OSHA bloodborne pathogens standard: what every employer must know

Last updated 2026-07-09

What is the OSHA bloodborne pathogens standard and who does it cover?

The OSHA bloodborne pathogens standard is 29 CFR 1910.1030, published in 1991 and revised in 2001 by the Needlestick Safety and Prevention Act ^[1]. The reason it exists is simple. Blood and a handful of other body fluids can carry HIV, hepatitis B (HBV), and hepatitis C (HCV), and those infections cross into another person through a needlestick, a cut, mucous membranes, or broken skin.

Healthcare is the obvious target. The reach goes much further. The rule applies to any employer where one or more employees can "reasonably anticipate" skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials (OPIM) as part of their job duties ^[2]. A parallel rule covers construction under 29 CFR 1926.

Those two words "reasonably anticipate" do most of the work. OSHA has read them to include hospital and clinic staff, dental offices, tattoo and piercing shops, funeral homes, commercial laundries that handle soiled linen, correctional officers, school nurses, first-aid responders, research labs, and the housekeeping crew that cleans up after an injury ^[8]. Train an employee in first aid and expect them to respond to workplace injuries, and they're covered, even if first aid isn't their main job.

Who's out? Office workers with no patient contact and no first-aid role. That's about it.

For a broader look at how OSHA builds its industry standards, see OSHA basics.

What exactly counts as "other potentially infectious materials" (OPIM)?

Blood is the big one. Past blood, the standard defines OPIM as semen, vaginal secretions, cerebrospinal fluid, synovial fluid, pleural fluid, pericardial fluid, peritoneal fluid, amniotic fluid, saliva in dental procedures, any body fluid visibly contaminated with blood, and any body fluid you can't identify ^[2].

It also covers unfixed human tissue or organs (other than intact skin), HIV-containing cell or tissue cultures, and HBV-containing cultures or media.

Sweat, tears, urine, feces, nasal secretions, sputum, and vomit are NOT covered unless they contain visible blood. That line matters. It decides which tasks land in your exposure determination and, from there, what goes into your written plan.

What does an exposure control plan have to include?

The exposure control plan (ECP) is the spine of your program. It has to be written, accessible to every employee during their shift, and reviewed and updated at least once a year ^[2]. You also update it any time a new task, procedure, or job position changes who gets exposed.

The standard names four required ECP elements ^[2]:

1. Exposure determination. List every job classification at your workplace. For each one, identify which employees have occupational exposure and which tasks put them there. You do this without regard to PPE, meaning you write down the raw risk as if nobody's wearing gloves.

2. Methods of implementation and control. This is where the hierarchy of controls lives: engineering controls (sharps containers, needleless systems), work practice controls (hand washing, no two-handed recapping), and PPE requirements.

3. HBV vaccination, post-exposure evaluation, and follow-up. Spell out how employees request and get their hepatitis B series, what happens after an exposure, and who handles the medical follow-up.

4. Hazard communication, training, and recordkeeping. Document your training schedule, your biohazard labeling, and how you keep the required records.

The 2001 amendments bolted on two more requirements that small employers miss constantly ^[1]. Your plan has to document that you asked non-managerial front-line workers for input when choosing safer medical devices. And you have to keep a sharps injury log that records the device type and brand, where the injury happened, and how.

Building an ECP from a blank page is the part that stalls people. A tool like SafetyFolio's safety program generator walks you through your own job classifications and tasks and produces a compliant written plan in about 15 minutes. It doesn't excuse you from reading the standard. It does kill the blank-page problem.

For how written safety programs stay OSHA-compliant across other hazards, the OSHA training guide covers the wider framework.

What engineering controls does OSHA require for bloodborne pathogens?

Engineering controls come first. They rank above PPE and above hoping a worker does the right thing. The standard tells employers to examine and put in feasible engineering controls, and since the 2001 Needlestick Safety and Prevention Act, it specifically requires safer medical devices: needleless systems and sharps with engineered sharps injury protections (SESIPs), wherever feasible ^[1][2].

The controls that show up most:

Sharps disposal containers. Closable, puncture-resistant, leakproof, and labeled or color-coded red. They have to sit where sharps get used and get swapped out before they overfill.

Self-sheathing needles and needleless IV access. These are the whole reason OSHA rewrote the standard in 2001. Before the law, the CDC estimated 600,000 to 800,000 needlestick injuries hit U.S. healthcare workers every year ^[3].

Splash guards and biological safety cabinets in labs. Required anywhere procedures involve blood or OPIM.

Handwashing facilities. Must be accessible. If they aren't right there, antiseptic hand cleaner plus paper towels hold the line until real handwashing is possible.

Work practice controls ride alongside. No two-handed recapping. No bending, breaking, or removing contaminated needles by hand. No eating, drinking, or applying cosmetics where exposure can happen. Hands get washed after gloves come off and after any skin contact with blood or OPIM.

Here's the mistake employers make. Work practice controls are not a swap for engineering controls. If a safer needle device exists for a procedure you run, you have to evaluate it and put it in place if it's feasible, no matter how long your staff has "always done it this way." OSHA has cited employers specifically for skipping that evaluation ^[2].

What PPE is required under the bloodborne pathogens standard?

PPE for bloodborne pathogens is employer-provided and employer-paid, full stop. Workers never supply their own. The standard requires it whenever engineering and work practice controls alone don't wipe out the exposure risk ^[2].

Gloves lead the list. Wear them for any hand contact with blood, OPIM, mucous membranes, or non-intact skin, and when handling contaminated items. Utility gloves can be decontaminated and reused if they're still intact. Single-use exam gloves cannot be washed and reused. Workers with latex allergies get alternatives.

Gowns, lab coats, aprons. Required when there's a risk of soak-through or splash to clothing or skin. The right type tracks the task. A blood draw needs less than an autopsy.

Masks, eye protection, face shields. Required whenever splash, spray, or splatter can reach the face. Safety glasses alone don't cut it if splatter can hit the nose or mouth.

Resuscitation devices. Mouthpieces, pocket masks, or resuscitation bags have to be on hand anywhere mouth-to-mouth resuscitation is reasonably foreseeable.

PPE comes off before leaving the work area and goes into a designated spot for disposal or decontamination. The employer eats the cost of the gear, plus cleaning, repair, replacement, and disposal. If an employee refuses to wear required PPE, that's a discipline problem, but the employer still has to provide it.

For PPE rules across the rest of the OSHA standards, see workplace PPE.

What are the hepatitis B vaccination requirements?

This is one of the most specific pieces of the standard and one of the most cited. Employers must make the hepatitis B vaccine series available to every employee with occupational exposure ^[2]. The rules:

Free of charge. The employer pays. Not the employee's health insurance.

After training, within 10 working days. The offer comes after the employee finishes bloodborne pathogens training and before they touch any task with occupational exposure.

At a reasonable time and place. You can't schedule it so inconveniently that it's a barrier in disguise.

By a licensed healthcare professional.

Decline the vaccine, and the employee signs a declination statement using the exact language in Appendix A of the standard ^[11]. That language reads: "I understand that due to my occupational exposure to blood or other potentially infectious materials I may be at risk of acquiring hepatitis B virus (HBV) infection. I have been given the opportunity to be vaccinated with hepatitis B vaccine, at no charge to myself. However, I decline hepatitis B vaccination at this time." Those last three words carry weight. An employee who declines has to be offered the vaccine again later if they change their mind.

If someone already finished the full series, you don't repeat it, but document it in their medical records. Antibody testing to confirm immunity exists, but the standard doesn't require it.

One thing you cannot do: require pre-screening before offering the vaccine. You can't make employees get blood drawn to check for existing immunity before you offer them the series.

What has to happen after a needlestick or exposure incident?

The standard defines an exposure incident as specific eye, mouth, other mucous membrane, non-intact skin, or parenteral contact with blood or OPIM that comes out of doing the job ^[2]. When one happens, the response is immediate and it's specific.

Immediate first aid. Wash the area with soap and water. Flush mucous membranes with water.

Document the incident. What happened, with what device, in what body part.

Arrange a confidential medical evaluation. The employer makes it available at no cost, at a reasonable time and place, by a licensed healthcare professional. That evaluation has to include, at minimum: the route of exposure and circumstances; identification and, with consent, blood testing of the source individual if known; collection and testing of the exposed employee's blood with consent; and post-exposure prophylaxis (PEP) where it's medically indicated ^[2].

PEP runs on a clock. For HIV exposure, the CDC recommends starting PEP within 72 hours, and sooner is better ^[3]. This is exactly why a written post-exposure procedure earns its keep. Nobody wants to be Googling "where do I send an exposed employee" during the two-hour window.

The healthcare professional sends the employer a written opinion. It states only whether the employee was told the results and whether more evaluation or treatment is needed. Everything else, including the actual test results, stays confidential. Employers don't get the employee's blood results without written consent.

Then add the incident to your sharps injury log if a sharp was involved, file the medical records, and ask whether the incident points to a change in your exposure control plan.

What does OSHA bloodborne pathogens training require?

Training is required at initial assignment (before the employee starts any task with occupational exposure) and every year after that ^[2]. Change an employee's duties in a way that changes the exposure risk, and you retrain, even if 12 months haven't passed.

The standard lists the topics every session has to cover ^[2]:

• A copy of the standard and an explanation of its contents
• General explanation of the epidemiology and symptoms of bloodborne diseases
• Modes of transmission
• The written exposure control plan and how to get a copy
• How to recognize tasks and activities that involve exposure
• Use and limits of engineering controls, work practices, and PPE
• Types, selection, use, removal, handling, and disposal of PPE
• Hepatitis B vaccination: efficacy, safety, how it's given, the benefits, and that it's free
• What to do and who to contact in an emergency involving blood or OPIM
• How to report an exposure incident and the medical follow-up that follows
• Post-exposure evaluation and follow-up
• Signs, labels, and color coding
• An interactive question-and-answer session with the trainer

That last item is not optional. Compliant training must include interactive Q&A. A video with no way to ask a question does not meet the standard.

The trainer has to be knowledgeable in the subject matter. The standard names no specific credential, but the person must be able to answer questions about your workplace and its exposure hazards ^[2].

Online training is widely accepted as long as the interactive Q&A box gets checked, usually through live chat, email, or phone access to a trainer. A static self-paced video with a quiz at the end sits in a gray zone and has drawn scrutiny in OSHA enforcement.

Keep training records for 3 years. They have to show the dates, the content or a summary, the names and qualifications of the trainers, and the names and job titles of everyone who attended.

For how OSHA structures training across all its standards, see OSHA training requirements.

What records does OSHA require employers to keep?

The standard creates two record categories with very different retention clocks ^[2].

Medical records. These cover hepatitis B vaccination status and post-exposure evaluation and follow-up for each exposed employee. Keep them for the duration of employment plus 30 years, under OSHA's medical records rule, 29 CFR 1910.1020 ^[9]. They stay confidential, out of the general personnel file, and off-limits to the employer without the employee's written consent.

Training records. These cover training dates, content or summary, trainer qualifications, and attendee names and job titles. Keep them 3 years from the training date.

Sharps injury log. Required for employers whose workers use sharps. The log records the device type and brand, the department or work area, and a description of how the incident happened. It has to be kept in a way that protects the injured employee's confidentiality. OSHA wants you to review the log as part of your annual ECP update ^[1].

Medical and training records both have to be available to the affected employee (or their designated representative) and to OSHA within a reasonable time of a request.

What are OSHA penalties for bloodborne pathogens violations?

OSHA raises its penalty numbers every year for inflation. As of 2024, a serious violation tops out at $16,550 per violation, and willful or repeated violations reach $165,514 per violation ^[4]. Other-than-serious citations also carry up to $16,550 each.

Bloodborne pathogens is one of OSHA's more frequently cited standards across healthcare and service work. The usual triggers:

• No written exposure control plan, or one that hasn't been updated in over a year
• No hepatitis B vaccine offer, or an offer with no documented declination when refused
• No sharps injury log, or one missing required elements
• Training records nobody can produce, or training that skipped required topics
• Sharps containers that are overfilled or out of reach
• Skipping the evaluation of safer sharps devices when they're feasible

For an employer who genuinely didn't know, OSHA usually treats the first citation as serious, not willful. Willful violations, where the employer knew the requirement and chose to ignore it, and repeated violations, land in the higher tier.

State-plan states run their own OSHA programs and must keep bloodborne pathogens standards at least as effective as the federal one. California (Title 8, Section 5193) and Washington State (WAC 296-823) both mirror the federal standard closely ^[6].

How do state OSHA plans affect the bloodborne pathogens standard?

Twenty-nine states and territories run their own OSHA-approved state plans as of 2024, covering either all workers or just state and local government employees ^[7]. On bloodborne pathogens, every state plan has to keep a standard at least as effective as 29 CFR 1910.1030.

Most state standards use nearly identical language. California, Washington, and Michigan have added requirements, like tighter training timelines or extra elements in the exposure control plan. Operate in a state-plan state, and you check the state standard first, not the federal one.

States with private-sector plans: Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, and Wyoming.

For the full list and links to state plan contacts, OSHA's state plans page is the authoritative source ^[7].

How much does OSHA bloodborne pathogens compliance actually cost?

Cost swings hard by industry and headcount, but here's a realistic picture for a small employer.

Hepatitis B vaccine series. The three-dose series runs roughly $150 to $250 per employee through occupational health clinics or pharmacy programs (2024) ^[12]. Some employer health plans cover it. For a 10-person team with no prior vaccination on file, that's $1,500 to $2,500.

Training. Online bloodborne pathogen courses run $15 to $50 per employee per year from reputable providers. In-person group training from a consultant usually lands at $300 to $800 for a session. Annual cost for 10 people: $150 to $500 online, or $300 to $800 in person.

PPE. Gloves, masks, and eyewear for a small healthcare-adjacent shop might run $200 to $600 a year depending on volume. Sharps containers run $3 to $15 each.

Written program development. A consultant typically charges $500 to $2,500 to draft an initial exposure control plan. A written program tool (like SafetyFolio's generator) costs far less and lets you produce the document yourself.

First-year total for a 10-person operation starting from nothing: realistically $2,500 to $5,000. Renewal after that drops to mostly training ($150 to $500) and supply replenishment.

That's cheap next to a single $16,550 serious citation.

Cost item	Typical range (per employee or per event)	Notes
Hep B vaccine series (3 doses)	$150-$250	One-time; document if already vaccinated
Annual BBP training	$15-$50 online	Must include interactive Q&A
Sharps containers	$3-$15 each	Replace before overfull
Gloves (box of 100)	$8-$20	Nitrile preferred; latex alternatives required
Written ECP (consultant)	$500-$2,500 total	One-time; update annually
Post-exposure medical eval	$200-$1,000+	Employer pays; varies by exposure type

How does the 2001 Needlestick Safety and Prevention Act change the standard?

The Needlestick Safety and Prevention Act (Public Law 106-430) was signed in November 2000 and produced a revised OSHA standard effective April 18, 2001 ^[1]. It made three substantive changes small employers miss all the time.

First, the revised standard added "sharps with engineered sharps injury protections" and "needleless systems" to the definitions and made clear that employers must evaluate and implement these devices wherever feasible. Not optional. If a safer needle device exists for a procedure you run and it's commercially available, you need a documented reason for not using it.

Second, employers now have to bring the people who do the work into the selection of engineering controls. The standard says employers must "solicit input from non-managerial employees responsible for direct patient care who are potentially exposed to injuries from contaminated sharps in the identification, evaluation, and selection of effective engineering and work practice controls" ^[2]. You document that you did it. Asking a supervisor doesn't count.

Third, the sharps injury log became mandatory. It's separate from the OSHA 300 log and wants more detail: device type and brand, location, and a description of how the injury happened. You review it during the annual ECP update to catch patterns.

These three additions are where post-2001 enforcement actions tend to originate, because plenty of exposure control plans were written before 2001 and never fully caught up.

Frequently asked questions

Does the OSHA bloodborne pathogens standard apply to small businesses?

Yes. 29 CFR 1910.1030 applies to any employer with at least one employee who has occupational exposure to blood or OPIM, regardless of company size. There's no small-business exemption. A two-person dental practice and a cleaning company whose workers clean up after workplace injuries both fall under the standard if those workers can reasonably anticipate exposure.

How often is bloodborne pathogen training required?

Annual training is required for every employee with occupational exposure, measured from their initial training date. Additional training is required any time an employee's duties change in a way that changes exposure risk, even before 12 months pass. Initial training has to happen before the employee performs any task with occupational exposure, never after.

Can online courses satisfy OSHA bloodborne pathogen training requirements?

Yes, if the course includes interactive Q&A. The standard requires employees to have an opportunity for interactive questions and answers with someone knowledgeable in the subject. A video-only course with no way to ask questions doesn't meet it. Most reputable online platforms cover this through live chat, email access to a trainer, or a scheduled call-in.

What is the OSHA bloodborne pathogens standard citation number?

The standard is 29 CFR 1910.1030. It sits in Subpart Z of the General Industry standards, which covers toxic and hazardous substances. The parallel construction rule is under 29 CFR 1926. The 2001 amendments came from Public Law 106-430, the Needlestick Safety and Prevention Act, and took effect April 18, 2001.

Who is considered a "qualified" trainer for bloodborne pathogen training?

The standard says the trainer must be "knowledgeable in the subject matter covered by the elements contained in the training program as it relates to the workplace." There's no required certification. The trainer must be able to answer employee questions about the specific workplace hazards. In practice, small employers use a qualified occupational health nurse, a safety consultant, or a staff member who completed a train-the-trainer program.

Does the bloodborne pathogens standard cover HIV and hepatitis C, or just hepatitis B?

It covers all bloodborne pathogens, which the regulation defines as "pathogenic microorganisms that are present in human blood and can cause disease in humans." It lists HBV and HIV as examples, but the definition also catches HCV and any other blood-transmissible pathogen. The controls, vaccination offer, and post-exposure protocols apply no matter which pathogen is involved.

What happens if an employee refuses the hepatitis B vaccine?

The employee signs the declination statement using the exact language in Appendix A of 29 CFR 1910.1030. You keep that signed statement in their confidential medical record. You can't penalize the employee for declining, and you must offer the vaccine again if they later change their mind. Your obligation is to offer and document, not to force vaccination.

Do janitorial and housekeeping workers need bloodborne pathogens training?

Yes, if they can reasonably anticipate contact with blood or OPIM during their work. Housekeeping staff who clean restrooms, locker rooms, first-aid areas, or any space after an injury have occupational exposure under the standard. OSHA has confirmed in multiple letters of interpretation that this holds even when actual contact is rare, because the risk is reasonably anticipated as part of the job.

How long do bloodborne pathogens training records need to be kept?

Training records have to be kept at least 3 years from the training date. Employee medical records (vaccination status and post-exposure documentation) must be kept for the duration of employment plus 30 years, per 29 CFR 1910.1020. These are two separate files. The medical file stays confidential and separate from the general personnel file.

What is a sharps injury log and is it different from the OSHA 300 log?

They're different. The sharps injury log comes from the 2001 amendments to 29 CFR 1910.1030 and records the device type and brand, the work area or department, and a description of how the incident happened. The OSHA 300 log is a broader injury and illness record. A recordable needlestick shows up on both, but they serve different purposes and carry separate retention and privacy rules.

Does OSHA's bloodborne pathogens standard cover tattoo artists and body piercers?

Yes. OSHA guidance states that tattoo artists and body piercers have occupational exposure to blood and must comply with 29 CFR 1910.1030. That means written exposure control plans, training, hepatitis B vaccine offers, proper sharps disposal, and PPE. Some state-plan states have issued extra guidance specific to tattooing and body piercing shops.

What is the penalty for not having a written exposure control plan?

A missing written exposure control plan is typically cited as a serious violation under 29 CFR 1910.1030(c). The maximum serious penalty as of 2024 is $16,550 per citation. OSHA often groups related violations, so a missing plan plus missing training records plus no hepatitis B vaccination documentation can produce multiple citations in one inspection.

Can an employee's doctor perform the post-exposure evaluation instead of an occupational health clinic?

Yes, as long as the healthcare professional is licensed, the evaluation meets all the standard's requirements, and the employer pays. The evaluating professional gives the employee documentation of the results and gives the employer a written opinion that states only whether further evaluation is recommended, not the actual medical findings, which protects employee confidentiality.

What does OSHA consider an "exposure incident" under the bloodborne pathogens standard?

An exposure incident is defined in 29 CFR 1910.1030(b) as specific eye, mouth, other mucous membrane, non-intact skin, or parenteral contact with blood or other potentially infectious materials that results from the performance of an employee's duties. Contact with intact skin isn't an exposure incident. It has to happen during job duties to trigger the post-exposure protocol.

Sources

1. U.S. Congress, Needlestick Safety and Prevention Act, Public Law 106-430: The Needlestick Safety and Prevention Act (PL 106-430) amended 29 CFR 1910.1030 effective April 18, 2001, adding requirements for safer sharps devices, employee input in device selection, and a sharps injury log.
2. OSHA, 29 CFR 1910.1030 Bloodborne Pathogens standard full text: Requirements for exposure control plan, hepatitis B vaccination, PPE, training content, declination statement language, and recordkeeping as specified in the standard.
3. CDC, Stop Sticks Campaign, bloodborne pathogen exposure data: CDC estimated 600,000 to 800,000 needlestick injuries occurred annually among U.S. healthcare workers before the Needlestick Safety and Prevention Act; PEP for HIV should begin within 72 hours of exposure.
4. OSHA, Penalties page, civil penalty amounts for 2024: Maximum OSHA penalty for a serious violation is $16,550 per violation; willful or repeated violations up to $165,514 per violation as of 2024.
5. Washington State Department of Labor and Industries, WAC 296-823 Bloodborne Pathogens: Washington State's bloodborne pathogens standard (WAC 296-823) is maintained under Washington's state OSHA plan and is at least as effective as the federal standard.
6. OSHA, State Plans page: Twenty-nine states and territories operate OSHA-approved state plans; all must maintain bloodborne pathogens standards at least as effective as 29 CFR 1910.1030.
7. OSHA, Bloodborne Pathogens and Needlestick Prevention overview page: OSHA overview confirming that the standard applies to workers in healthcare, public safety, tattoo shops, funeral homes, research labs, and other settings where occupational exposure is reasonably anticipated.
8. OSHA, Medical Records standard, 29 CFR 1910.1020: Employee medical records including bloodborne pathogen vaccination and post-exposure documentation must be retained for duration of employment plus 30 years.
9. BLS, Survey of Occupational Injuries and Illnesses, healthcare sector injury data: BLS occupational injury and illness data showing healthcare and social assistance sector injury rates, contextualizing bloodborne pathogen exposure risk.
10. OSHA, Bloodborne Pathogens standard, Appendix A, HBV declination statement language: Appendix A of 29 CFR 1910.1030 contains the mandatory hepatitis B vaccine declination statement language that must be used verbatim when an employee refuses vaccination.
11. CDC, Hepatitis B vaccination information for healthcare workers: Hepatitis B vaccine series consists of three doses; cost through occupational health programs ranges approximately $150 to $250 per person.