What Is an Exposure Incident? OSHA Reporting and PEP Timelines

Under federal workplace safety rules, an exposure incident is a specific event: contact between an employee’s eyes, mouth, other mucous membrane, non-intact skin, or a puncture through the skin and blood or other potentially infectious materials, occurring while the employee is performing job duties. The definition sits in 29 CFR 1910.1030, and once an incident meets it, a set of employer obligations kicks in automatically: confidential medical evaluation, source testing where feasible, post-exposure prophylaxis when indicated, written follow-up, and formal recordkeeping, all at no cost to the worker.¹

What Qualifies and What Doesn’t

Two things have to line up for an event to count: the material and the route of contact.

The materials covered are human blood, blood components, blood products, and a category the regulation calls “other potentially infectious materials” (OPIM). OPIM includes semen, vaginal secretions, cerebrospinal fluid, synovial fluid, pleural fluid, pericardial fluid, peritoneal fluid, amniotic fluid, saliva during dental procedures, any body fluid visibly contaminated with blood, and all body fluids in situations where you can’t tell them apart.¹

The route of contact must be one of these: a mucous membrane (eyes, mouth, nose), skin that is already compromised by dermatitis, hangnails, abrasions, or open cuts, or a puncture through the skin from a contaminated needlestick, human bite, or sharp instrument.¹

A splash of blood onto intact, healthy skin generally does not meet the definition. A splash to the eyes or mouth does, because those are mucous membranes regardless of the skin around them. And the incident has to happen in the course of work duties for the bloodborne pathogens standard to apply.

The First Few Minutes

Before anything else, take care of the site of contact:

For a needlestick or cut, wash the site with soap and water.
For a splash to the nose, mouth, or skin, flush with water.
For a splash to the eyes, irrigate with clean water, saline, or sterile irrigants.

These are the CDC’s recommended immediate steps.² Skip the bleach, alcohol, and harsh antiseptics; the point is to flush the contaminant out, not to sterilize the wound. Then report the incident so the medical evaluation can start.

Reporting to Your Employer

Report to your supervisor or designated safety officer immediately. Speed matters because some post-exposure treatments lose effectiveness within hours. Your employer should have an exposure control plan, a written document naming who to contact and what happens next; if you have never seen it, ask, because the plan is required to be accessible to every employee with potential occupational exposure.³

When you report, be specific: which body fluid was involved, how it reached you, which part of your body was affected, and what protective equipment you were wearing. Those details drive the medical evaluation and risk assessment.

What Your Employer Must Provide After You Report

Once you report, federal law triggers non-negotiable obligations. Your employer must make a confidential medical evaluation and follow-up available to you immediately, at no cost, at a reasonable time and place, performed by a licensed physician or other licensed healthcare professional.⁴ “No cost” is literal: no bill for the evaluation, blood tests, prophylaxis, or follow-up.

The employer must give the evaluating provider a copy of the bloodborne pathogens regulation and a description of your job duties as they relate to the exposure, along with your relevant medical records, including your Hepatitis B vaccination status and any prior exposure records.¹

The medical evaluation itself documents the route of exposure and the circumstances: the task you were performing, the equipment in use, how the breach occurred.⁵

Within 15 days of the evaluation’s completion, your employer must give you a written copy of the healthcare professional’s opinion, confirming that you were told the results and informed of any conditions needing further attention.¹

Testing the Source Individual

The employer must identify the person whose blood or body fluid was involved unless doing so is genuinely infeasible or prohibited by state or local law. That person’s blood should be tested as soon as feasible, with consent, for Hepatitis B and HIV. If the source individual is already known to be infected, repeat testing isn’t required. If consent is refused, the employer must document that consent could not be obtained; some jurisdictions allow testing without consent. The results, and any laws governing disclosure of the source individual’s identity and status, must be shared with you.¹

The regulation’s text doesn’t explicitly name Hepatitis C, but current CDC guidance recommends HCV testing as part of post-exposure follow-up, including baseline testing and follow-up at three to six weeks and again at four to six months after exposure.⁶ A competent post-exposure evaluation will include it.

Why Speed Matters: Prophylaxis Timelines

Post-exposure prophylaxis (PEP) for HIV is most effective when started as soon as possible after exposure, with an outer limit of 72 hours. The 2025 U.S. Public Health Service guidelines call for initiating PEP as quickly as possible, with every hour of delay reducing the likelihood of preventing infection; ideally the first dose is taken within 24 hours.⁷

For Hepatitis B, an unvaccinated worker exposed to a source who is HBsAg-positive should receive both Hepatitis B immune globulin (HBIG) and the first dose of the vaccine series as soon as possible, preferably within 24 hours. When the source’s HBV status is unknown, the vaccine series should still begin immediately.⁸

There is no approved post-exposure prophylaxis for Hepatitis C. The CDC does not recommend preventive antiviral therapy for HCV exposures; the approach relies on the testing timeline above so that treatment can begin quickly if an infection develops.⁶

What Has to Be Documented

Every work-related needlestick or cut from a sharp object contaminated with another person’s blood or OPIM must be recorded on the OSHA 300 Log as an injury, regardless of whether the worker develops an illness afterward.⁹ The contaminated sharps injury itself is the recordable event; you don’t wait to see if illness develops. To protect privacy, the employee’s name may not appear on the 300 Log for these entries. The entry must be made within seven calendar days of the employer learning about the incident.¹⁰

Employers who maintain injury and illness records must also keep a separate sharps injury log recording the type and brand of device involved (if known), the department or work area, and how the incident happened, with the injured worker’s identity protected.¹¹ The point of this log is pattern detection: if one device or department keeps appearing, that’s a signal to re-evaluate controls.¹²

Each recordable incident also requires a completed OSHA Form 301, the Incident Report, capturing what the employee was doing, how the incident occurred, which body part was affected, and what object or substance was involved.¹³

Post-exposure medical records must be preserved for the duration of the employee’s employment plus 30 years under 29 CFR 1910.1020.¹⁴ The long retention period exists because some bloodborne infections can remain dormant for years, and the original record may be the link that establishes an illness as work-related. You have the right to access your own exposure and medical records; if you leave a job where you had an exposure incident, consider requesting copies before you go.

Penalties and Retaliation Protection

Employers who fail to provide the required services face OSHA penalties. As of the adjustment effective January 2025, a serious violation can draw a fine of up to $16,550 per violation, and willful or repeated violations can reach $165,514 per violation, with annual inflation adjustments after that.¹⁵

Federal law also prohibits an employer from firing, disciplining, demoting, or otherwise retaliating against an employee for reporting an exposure incident or filing a safety complaint. Section 11(c) of the Occupational Safety and Health Act makes it illegal to discriminate against any employee who exercises rights under the Act, files a complaint, or participates in a related proceeding.¹⁶ Protected activity includes internal safety reports, participation in inspections, and requests for access to exposure records, not only formal OSHA complaints.

If you believe you have been retaliated against, you have 30 days from the adverse action to file a complaint with OSHA. That deadline is strict; note it now, before you might need it. Section 11(c) covers private-sector employees and U.S. Postal Service employees. State and local government workers are generally not covered under this specific provision, though many states have parallel whistleblower protections under their own occupational safety laws.

1
eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens
2
Centers for Disease Control and Prevention. Best Practices for Occupational Exposure to Blood
3
Occupational Safety and Health Administration. Most Frequently Asked Questions Concerning the Bloodborne Pathogens Standard
4
Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens – Section: 1910.1030(f)
5
Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens – Section: 1910.1030(f)(3)
6
Centers for Disease Control and Prevention. Guidelines for Health Care Personnel Exposed to Hepatitis C Virus
7
National Library of Medicine. 2025 US Public Health Service Guidelines for the Management of Occupational Exposures to HIV
8
Centers for Disease Control and Prevention. Responding to HBV Exposures in Health Care Settings
9
Occupational Safety and Health Administration. 29 CFR 1904.8 – Recording Criteria for Needlestick and Sharps Injuries
10
eCFR. 29 CFR 1904.29 – Forms
11
Occupational Safety and Health Administration. Quick Reference Guide to the Bloodborne Pathogens Standard
12
Occupational Safety and Health Administration. Employee Access to Needlestick and Contaminated Sharps Injury Log Requirements
13
Occupational Safety and Health Administration. OSHA Forms for Recording Work-Related Injuries and Illnesses
14
Occupational Safety and Health Administration. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
15
Occupational Safety and Health Administration. OSHA Penalties
16
Office of the Law Revision Counsel. 29 USC 660 – Judicial Review