible.
Prophylaxis Timing
Treatment windows after a potential exposure are tight, which is why the standard emphasizes speed. HIV post-exposure prophylaxis must begin within 72 hours of exposure, and every hour of delay reduces effectiveness.6Centers for Disease Control and Prevention. Preventing HIV with PEP For hepatitis B, unvaccinated or incompletely vaccinated workers should receive hepatitis B immune globulin and the vaccine series as soon as possible, preferably within 24 hours.7Centers for Disease Control and Prevention. Responding to HBV Exposures in Health Care Settings
When the source’s status is unknown, clinicians don’t wait for results before starting prophylaxis. Current CDC guidance recommends initiating HIV PEP based on a case-by-case risk assessment and stopping only if the source is later confirmed HIV-negative.8Centers for Disease Control and Prevention. Antiretroviral Postexposure Prophylaxis After Sexual, Injection Drug Use, or Other Nonoccupational Exposure to HIV – CDC Recommendations, United States, 2025 Treat first, confirm later, because the window is narrow.
Sharing Results and Confidentiality
The source individual’s test results must be shared with the exposed employee, because the employee needs that information to make decisions about prophylaxis and monitoring.9eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens At the same time, the employee must be told about all applicable laws governing disclosure of the source’s identity and infectious status. The standard doesn’t create a blanket confidentiality rule of its own, but it requires the worker to understand the federal and state privacy restrictions before receiving the information.
The worker learns what they need for their own medical care and carries a legal responsibility to handle it carefully. Unauthorized disclosure of the source’s identity or health status can trigger liability under privacy statutes. The practical implication for employers is to make sure the healthcare provider walks through those disclosure rules during the post-exposure consultation, and to document that the conversation happened.
The Healthcare Provider’s Written Opinion
The employer must obtain a copy of the evaluating healthcare professional’s written opinion and provide it to the employee within 15 days of the evaluation.9eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens The standard sharply limits what that document can say. It confirms only two things: that the employee was informed of the evaluation results, and that the employee was told about any medical conditions from the exposure that need further evaluation or treatment.
The written opinion does not include the employee’s specific diagnoses, test results, or the source individual’s medical information. The employer receives the bare minimum needed to confirm the required process happened. Everything else stays between the employee and the healthcare provider. It is a compliance document, not a medical report.
OSHA Penalties for Getting It Wrong
Failing to follow the identification, testing, or documentation requirements around a source individual can lead to OSHA citations. A serious violation of the Bloodborne Pathogens Standard carries a maximum penalty of $16,550 per violation.10Occupational Safety and Health Administration. OSHA Penalties Willful or repeated violations reach up to $165,514 per violation. These figures are adjusted annually for inflation, and the current amounts reflect the adjustment effective after January 15, 2025.
Penalties get expensive in multi-instance citations. An employer that fails to document source individuals across several exposure incidents, or lacks an exposure control plan entirely, can face stacked violations rather than a single fine. The most commonly cited bloodborne pathogen violations involve gaps in the exposure control plan, failure to offer hepatitis B vaccination, and incomplete post-exposure follow-up documentation.