Bloodborne Pathogens Training Guide
Updated March 2026 · OSHA 29 CFR 1910.1030 compliance
OSHA Compliance at a Glance
29 CFR 1910.1030
OSHA Bloodborne Pathogens Standard
385,000+
Needlestick injuries per year in U.S. hospitals
$3,000
Average cost per needlestick injury (testing + treatment)
OSHA’s Bloodborne Pathogens (BBP) standard protects an estimated 5.6 million healthcare workers in the United States from occupational exposure to blood and other potentially infectious materials (OPIM). Whether you run a two-provider clinic or a multi-site health system, compliance with 29 CFR 1910.1030 is not optional — and the stakes extend beyond fines. A single unmanaged needlestick can expose a worker to hepatitis B, hepatitis C, or HIV.
This guide covers everything your practice needs: the twelve required training elements, how to build and maintain an exposure control plan, sharps injury prevention strategies, post-exposure procedures, and recordkeeping obligations. If you’re also working on broader compliance, see our HIPAA compliance checklist and HIPAA applicability guide.
What Annual BBP Training Must Cover
OSHA requires training at initial assignment and at least annually thereafter. Training must be provided at no cost, during working hours, and at an appropriate educational level. The regulation at 29 CFR 1910.1030(g)(2)(vii) specifies twelve minimum elements every session must address.
Frequency
Initial + annual refresher within 12 months of prior training
Who Must Attend
All employees with reasonably anticipated occupational exposure
Trainer Requirement
Must be knowledgeable in the subject matter and allow live Q&A
12 Required Training Elements
Per 1910.1030(g)(2)(vii)(A)–(N)
- Copy of the OSHA BBP standard and an explanation of its contents
- Explanation of the epidemiology, symptoms, and transmission modes of bloodborne diseases (HBV, HCV, HIV)
- Explanation of the employer's Exposure Control Plan and how employees can obtain a copy
- How to recognize tasks and activities that may involve exposure to blood or OPIM
- Methods to reduce or prevent exposure: engineering controls, work practices, PPE
- Types, proper use, location, removal, handling, decontamination, and disposal of PPE
- Basis for selection of PPE
- Hepatitis B vaccine: efficacy, safety, method of administration, benefits, and that it is offered free of charge
- Actions to take and persons to contact in an emergency involving blood or OPIM
- Post-exposure evaluation and follow-up procedures
- Signs, labels, and color-coding used to identify biohazards
- Q&A opportunity with a person knowledgeable in the subject matter
Generic online courses may not satisfy OSHA
OSHA has cited employers for using off-the-shelf online BBP training that does not address facility-specific procedures. Your training must reference your exposure control plan, your specific engineering controls, and your PPE selection.
Exposure Control Plan: Required Elements
Every employer with workers who have occupational exposure must establish a written Exposure Control Plan (ECP). The plan must be reviewed and updated at least annually, and whenever new tasks, procedures, or positions are created that affect occupational exposure. Per 29 CFR 1910.1030(c)(1), the ECP must be accessible to all employees.
If your practice also handles HIPAA-protected information during incident response, make sure your ECP aligns with your HIPAA compliance checklist — particularly around documentation and access controls for employee medical records.
1. Exposure Determination
- List ALL job classifications where employees have occupational exposure
- List tasks and procedures where exposure occurs for each classification
- Include part-time, per diem, and temporary staff — not just full-time
2. Schedule & Methods of Compliance
- Universal precautions policy statement
- Engineering controls inventory (sharps containers, self-sheathing needles, needleless systems)
- Work practice controls (handwashing, specimen handling, laundry procedures)
- PPE requirements by task: gloves, gowns, masks, eye protection
- Housekeeping schedule for decontamination of surfaces and equipment
3. Hepatitis B Vaccination Program
- Vaccination offered within 10 working days of assignment
- Provided at no cost by licensed healthcare professional
- Declination form for employees who refuse (can accept later at no cost)
- Post-vaccination antibody testing timeline
4. Post-Exposure Evaluation & Follow-Up
- Immediate wound care and decontamination procedures
- Incident reporting process and documentation requirements
- Source individual identification and blood testing protocol
- Exposed employee blood testing and follow-up schedule
- Post-exposure prophylaxis (PEP) referral procedures
- Healthcare professional's written opinion timeline (15 days)
5. Communication of Hazards
- Biohazard labeling requirements (fluorescent orange-red or red)
- Red bag usage for regulated waste
- Container labeling for blood and OPIM storage/transport
- Warning signs for HIV/HBV research labs (if applicable)
6. Recordkeeping
- Medical records: maintained for employment + 30 years
- Training records: maintained for 3 years from training date
- Sharps injury log: maintained for 5 years (Needlestick Safety Act)
- Annual ECP review documentation
Annual Review Requirement
The Needlestick Safety and Prevention Act requires employers to solicit frontline employee input when reviewing and updating the ECP each year — particularly regarding the selection of safer sharps devices. Document who participated and what devices were evaluated.
Post-Exposure Procedures: 5-Step Protocol
When an exposure incident occurs, the employer must make immediately available a confidential medical evaluation and follow-up per 29 CFR 1910.1030(f). Speed matters — HIV PEP is most effective when started within 2 hours. Document every step for both OSHA compliance and your risk assessment records.
Immediate Care
Within minutes- Wash needlestick/cut with soap and water
- Flush mucous membrane splash with water for 15 minutes
- Irrigate eyes with clean water, saline, or sterile irrigant
- Do NOT squeeze the wound to force bleeding — this can increase exposure
Report the Incident
Same shift- Notify supervisor immediately
- Complete the facility's incident/exposure report form
- Document the route of exposure and circumstances
- Identify the source individual (patient) if possible
Medical Evaluation
Within 2 hours- Employer arranges confidential medical evaluation at no cost
- Source individual's blood tested for HBV, HCV, and HIV (with consent)
- Exposed employee's blood collected and tested (baseline)
- Post-exposure prophylaxis (PEP) initiated if indicated — most effective within 2 hours for HIV
Follow-Up Testing
Ongoing- HIV: repeat testing at 6 weeks, 12 weeks, and 6 months
- HCV: anti-HCV and ALT at baseline, 4–6 weeks, and 4–6 months
- HBV: based on vaccination status and antibody levels
- Counseling on infection signs/symptoms and safe practices during follow-up period
Written Opinion & Documentation
Within 15 days- Healthcare professional provides written opinion to employer within 15 days
- Opinion limited to: whether Hep B vaccine is indicated, whether employee received it
- Employee informed of evaluation results and conditions requiring further treatment
- Record added to employee's confidential medical file (retained for employment + 30 years)
PEP timing is critical for HIV exposures
Post-exposure prophylaxis should be initiated as soon as possible, ideally within 2 hours. Effectiveness drops significantly after 24 hours and is generally not recommended after 72 hours. Keep PEP starter packs accessible in your facility — do not rely on pharmacy availability.
Recordkeeping Requirements
OSHA mandates three categories of records under the BBP standard. These overlap with documentation you already maintain for clinical documentation and HIPAA compliance, but have distinct retention periods. Missing records are the most frequently cited violation during OSHA inspections.
Medical Records
Retain for: Duration of employment + 30 years
- Employee name and SSN
- Hepatitis B vaccination status and dates
- Exposure incident reports and follow-up results
- Healthcare professional's written opinions
- Employee medical complaints related to exposure
Confidential — cannot be disclosed without employee's written consent except as required by OSHA or law.
Training Records
Retain for: 3 years from training date
- Training dates
- Content or summary of the training session
- Name(s) and qualifications of the trainer(s)
- Names and job titles of all attendees
Must be available for examination and copying by employees, employee representatives, and OSHA.
Sharps Injury Log
Retain for: 5 years from date of incident
- Type and brand of device involved
- Department or work area where the incident occurred
- Description of the incident
Added by the Needlestick Safety and Prevention Act. Must protect employee identity (privacy).
Common OSHA Citation: Missing or Incomplete Records
In fiscal year 2024, recordkeeping violations under the BBP standard accounted for roughly 15% of all BBP citations. The most common gap: training records that list attendees but omit the trainer's qualifications or the content covered. Use a standardized training log template to ensure nothing is missed.
BBP Compliance Quick Reference
Build your compliance program step by step
BBP training is one piece of a broader compliance framework. Start with a risk assessment, ensure your Notice of Privacy Practices is current, and verify that all providers are properly credentialed.
Related Tools & Guides
HIPAA Risk Assessment Template
Guided security risk assessment based on NIST SP 800-30 methodology.
HIPAA Compliance Checklist
Interactive checklist covering Privacy, Security, and Breach Notification Rules.
Clinical Documentation Improvement
Best practices for accurate, compliant clinical documentation.
Who Does HIPAA Apply To?
Covered entities, business associates, and the extended HIPAA chain.