OSHA’s Bloodborne Pathogens Standard exists to protect workers from infections caused by contact with human blood and other potentially infectious body fluids on the job. Codified as 29 CFR 1910.1030, it requires every employer with workers who face this kind of exposure to have a written plan that eliminates or minimizes the risk. The standard primarily targets hepatitis B (HBV), hepatitis C (HCV), and HIV, though it covers all bloodborne pathogens. It applies broadly, covering not just nurses and doctors but also first responders, lab technicians, housekeeping staff, and anyone else whose job duties could bring them into contact with blood or infectious materials.
Who the Standard Covers
The standard applies to any employer who has even one employee with “occupational exposure,” meaning a reasonably anticipated contact with blood or other potentially infectious materials as part of their job duties. This includes obvious roles like phlebotomists and surgeons, but also less obvious ones: janitorial workers in hospitals, dental hygienists, correctional officers, and school nurses. Employers must identify every job classification where exposure could happen and list the specific tasks that create risk. Importantly, this determination is made without considering whether the employee wears protective equipment. The question is whether the exposure could occur, not whether it’s currently being managed.
The Exposure Control Plan
At the heart of the standard is a requirement that every covered employer create and maintain a written Exposure Control Plan. This isn’t a general safety policy. It’s a specific document that must include three core elements: an exposure determination identifying which job roles and tasks carry risk, a schedule detailing how the employer will implement each protective measure required by the standard, and a procedure for investigating any incident where an employee is actually exposed to blood or infectious material.
The plan must be reviewed and updated at least annually. It’s a living document, not something filed away and forgotten. If new positions are created, procedures change, or safer technology becomes available, the plan needs to reflect that.
Universal Precautions
The standard requires employers to observe “universal precautions,” a practice built on a simple principle: treat all human blood and certain body fluids as if they are infectious, regardless of the source. You don’t wait for a confirmed diagnosis to take protective steps. Blood, cerebrospinal fluid, joint fluid, and fluid surrounding the heart, lungs, or abdominal organs all fall under this requirement. Fluids like sweat, vomit, or nasal secretions are excluded unless visible blood is present.
This approach removes guesswork. Workers don’t need to know a patient’s or individual’s infection status to know how to handle the situation safely.
Engineering and Work Practice Controls
The standard prioritizes eliminating hazards at the source rather than relying on workers to protect themselves. Engineering controls are physical devices or systems that remove the danger before it reaches the employee. Examples written into the standard include sharps disposal containers, self-sheathing needles, needleless IV systems, and other safer medical devices with built-in sharps injury protections.
Sharps containers, for instance, must meet specific criteria: they need to be closable, puncture resistant, leakproof on the sides and bottom, and clearly labeled or color-coded. Contaminated needles and blades must go into these containers immediately or as soon as possible after use. These aren’t suggestions. They’re enforceable requirements, and employers must evaluate and adopt newer, safer devices as they become available.
Personal Protective Equipment
When engineering controls alone aren’t enough, employers must provide personal protective equipment at no cost to the employee. This includes gloves, gowns, lab coats, face shields, masks, eye protection, and ventilation devices like pocket masks for resuscitation. The equipment is considered “appropriate” only if it prevents blood or infectious materials from reaching the worker’s skin, eyes, mouth, mucous membranes, or clothing under normal use conditions.
Employers also bear responsibility for cleaning, laundering, and disposing of all protective equipment. Workers can’t be asked to take contaminated gear home to wash. The only narrow exception to mandatory PPE use applies when an employee makes a professional judgment, in rare and extraordinary circumstances, that wearing the equipment would prevent them from delivering critical healthcare or public safety services, or would create a greater hazard. Even then, the employer must investigate and document the incident.
Free Hepatitis B Vaccination
One of the most concrete protections in the standard is the requirement that employers offer the hepatitis B vaccine series to all at-risk employees, free of charge. The vaccination must be offered within 10 days of an employee’s initial assignment to a role involving occupational exposure, and only after the employee has received training about bloodborne pathogens. The only exceptions are employees who have already been vaccinated, those confirmed immune through antibody testing, or those for whom the vaccine is medically contraindicated.
Employees can decline, but the employer must have them sign a formal declination form. If an employee changes their mind later, the employer is still required to provide the vaccine at no cost. This provision has had a dramatic effect: since the standard took effect in 1991, occupational hepatitis B infections among healthcare workers have dropped sharply, according to CDC surveillance data.
Post-Exposure Follow-Up
When an exposure incident does occur, such as a needlestick, a splash of blood to the eyes, or contact with broken skin, the standard spells out what must happen next. The employer must provide the affected employee with a confidential medical evaluation and follow-up, again at no cost. This includes testing the source individual’s blood for HBV, HCV, and HIV (when consent or legal authority allows), testing the exposed employee’s blood, and providing any necessary preventive treatment.
The employer must also document the circumstances of the exposure: what happened, what device or procedure was involved, and what protective measures were in place. This investigation isn’t punitive. It’s designed to identify whether changes to equipment, procedures, or training could prevent a similar incident.
Training and Recordkeeping
Every employee with occupational exposure must receive training when first assigned to their role and then again every year. Annual refresher training doesn’t have to be an exact repeat of the initial session, but it must cover the topics required by the standard to the extent needed. This is a firm annual requirement regardless of how much training or education an employee has received elsewhere.
The standard also imposes strict recordkeeping rules. Medical records for each employee with occupational exposure must be maintained for the duration of employment plus 30 years. Training records must be kept for three years. These records ensure that if a worker develops an illness years later, there’s a documented trail of their exposures, vaccinations, and any incidents that occurred on the job.
Why the Standard Matters
Before the Bloodborne Pathogens Standard took effect in 1991, there was no consistent federal requirement for how employers protected workers from blood-related infections. Needlestick injuries were common, hepatitis B vaccination rates among healthcare workers were low, and many workplaces lacked basic sharps disposal systems. The standard changed that by making prevention a legal obligation rather than a best practice. It shifted the burden from individual workers making their own safety decisions to employers building systems that protect everyone by default. The steep decline in occupational hepatitis B infections in the years since is one of its clearest measurable outcomes.