CPR training documentation requirements for OSHA compliance

Last updated 2026-07-10

What does OSHA actually require for CPR training documentation?

OSHA's general industry standard at 29 CFR 1910.151(b) says that "in the absence of an infirmary, clinic, or hospital in near proximity to the workplace, a person or persons shall be adequately trained to render first aid." ^[1] CPR is understood to be part of first-aid training. What the standard does not do is prescribe what your documentation must look like, which frustrates a lot of small business owners who want a checklist.

That ambiguity is on purpose. OSHA sets the performance requirement (someone trained must be present) and leaves the paperwork mechanics to the employer. In practice, a compliance officer inspecting your site looks for evidence that the training happened, that the content was appropriate, that the trainer was qualified, and that certifications are current. Can't show that evidence? You're exposed.

OSHA letters of interpretation have clarified the first-aid obligation repeatedly. A 2002 letter confirmed that employers must assess whether the workplace is in "near proximity" to a hospital or clinic and, if it isn't, provide trained personnel on every shift. ^[2] That shift-coverage requirement has direct documentation consequences. You need records showing trained people were scheduled and present, not proof that someone somewhere in the company once took a class years ago.

For construction, the standard is 29 CFR 1926.50, which mirrors the general industry language but requires at least one person per worksite to hold a valid first-aid and CPR certificate. ^[3] Maritime, agriculture, and healthcare carry their own parallel requirements, all of which demand documentation you can produce on request.

Which OSHA standards reference CPR or first-aid training records?

Several CFR sections touch CPR documentation, and it matters which ones apply to your operation. The bloodborne pathogens rule is the strictest most small employers will meet.

Standard	Industry	Key Requirement
29 CFR 1910.151	General Industry	Trained first-aid person when no nearby medical facility
29 CFR 1926.50	Construction	Valid certificate for each worksite, every shift
29 CFR 1910.269	Electric Power Generation	First aid and CPR training with documented refresher intervals
29 CFR 1910.410	Commercial Diving	CPR competency before dive operations
29 CFR 1910.120	HAZWOPER / Emergency Response	CPR included in required 24-hour or 40-hour training blocks
29 CFR 1910.1030	Bloodborne Pathogens	Training records with dates, content, and trainer credentials

The bloodborne pathogens standard at 1910.1030(h)(2) is the most detailed documentation requirement most general-industry employers will ever meet. It requires training records to include the date of each session, the contents or a summary of the training, the names and qualifications of the trainer, and the names and job titles of attendees. ^[4] If your employees could face exposure to blood or other potentially infectious materials, and CPR-trained employees are among them, this standard controls your record format.

HAZWOPER under 1910.120 is similarly specific. Trained emergency responders need records showing curriculum hours completed, trainer qualifications, and competency verification. CPR is embedded in the required first-responder operational training block. ^[11]

For electrical workers under 1910.269, OSHA requires employees who work on or near exposed energized parts to be trained in first aid including CPR, and employers must document that training and run refreshers. The standard gives no hard interval, but OSHA's enforcement posture and the American Heart Association's guidance both treat two years as the outer limit for CPR skill maintenance without a refresher. ^[5]

What information must a CPR training record actually contain?

Build your record to satisfy the most demanding OSHA standard that applies to you, and every other standard is covered. The bloodborne pathogens rule at 1910.1030(h)(2) gives you the clearest template, and it's a fair floor for everyone.

A complete CPR training record should include:

1. Employee full name and job title 2. Date of training (the actual class date, not the cert card issue date) 3. Training content summary or syllabus reference (for example, "AHA Heartsaver CPR/AED, 2020 Guidelines") 4. Trainer name and credentials (BLS instructor certification number if applicable) 5. Training organization (American Heart Association, American Red Cross, ASHI, and so on) 6. Duration of training in hours or minutes 7. Certification or card number if issued 8. Expiration or recertification due date 9. Whether an AED component was included 10. Supervisor or HR signature confirming receipt of record

That last item is optional but worth adding. An inspector who sees a signed acknowledgment has more confidence the record is contemporaneous rather than reconstructed after the fact.

Here's what trips up small employers: the cert card itself is not a training record. Cards get lost, and they don't carry the content summary OSHA wants. Keep a separate internal record that mirrors the card data plus the content and trainer details. The card is the employee's personal proof of competency. Your internal record is your compliance evidence.

If you use an outside training vendor, ask for a class roster with every required field filled in. Most AHA and Red Cross authorized training centers provide this automatically. Confirm it before the class rather than trying to recover it months later.

How long do you have to keep CPR training records?

It depends on which standard applies, and the answers vary more than most people expect. Under 29 CFR 1910.1030 (bloodborne pathogens), training records must be kept for the duration of employment plus three years. ^[4] That's the longest explicit retention requirement in the general-industry first-aid space.

For HAZWOPER under 1910.120, OSHA does not specify a minimum retention period for training records. Its recordkeeping standard at 1910.1020 covers employee exposure and medical records, and it requires certain occupational exposure records to be kept 30 years. Many compliance attorneys advise keeping HAZWOPER training documentation for employment duration plus 30 years, because exposure is tied to trained responders.

For construction under 1926.50, no explicit retention period appears in the standard. General OSHA construction recordkeeping rules under 29 CFR 1904 require injury and illness records to be kept five years, and good practice is to match training records to that window at minimum.

For everyone else (general industry, 1910.151, no bloodborne pathogen exposure), three years from the date of training is the conventional safe harbor. No federal standard requires less. Some state plans set longer periods. California's Cal/OSHA has training-record retention requirements that run three years from the training date regardless of employment status. ^[6]

My advice: keep all CPR training records for employment duration plus three years, full stop. Storage is cheap. Reconstructing records during an inspection is expensive, stressful, and rarely convincing.

How often does CPR training need to be renewed to stay compliant?

Most OSHA standards don't state a renewal interval with precision, which creates real confusion. The practical answer for almost everyone is two years, because that's how long the certifying bodies say their cards last.

29 CFR 1910.269 (electrical work) requires periodic retraining but leaves the interval undefined. OSHA enforcement guidance and the NFPA 70E standard both treat two years as the expected maximum gap between CPR refreshers for electrical workers. ^[7]

The American Heart Association's Basic Life Support (BLS) certification is valid for two years. The Heartsaver CPR/AED course, the most common non-healthcare workplace cert, is also valid for two years. ^[5] Red Cross First Aid/CPR/AED certifications run two years as well. When OSHA compliance officers check whether training is "current," they're almost always benchmarking against the certifying organization's own validity window.

For bloodborne pathogens (1910.1030), OSHA requires annual training on top of initial training. That annual session should include or reference CPR skills for employees who may need to respond to an exposure incident. ^[4]

Design your CPR recertification program around a two-year cycle. Document the renewal the same way you document the initial training. Flag expiration dates in your HR or scheduling system at least 60 days out so you're not scrambling. Letting a trained employee's cert lapse on a shift where they're the designated first-aid person is an immediate citation risk if something goes wrong.

What happens if OSHA finds your CPR training records are missing or incomplete?

Missing or incomplete training documentation is one of the more common general-industry citations, and the penalties are real. For 2024, OSHA's maximum penalty for a serious violation is $16,131 per violation. ^[8] Willful or repeated violations can reach $161,323 per violation.

A failure to maintain bloodborne pathogens training records (1910.1030) is typically cited as serious, because the underlying hazard (bloodborne disease transmission) is recognized and the fix (keeping a record) is simple.

Now the harder scenario. A worker suffers a cardiac arrest and dies, OSHA investigates, and the agency finds you had no documented trained first-aid responder on that shift. The citation risk multiplies. You're looking at a potential willful violation if the employer knew the standard and failed to comply. That can go beyond fines to referral for criminal prosecution under Section 17(e) of the OSH Act in cases involving a fatality.

Documentation gaps also hit your workers' compensation position and civil liability exposure. In a wrongful death suit, a plaintiff's attorney asks for your CPR training records on day one of discovery. "We had training but didn't document it" is not a defense that holds up.

One grace note: OSHA does give employers a chance to correct paperwork-only violations during an inspection, as opposed to actual hazard corrections. If your people are trained but the records are a mess, an inspector may issue an other-than-serious citation and give you time to clean up. Don't count on that mercy. But it does happen.

Does OSHA require AED training documentation alongside CPR?

Not explicitly at the federal level. The practical answer is still yes, document it. OSHA has no standalone AED training standard in the CFR. The agency has encouraged AED programs and noted in letters of interpretation that an AED without trained users defeats its own purpose, but no CFR section requires AED training specifically. ^[2]

Many states have passed laws requiring AED training for certain facilities, including schools, fitness centers, and large public venues. If you operate in one of those environments, your state law or state plan may impose documentation requirements that go beyond federal OSHA. Check your specific state's AED law and your state OSHA plan if your state has one.

From a liability standpoint, treating AED competency the same as CPR competency in your documentation is straightforward and defensible. If your Heartsaver or BLS course included AED, note that in the training content field of your record. It takes five seconds to write and it closes a gap that could matter in a post-incident review.

The American Heart Association's 2020 guidelines make the point that CPR and AED use are effectively inseparable in the out-of-hospital cardiac arrest chain of survival. ^[5] Document CPR and ignore the AED component, and you've documented half a skill.

Do the documentation rules differ for small businesses under OSHA's small employer exemptions?

OSHA's small-employer exemptions cover injury and illness logs (the 300 log), not training records. This is one of the most common misunderstandings I see.

Employers with 10 or fewer employees in low-hazard industries are exempt from keeping OSHA 300/300A injury logs under 29 CFR 1904.1. ^[9] That exemption says nothing about training documentation. The 1910.151 first-aid obligation and the 1910.1030 bloodborne pathogens training records obligation apply regardless of company size, as long as the underlying hazard exists at your workplace.

So if you have three employees and you work with patients or sharps (dental office, home health, tattoo studio), you still owe annual bloodborne pathogens training with the full documentation package. Five employees and your workplace sits more than four minutes by ambulance from a hospital? You still need a trained first-aid person on each shift and records to prove it.

Small businesses are partly insulated from inspection through OSHA's programmed inspection priorities, which target higher-hazard industries. But if there's an incident, the agency inspects regardless of your size. The absence of training records is just as visible in a two-person shop as in a two-hundred-person facility.

Building a first OSHA training program from scratch? Keeping CPR documentation is not a burden. A simple spreadsheet with the fields above, backed by scanned cert cards, satisfies the standard for most general-industry employers.

How should you store and organize CPR training records to pass an inspection?

A compliance officer who asks for first-aid training records wants them fast. A calm, organized response signals a working safety program. A panicked hunt through filing cabinets signals the opposite.

The most practical system for a small business starts with a master training log. Use a spreadsheet or whatever your HR system allows, one row per training event, with all the fields listed in the documentation section above. Sort it by employee name and cert expiration date so you can answer "who's expiring in the next 90 days" in about 15 seconds.

Scan or photograph each employee's physical cert card and attach it to their personnel file or your safety training file. Cards fade, get lost, and end up in the laundry. A digital copy is cheap insurance.

For bloodborne pathogens specifically, keep the training records separate from general HR files if you can. The 1910.1030 rule treats these as a distinct category with its own retention clock, and mixing them with general personnel files makes it harder to prove you've met the employment-duration-plus-three-years requirement.

Label everything with the standard it satisfies. When a record goes in the file, add a note: "Maintained per 29 CFR 1910.1030(h)(2)" or "Maintained per 29 CFR 1910.151." It looks fussy if you've never done it. But it tells an inspector immediately that you know which regulation you're meeting, which is a very different conversation than scrambling to explain why you kept a record at all.

Some employers run a safety management platform that tracks cert expiration dates and auto-generates reminders. Managing more than ten or fifteen trained employees? That's worth the subscription. For smaller teams, a shared Google Sheet with conditional formatting on expiration dates does the same job for free.

To build out a full written safety program that folds in CPR training documentation alongside your other OSHA requirements, SafetyFolio's program generator can produce a ready-to-use first-aid and CPR documentation policy in about 15 minutes, structured around the CFR standards that apply to your specific industry.

What qualifications must the CPR trainer have for the training to be OSHA-acceptable?

OSHA does not certify trainers or mandate a specific certifying body. The standard asks that training be "adequate," a word the agency defines through enforcement rather than prescription.

An OSHA compliance officer evaluating trainer qualifications looks at whether the trainer was credentialed by a recognized organization and whether the curriculum followed evidence-based guidelines. Three organizations whose CPR training OSHA inspection history treats as presumptively adequate are the American Heart Association, the American Red Cross, and the American Safety and Health Institute (ASHI). ^[10] Training from any of these bodies, taught by an instructor currently certified by that organization, satisfies "adequate" in every general-industry inspection scenario I'm aware of.

For healthcare employers under 1910.1030 and OSHA's healthcare standards, the AHA's Basic Life Support (BLS) for Healthcare Providers course is effectively the industry standard. Non-healthcare employers typically use Heartsaver CPR/AED (AHA) or First Aid/CPR/AED (Red Cross).

In-house trainers are fine. If a manager or safety officer completes an instructor-level certification from the AHA or Red Cross and delivers CPR training to employees, that satisfies the standard. The instructor's own certification must be current, and that credential belongs in the training record alongside the student records.

One thing to watch: online-only CPR training does not meet OSHA's adequacy standard for hands-on skill competency. The AHA and Red Cross both offer blended learning (online knowledge component plus in-person skills session), and that format is acceptable. Pure click-through online courses with no manikin time are not. An inspector can ask whether a skills check happened. If the answer is no, the training is likely to be found inadequate no matter what the paper certificate says.

How does the first-aid program fit into a broader written safety program?

CPR training documentation doesn't stand alone. It's one part of a first-aid program, which OSHA expects to be documented and written in higher-hazard environments.

Compliance with 1910.151 requires a workplace assessment to determine three things: the types of injuries and illnesses likely to occur, whether a medical facility is in near proximity, and what first-aid supplies and training are therefore needed. Write this assessment down, because an inspector may ask to see it. That written assessment is the foundation for your CPR training requirements, including how many trained people you need, on which shifts, and with what recertification schedule.

For construction, 1926.50 requires first-aid supplies approved by a physician (or adequate to the hazards present), which means you should have a physician sign off on your first-aid kit contents on a complex project. That physician consultation is itself a documentable event.

For the broader picture of what OSHA requires employers to document and train on, the OSHA training overview is a good starting point. A complete written safety program ties first-aid and CPR documentation into the rest of your required written programs so nothing falls through the cracks.

If you also have workers around lockout-tagout hazards or confined spaces, CPR training requirements for those programs are often stricter and may require more frequent refreshers than the standard two-year cycle. Review each applicable standard to confirm. The lockout tagout program, for example, carries its own training and documentation requirements that must be maintained alongside your first-aid records.

After a workplace incident, your CPR training records become part of the investigation package. Knowing that before an incident happens is exactly why good documentation habits matter. The incident report process and the first-aid training record should reference each other in your safety management system.

Frequently asked questions

Is there a specific OSHA form for CPR training records?

No. OSHA has no required form for CPR training records. You create your own record as long as it captures the employee name, training date, content summary, trainer qualifications, and recertification date. The bloodborne pathogens standard at 29 CFR 1910.1030(h)(2) is the most prescriptive, and it still doesn't mandate a specific form, just specific data fields.

Does every employee need CPR training, or just designated first-aid responders?

OSHA does not require all employees to be CPR-trained. The requirement under 29 CFR 1910.151(b) is that at least one person adequately trained in first aid (including CPR) is present when medical facilities are not in near proximity. How many trained people you need depends on your shift structure, workplace size, and the time it would take emergency services to arrive.

What counts as 'near proximity' to a medical facility under OSHA's rules?

OSHA has never defined "near proximity" with a specific distance or time in the regulatory text. Letters of interpretation and enforcement history suggest that if emergency medical services cannot reach your workplace within three to four minutes, trained on-site personnel are required. Rural worksites, large warehouses, and remote construction sites almost always fail the near-proximity test.

Can online-only CPR training satisfy OSHA's training requirement?

No. OSHA expects CPR training to include hands-on skill practice. Online-only courses with no manikin component do not demonstrate competency. The AHA and Red Cross offer blended learning options with an in-person skills session, and those are acceptable. A purely click-through online certificate would likely be found inadequate if an inspector scrutinizes the training method.

How do you document CPR training for employees who work alone or in remote locations?

The documentation requirements are the same regardless of work location. What changes is the scheduling: if an employee works alone and is more than a few minutes from emergency services, OSHA's position is that they themselves must be trained. You still need the full training record, and you should note in your workplace assessment why individual training was required rather than relying on a designated team member.

Do state OSHA plans have different CPR training documentation requirements than federal OSHA?

Yes, potentially. Twenty-two states and two territories run their own OSHA-approved state plans. State plans must be at least as protective as federal OSHA but can go further. California's Cal/OSHA, for example, has specific training and documentation requirements for construction and healthcare that exceed federal minimums. Always check your state plan if your state has one, because federal CFR citations alone may not be enough.

What should you do if an employee loses their CPR certification card?

Your internal training record should serve as the primary compliance document, not the card. If you've kept the record properly, a lost card is a minor inconvenience, not a compliance problem. The employee can often get a duplicate card from the training organization using their class roster entry. Either way, the internal record showing the training date, content, and trainer credentials is what OSHA will actually inspect.

How does CPR training documentation connect to OSHA's bloodborne pathogens standard?

For any employee with occupational exposure to blood or other potentially infectious materials, CPR training is typically delivered as part of the bloodborne pathogens training program. 29 CFR 1910.1030(h)(2) requires training records with specific content fields and a retention period of employment duration plus three years. This is the most detailed training record requirement in general industry and sets the documentation floor for covered employers.

Are CPR training records confidential like medical records?

CPR training records are not medical records and are generally not protected under HIPAA or the ADA's medical record confidentiality rules. They're safety program records. However, if CPR training is embedded in a broader medical evaluation or occupational health file, those portions may carry confidentiality requirements. Keep training records in a safety file rather than a medical file to avoid confusion about access and retention rules.

What's the difference between a CPR certification and OSHA first-aid training compliance?

A CPR certification proves an individual completed a course. OSHA compliance requires more: that the certified person was present during shifts when needed, that the curriculum met OSHA's adequacy standard, that the cert is current, and that all of this is documented. Many employers have employees with CPR cards but no documentation system, no shift-coverage analysis, and no recertification calendar. The card is step one; the compliance program is the rest.

Can a small business with fewer than 10 employees skip CPR training documentation?

No. OSHA's small employer exemption applies only to injury and illness recordkeeping under 29 CFR 1904, not to training program requirements. A two-person dental office still owes annual bloodborne pathogens training records. A five-person construction crew still needs a documented first-aid and CPR-trained person on site under 29 CFR 1926.50. Company size does not change the training documentation obligation.

How far in advance should you schedule CPR recertification to avoid a compliance gap?

Schedule recertification at least 60 days before the current certification expires. That window gives you time to find a course if your first choice is full, accommodates employee scheduling conflicts, and ensures no gap in coverage if the shift-coverage analysis requires a trained person to be present. Flag expiration dates in your HR or scheduling system with a 90-day advance alert to be safe.

Does OSHA require a written first-aid program, or just training records?

There is no explicit requirement in 29 CFR 1910.151 for a standalone written first-aid program, but OSHA's compliance expectations for larger or higher-hazard employers effectively require one. The workplace assessment that drives your training decisions (distance to medical facility, hazard types, shift staffing) should be written. Under HAZWOPER and bloodborne pathogens, written program elements are explicitly required and include first-aid procedures.

Sources

1. OSHA, 29 CFR 1910.151 Medical Services and First Aid: In the absence of a nearby infirmary or clinic, a person or persons shall be adequately trained to render first aid
2. OSHA, 29 CFR 1926.50 Medical Services and First Aid (Construction): Construction standard requires at least one valid first-aid and CPR certificate holder per worksite
3. OSHA, 29 CFR 1910.1030 Bloodborne Pathogens Standard: Training records must include the date, content summary, trainer name and qualifications, and attendee names and job titles; retained for duration of employment plus three years
4. American Heart Association, 2020 Guidelines for CPR and ECC: AHA BLS and Heartsaver CPR/AED certifications are valid for two years; CPR and AED use are inseparable in the chain of survival
5. California DIR, Cal/OSHA Division of Occupational Safety and Health: Cal/OSHA training records must be retained for three years from training date regardless of employment status
6. OSHA, 29 CFR 1910.269 Electric Power Generation, Transmission, and Distribution: Electrical workers must receive first-aid training including CPR with periodic retraining; enforcement guidance treats two years as the maximum interval
7. OSHA, Penalties Page: Maximum penalty for a serious violation in 2024 is $16,131 per violation; willful or repeated violations can reach $161,323 per violation
8. OSHA, 29 CFR 1904.1 Partial Exemption for Employers with 10 or Fewer Employees: Employers with 10 or fewer employees in low-hazard industries are exempt from OSHA 300/300A injury log requirements, not from training record requirements
9. OSHA, Best Practices Guide: Fundamentals of a Workplace First-Aid Program: OSHA recognizes training from established organizations such as the American Heart Association, American Red Cross, and ASHI as adequate for first-aid and CPR
10. OSHA, 29 CFR 1910.120 Hazardous Waste Operations and Emergency Response: HAZWOPER requires CPR as part of required 24-hour or 40-hour training blocks with documentation of curriculum hours and trainer qualifications
11. Bureau of Labor Statistics, Census of Fatal Occupational Injuries: BLS data on fatal occupational injuries informs the risk context for first-aid and CPR response time requirements