The Bloodborne Pathogens Standard is a federal workplace safety regulation, codified at 29 CFR 1910.1030, that requires employers to protect workers from infectious diseases spread through contact with human blood and other body fluids. Issued by the Occupational Safety and Health Administration (OSHA), it applies to any employee who has a reasonably anticipated risk of exposure to blood on the job, from nurses and lab technicians to custodians and first responders.
What the Standard Covers
The regulation defines bloodborne pathogens as disease-causing microorganisms present in human blood. Hepatitis B (HBV) and HIV are the two pathogens named explicitly, but the standard is not limited to those. Hepatitis C and other blood-transmitted infections fall under its protection as well.
“Occupational exposure” under the standard means any reasonably anticipated contact with blood or other potentially infectious materials through the skin, eyes, mucous membranes, or a puncture wound during the course of work. This covers obvious roles like phlebotomists drawing blood, but also less obvious ones: a school nurse cleaning a scraped knee, a janitorial worker handling biohazard waste, or a police officer responding to a car accident. If an employee’s duties could bring them into contact with human blood or certain body fluids, the standard applies to their employer.
The Exposure Control Plan
Every covered employer must create and maintain a written Exposure Control Plan. This is the backbone of the standard, and it has to include several specific components:
- Exposure determination: A list identifying which job classifications and tasks involve potential contact with blood or infectious materials.
- Control methods: The specific engineering controls, work practice controls, personal protective equipment, and housekeeping procedures the employer uses to minimize exposure.
- Hepatitis B vaccination program: Details on how the employer offers the vaccine to workers.
- Post-exposure evaluation and follow-up: Procedures for what happens after a worker is exposed to blood or infectious material.
- Training and hazard communication: How workers will be educated about risks and safe practices.
- Recordkeeping: How the employer documents injuries, vaccinations, and training.
The plan is not a one-time document. Employers must review and update it at least annually, and whenever new tasks, procedures, or positions create different exposure risks.
Universal Precautions
The standard is built on a concept called universal precautions: treat all human blood and certain body fluids as if they are infectious for HIV, hepatitis B, and other bloodborne pathogens. You don’t wait for a confirmed diagnosis to take protective measures. Every sample of blood, every soiled bandage, and every used needle is handled the same way, regardless of whether the source person is known to carry a disease. This removes guesswork and ensures consistent protection.
Engineering and Work Practice Controls
The standard prioritizes eliminating or reducing hazards at the source, before relying on protective gear. Engineering controls are physical devices or systems that isolate workers from the hazard. Sharps disposal containers are one of the most common examples. These containers must be closable, puncture-resistant, and leakproof. OSHA does not specify one container size or lid design for every situation. Instead, employers are expected to assess the types and sizes of sharps used at each workstation and select containers whose openings can safely accommodate them. If workers routinely need to open the entire lid to fit sharps inside, the container is the wrong fit.
Needleless IV systems, self-sheathing needles, and blunt-tip suture needles are other engineering controls the standard encourages. Work practice controls complement these: never recapping needles by hand, never bending or breaking contaminated sharps, and always washing hands immediately after removing gloves.
Personal Protective Equipment
When engineering controls alone can’t eliminate exposure, employers must provide personal protective equipment (PPE) at no cost. This includes gloves, gowns, face shields, eye protection, and masks, depending on the task. The employer is responsible for ensuring the equipment is accessible, in the right sizes, and replaced when damaged or contaminated. Workers are not allowed to take contaminated PPE home. Cleaning, laundering, disposal, and replacement all fall on the employer.
Hepatitis B Vaccination
Employers must offer the hepatitis B vaccine to every worker with occupational exposure, free of charge. The vaccine must be made available within 10 days of the worker’s initial assignment to a job involving exposure, and only after the worker has received training on bloodborne pathogens. Workers who have already been vaccinated, who have confirmed immunity through antibody testing, or who have a medical reason not to receive the vaccine are exempt.
If a worker declines the vaccine, they must sign a declination form. The form is designed to make clear that declining leaves the worker at continued risk for hepatitis B. Importantly, the decision is not permanent. If a worker changes their mind later, the employer must provide the vaccine at no cost, as long as the worker still has occupational exposure.
Post-Exposure Evaluation and Follow-Up
When an exposure incident occurs, such as a needlestick or a splash of blood to the eyes, the standard requires the employer to provide an immediate, confidential medical evaluation at no cost to the worker. This includes documenting the route and circumstances of the exposure, identifying the source individual (when possible and legally permitted), and collecting and testing the exposed worker’s blood.
The employer must provide the evaluating healthcare professional with a copy of the standard, a description of the worker’s duties as they relate to the exposure, and records of the worker’s hepatitis B vaccination status. The healthcare professional then provides the employer with a written opinion, but that opinion is limited to whether the vaccine is recommended and whether the worker received it. All other medical findings remain confidential.
Training Requirements
Every worker with occupational exposure must receive training when they are first assigned to a covered role and again at least once a year after that. The training must be interactive, meaning workers need the opportunity to ask questions of a knowledgeable presenter. Topics include an explanation of the standard itself, the epidemiology and symptoms of bloodborne diseases, how infections are transmitted, the employer’s Exposure Control Plan, how to recognize tasks that involve exposure, the proper use of PPE, information about the hepatitis B vaccine, and what to do after an exposure incident.
If new tasks or procedures are introduced that affect a worker’s exposure risk, additional training is required at that time, not just at the next annual session.
Recordkeeping and Sharps Injury Logs
The standard requires employers to maintain two categories of records. Medical records, which include vaccination status and post-exposure follow-up details, must be kept for the duration of employment plus 30 years. Training records, documenting session dates, content, trainer qualifications, and attendee names, must be retained for three years.
Employers with workers who sustain needlestick or sharps injuries must also record those incidents on the OSHA 300 Log. To protect privacy, the worker’s name is not entered on the log. If a recorded injury later leads to an infectious disease diagnosis, the employer must update the log to reclassify the case from an injury to an illness and identify the disease.
Penalties for Noncompliance
OSHA enforces the standard through workplace inspections, and penalties are adjusted annually for inflation. As of 2025, a serious violation of the Bloodborne Pathogens Standard carries a maximum fine of $16,550 per violation. Willful or repeated violations can reach $165,514 per violation. Because each unprotected worker or each missing element of an Exposure Control Plan can count as a separate violation, fines for a single inspection can add up quickly.