The OSHA Bloodborne Pathogens Standard, Explained
The Bloodborne Pathogens Standard is codified at 29 CFR 1910.1030. OSHA issued it in 1991, and it was amended in 2001 following the Needlestick Safety and Prevention Act to add explicit requirements around safer sharps devices. It applies to employers whose employees have reasonably anticipated occupational exposure to blood or other potentially infectious materials — a phrase that covers considerably more workplaces than people assume.
Healthcare is the obvious case, but the standard also reaches first responders, law enforcement, correctional officers, funeral service workers, laboratory staff, tattoo and body-piercing operators, custodial staff who handle waste, and biohazard remediation technicians. The test is whether exposure is reasonably anticipated as part of the job, not whether it happens often.
The central requirement is a written Exposure Control Plan. It has to identify which job classifications involve exposure, set out the methods used to control it, describe how exposure incidents are evaluated, and be reviewed and updated at least annually. It must be accessible to employees, and the annual review has to document consideration of safer medical devices that have become available.
Beyond the plan, the standard requires: universal precautions, meaning all blood and OPIM is treated as infectious regardless of what is known about the source; engineering and work practice controls, such as sharps containers and self-sheathing needles, which take priority over relying on personal protective equipment; PPE provided and laundered at no cost to the employee; and specific rules on labelling, containment and handling of contaminated material.
Hepatitis B vaccination must be offered to every employee with occupational exposure, free of charge, within ten working days of assignment. An employee who declines has to sign a specific declination statement, and can still request the vaccine later at no cost.
Where an exposure incident occurs, the employer must make a confidential medical evaluation and follow-up available immediately, at no cost, including source-individual testing where permitted by law and post-exposure prophylaxis where indicated. A sharps injury log is required for employers with more than ten employees.
Training is required at initial assignment and at least annually thereafter, delivered in a manner the employee can understand, with an opportunity for questions and answers with a knowledgeable trainer. Training records are kept for three years; medical records are kept for the duration of employment plus thirty years.
For a business dealing with a blood spill on site, the practical consequence is that the standard governs how it is handled and by whom. Directing an untrained employee to clean it with a mop and household bleach is a compliance failure as well as a health risk, which is why most organisations contract the work out.
Who the standard covers
The standard applies to employers whose employees have reasonably anticipated occupational exposure to blood or other potentially infectious materials. The test is whether exposure is reasonably anticipated as part of the job — not whether it happens often, and not whether it has happened yet.
Healthcare is the obvious case, but the reach is much wider than most employers realise.
- First responders, law enforcement and correctional officers
- Funeral service and mortuary workers
- Laboratory and research staff
- Tattoo and body-piercing operators
- Custodial and janitorial staff who handle waste
- Biohazard remediation technicians
- School nurses and designated first aiders in any workplace
The Exposure Control Plan
The central requirement is a written plan. It has to identify which job classifications involve exposure, set out the methods used to control it, describe how exposure incidents are evaluated, and be accessible to employees.
It must be reviewed and updated at least annually, and the review has to document consideration of safer medical devices that have become available since the last one. That documentation requirement came in with the 2001 amendment following the Needlestick Safety and Prevention Act, and it is the element most often missing when an inspector looks.
Core requirements
| Requirement | What it means in practice |
|---|---|
| Universal precautions | All blood and OPIM is treated as infectious regardless of what is known about the source. |
| Engineering controls | Sharps containers, self-sheathing needles, splash guards. These take priority over relying on PPE. |
| Work practice controls | No eating, drinking or applying cosmetics in exposure areas; handwashing immediately after removing gloves. |
| Personal protective equipment | Provided, repaired, replaced and laundered at no cost to the employee. |
| Labelling and containment | Biohazard labelling on containers, refrigerators and transport; leak-proof, closable containers. |
| Housekeeping | A written schedule for cleaning and decontaminating surfaces and equipment. |
Hepatitis B vaccination
Vaccination must be offered to every employee with occupational exposure, free of charge, within ten working days of assignment. It has to be made available after any required training and at a reasonable time and place.
An employee who declines must sign a specific declination statement, the wording of which is set out in the standard. Declining is not permanent — they can request the vaccine later, still at no cost, at any point while they remain in a role with exposure.
After an exposure incident
- A confidential medical evaluation and follow-up must be made available immediately and at no cost
- The source individual's blood is tested where permitted by law and where consent is obtained
- The exposed employee's blood is collected and tested with their consent
- Post-exposure prophylaxis is provided where medically indicated
- Counselling and evaluation of any reported illness are offered
- A written opinion from the healthcare professional is provided to the employer within 15 days
Training and records
Training is required at initial assignment and at least annually thereafter. It must be delivered at a level the employee can understand, in a language they understand, and must include an opportunity for interactive questions and answers with someone knowledgeable about the subject. A video with no opportunity to ask questions does not satisfy the standard.
Training records are kept for three years and must include dates, content, trainer details and attendees. Medical records are kept for the duration of employment plus thirty years and must remain confidential. A sharps injury log is required for employers with more than ten employees.
What this means for a spill at work
If blood is spilled in your workplace, the standard governs how it is handled and by whom. Directing an untrained employee to clean it with a mop and household bleach is a compliance failure as well as a health risk, regardless of how willing that employee is.
This is the practical reason most organisations contract the work out: the contractor arrives with trained technicians, appropriate PPE, rated disinfectants and a regulated disposal route, and they leave documentation showing it was done correctly. That documentation is what satisfies both an insurer and an inspector.
What inspectors most often find missing
- An Exposure Control Plan that exists but has not been reviewed in the last twelve months
- No documented consideration of safer sharps devices in the annual review, which the 2001 amendment specifically requires
- Hepatitis B declination statements missing for employees who declined vaccination
- Training records that do not name the trainer or evidence the opportunity for interactive questions
- No sharps injury log where the employer has more than ten employees
- PPE available but no documented process for repair, replacement or laundering at employer expense
Other potentially infectious materials
The standard covers more than blood. "Other potentially infectious materials" is a defined term and includes semen, vaginal secretions, cerebrospinal fluid, synovial fluid, pleural fluid, pericardial fluid, peritoneal fluid, amniotic fluid, saliva in dental procedures, any body fluid visibly contaminated with blood, and any body fluid where it is difficult to differentiate.
It also covers unfixed human tissue or organs, and cell or tissue cultures containing HIV or HBV. Notably, it does not cover faeces, nasal secretions, sputum, sweat, tears, urine or vomit unless they contain visible blood — a distinction that surprises people and that matters when deciding whether the standard applies to a given clean-up.
Common questions
Does the standard apply to a small business with one first aider?
Potentially yes. If someone is designated to render first aid as part of their job duties, exposure is reasonably anticipated and the standard applies to that role.
Can an employee be charged for PPE or vaccination?
No. The standard requires both to be provided at no cost to the employee, including laundering and replacement of PPE.
What penalties apply for non-compliance?
OSHA citations for bloodborne pathogen violations are common and can carry substantial per-violation penalties, with higher amounts for willful or repeat findings.
Is a written plan really required for a small employer?
Yes. There is no small-employer exemption from the Exposure Control Plan requirement, though the plan itself will be proportionate to the operation.
Does the standard apply to volunteers?
It applies to employees. Volunteer exposure sits outside its scope, though other duties of care may apply and many organisations follow the standard anyway.
How often must training be repeated?
At initial assignment and at least annually thereafter, with an opportunity for interactive questions with a knowledgeable trainer each time.
What counts as an exposure incident?
Specific eye, mouth, mucous membrane, non-intact skin or parenteral contact with blood or other potentially infectious material during the performance of duties.
Can an employee refuse to clean a spill?
An untrained employee should not be assigned to it at all. Where an employee is trained and equipped, refusal becomes an employment matter — but the duty to provide training and PPE sits with the employer first.
Related service: Blood Spill Cleanup