OSHA’s Bloodborne Pathogen Standard (29 CFR 1910.1030) applies to every employer with workers who have reasonably anticipated exposure to blood or other potentially infectious materials — not just healthcare facilities. That includes restaurants, schools, gyms, daycares, cleaning companies, and any business where an employee might encounter blood. You need a written Exposure Control Plan, annual training, free PPE, free Hepatitis B vaccinations, and documented procedures. Violations carry fines of $16,131 per instance, with willful violations reaching $161,323.
Who Must Comply
The standard applies to all employers with employees who have reasonably anticipated occupational exposure to blood or other potentially infectious materials (OPIM). This is broader than most people realize. OSHA defines OPIM to include:
- Human blood, blood components, and products made from blood
- Semen, vaginal secretions, cerebrospinal fluid, synovial fluid, pleural fluid, peritoneal fluid, pericardial fluid, amniotic fluid
- Saliva in dental procedures
- Any body fluid visibly contaminated with blood
- Any unfixed tissue or organ (other than intact skin) from a living or dead human
- Cell cultures, organ cultures, and HIV/HBV-containing culture media
| Industry | Who’s Covered | Common Exposure Scenarios |
|---|---|---|
| Healthcare | Nurses, doctors, phlebotomists, lab techs, EMTs, dental workers | Needlesticks, splashes, patient contact |
| Schools & Daycares | Teachers, aides, school nurses, custodians | Student injuries, nosebleeds, playground accidents, bathroom incidents |
| Restaurants & Food Service | Kitchen staff, servers, managers | Knife cuts, broken glass, first aid situations |
| Gyms & Sports Facilities | Trainers, coaches, facility staff | Athletic injuries, blood on equipment, locker room incidents |
| Cleaning & Janitorial | Custodians, janitors, housekeepers | Cleaning blood spills, handling waste, restroom maintenance |
| Public Safety | Police, firefighters, correctional officers | Crime scenes, accidents, physical confrontations |
| Hospitality & Hotels | Housekeeping, maintenance, front desk | Guest room cleanups, needles in rooms, blood on linens |
| Retail | Managers, employees designated for first aid | Customer or employee injuries requiring first aid response |
| Manufacturing & Construction | First aid responders, safety personnel | Workplace injuries, first aid kit use |
“We’re not a healthcare facility, so the BBP standard doesn’t apply to us.” This is the most common — and most costly — mistake businesses make. If any employee could reasonably encounter blood as part of their duties (including designated first-aid responders, custodians, or anyone who cleans up after an injury), the standard applies. OSHA has cited restaurants, schools, gyms, and office buildings for BBP violations.
The Standard at a Glance
Here is a high-level overview of every major requirement in the Bloodborne Pathogen Standard. Each is detailed in the sections that follow.
| Requirement | What It Means | Frequency |
|---|---|---|
| Written Exposure Control Plan | Document identifying exposed job classifications, procedures, and protocols | Updated annually |
| Universal Precautions | Treat all blood/OPIM as infectious | Always |
| Engineering & Work Practice Controls | Sharps containers, handwashing stations, needle safety devices | Ongoing |
| Personal Protective Equipment | Gloves, face/eye protection, gowns provided free to employees | Ongoing; replaced as needed |
| Hepatitis B Vaccination | Offered free within 10 working days of assignment | One-time series (3 doses) |
| Training | Comprehensive BBP training for all at-risk employees | At hire + annually |
| Decontamination Procedures | Written schedule for cleaning and disinfecting work surfaces | After contamination + per schedule |
| Regulated Waste Disposal | Labeled, leak-proof containers for contaminated materials and sharps | Ongoing |
| Post-Exposure Evaluation | Confidential medical evaluation and follow-up after any exposure incident | Per incident |
| Recordkeeping | Medical records (30 years), training records (3 years), sharps injury log | Ongoing |
Exposure Control Plan Requirements
The Exposure Control Plan (ECP) is the foundation of BBP compliance. It is a written document that must be:
- Accessible to all employees during their work shift
- Reviewed and updated at least annually, or whenever new tasks, procedures, or positions with exposure risk are introduced
- Specific to your workplace — a generic template downloaded from the internet is not sufficient if it doesn’t reflect your actual operations
The ECP must contain three core elements:
Exposure Determination
A list of all job classifications in which employees have occupational exposure, and all tasks and procedures in which exposure occurs. This determination must be made without regard to PPE use — you list who is exposed, not who is protected.
Example: “Custodial staff — cleaning blood spills in restrooms, hallways, and classrooms. School nurse — providing first aid for student injuries.”
Schedule and Methods of Implementation
Detailed procedures for how each provision of the standard will be implemented in your workplace: Universal Precautions protocols, engineering controls, PPE selection, housekeeping schedules, training delivery, vaccination administration, and post-exposure response.
Procedure for Evaluating Exposure Incidents
Step-by-step protocol for what happens when an employee is exposed to blood or OPIM: immediate first aid, incident reporting, medical referral, source individual testing (if consent is obtained), follow-up testing schedule, and confidentiality protections.
OSHA inspectors look at the ECP first during any BBP-related inspection. The most common citations are: (1) no ECP exists, (2) the ECP is generic and doesn’t reflect the actual workplace, (3) the ECP hasn’t been updated in the past year, and (4) employees don’t know where to find it. Keep it current, specific, and accessible.
Universal Precautions
Universal Precautions is the OSHA-mandated approach to infection control: treat all human blood and OPIM as if they are known to be infectious for HIV, HBV, HCV, and other bloodborne pathogens.
In practice, this means:
- Never make assumptions about whether blood is “safe” based on the source person’s appearance, age, or perceived health
- Always wear appropriate PPE when blood exposure is reasonably anticipated
- Always follow decontamination procedures, regardless of how small the blood spill appears
- Never eat, drink, smoke, apply cosmetics, or handle contact lenses in areas where blood exposure may occur
OSHA also permits Body Substance Isolation (BSI) as an alternative or supplement to Universal Precautions. BSI treats all body fluids and substances as potentially infectious, going beyond the specific fluids listed in the standard. Either approach satisfies the regulation as long as it is documented in the ECP and consistently followed.
PPE Requirements
Employers must provide, at no cost to the employee, all PPE necessary to protect against blood and OPIM exposure. The employer must also ensure employees use the PPE appropriately and replace it when contaminated, damaged, or no longer effective.
| PPE Type | When Required | Specifications |
|---|---|---|
| Gloves | Any time hands may contact blood, OPIM, mucous membranes, or non-intact skin | Disposable single-use (nitrile or latex). Replace between tasks and when torn, punctured, or contaminated. Hypoallergenic alternatives must be available. |
| Face/Eye Protection | When splashes, sprays, spatters, or droplets of blood/OPIM may be generated | Safety glasses with side shields, goggles, or face shields. Must protect eyes, nose, and mouth. |
| Gowns/Aprons | When gross contamination to clothing is reasonably anticipated | Fluid-resistant or impervious. Disposable preferred for biohazard cleanup. |
| Masks | When airborne droplets of blood/OPIM are anticipated | Surgical mask minimum; N95 respirator if aerosol-generating procedures are involved. |
| Shoe Covers | When floor contamination is expected | Fluid-resistant disposable covers. |
The employer bears 100% of the cost for BBP-related PPE. Employees cannot be asked to provide their own gloves, goggles, or gowns. Additionally, the employer must ensure that PPE is readily accessible in the work area — not locked in a supply closet or stored in another building.
Training Requirements
All employees with occupational exposure must receive comprehensive BBP training. The training must be:
- Provided at the time of initial assignment to tasks with exposure risk
- Repeated annually thereafter
- Conducted by a knowledgeable person (not a self-guided online quiz with no interaction)
- Appropriate in content and vocabulary to the educational level, literacy, and language of the employees
- Interactive — employees must have an opportunity to ask questions
Required Training Content
OSHA specifies 14 minimum training elements. The training must cover:
- An accessible copy of the BBP standard text and an explanation of its contents
- A general explanation of the epidemiology, symptoms, and transmission of bloodborne diseases
- An explanation of the Exposure Control Plan and how to obtain a copy
- How to recognize tasks that may involve exposure
- An explanation of the use and limitations of engineering controls, work practices, and PPE
- Information on the types, selection, proper use, location, removal, handling, decontamination, and disposal of PPE
- Information on the Hepatitis B vaccine (efficacy, safety, benefits, and that it is offered free)
- Information on who to contact and what to do in an emergency involving blood/OPIM
- The procedure to follow if an exposure incident occurs
- The post-exposure evaluation and follow-up the employer will provide
- An explanation of signs, labels, and color-coding used for biohazard identification
- An opportunity for interactive questions and answers
Sending employees a PDF or having them watch a video with no opportunity for interaction does not satisfy OSHA’s training requirement. The standard explicitly requires that a “person who is knowledgeable in the subject matter” conduct the training and that employees have the ability to ask questions. Online training platforms can be used, but only if they include a live or interactive Q&A component.
Hepatitis B Vaccination
Employers must offer the Hepatitis B vaccine series to all employees with occupational exposure. This is not optional.
- Timeline: Must be offered within 10 working days of initial assignment to a position with exposure risk
- Cost: Free to the employee — the employer pays for the vaccine, administration, and any required blood testing
- Voluntary: Employees may decline, but must sign a specific declination statement (the exact wording is prescribed in the standard). An employee who initially declines may accept the vaccine at any time later, at the employer’s expense.
- Series: The standard HBV vaccine is a 3-dose series given over 6 months
- Post-vaccination testing: Employers must provide post-vaccination antibody testing to confirm immunity
The HBV vaccine is 95% effective at preventing infection and is considered one of the most important protections available to employees with blood exposure risk. Given that HBV is 50–100 times more infectious than HIV and survives on surfaces for at least 7 days, vaccination is the single most effective protection measure.
Decontamination and Housekeeping
The standard requires a written schedule for cleaning and decontaminating work areas, including:
- Work surfaces: Must be decontaminated with an appropriate disinfectant after contact with blood/OPIM, and at the end of the work shift if contamination may have occurred
- Protective coverings: If used (e.g., plastic-backed absorbent paper), must be replaced when contaminated and at the end of the work shift
- Equipment: Must be decontaminated before servicing or shipping. If decontamination is not feasible, the equipment must be labeled with the biohazard symbol noting which portions remain contaminated.
- Bins, cans, and containers: Must be inspected, cleaned, and decontaminated on a regular schedule
- Broken glass: Must be cleaned using mechanical means (brush, dustpan, tongs) — never by hand, even with gloves
Approved disinfectants: OSHA accepts EPA-registered tuberculocidal disinfectants, a 1:10 dilution of household bleach (freshly prepared), or EPA-registered products on List S (effective against bloodborne pathogens).
Regulated Waste Disposal
OSHA defines regulated waste as:
- Liquid or semi-liquid blood or OPIM
- Contaminated items that would release blood or OPIM in a liquid or semi-liquid state if compressed
- Items caked with dried blood or OPIM that are capable of releasing these materials during handling
- Contaminated sharps (needles, broken glass, scalpels)
- Pathological and microbiological wastes containing blood or OPIM
Requirements for handling regulated waste:
General Regulated Waste
Must be placed in containers that are: closable, leak-proof, labeled or color-coded (red bags or biohazard symbol). Containers must be closed before removal and replaced routinely. If the outside of a container becomes contaminated, it must be placed in a second labeled container.
Sharps Waste
Must be placed in containers that are: puncture-resistant, leak-proof, closable, labeled or color-coded. Sharps containers must be easily accessible, maintained upright, and replaced before overfilling. Never reach into a sharps container. Never bend, recap, or remove contaminated needles by hand.
Many businesses that are not in healthcare still need sharps containers — think hotel housekeeping (needles found in rooms), schools (diabetic students), and cleaning companies. If your employees could encounter sharps, you need sharps disposal protocols in your ECP.
Post-Exposure Procedures
When an exposure incident occurs (blood contact with eyes, mouth, non-intact skin, or a needlestick), the employer must provide a confidential medical evaluation and follow-up at no cost to the employee:
Immediate First Aid
Wash the exposure site thoroughly with soap and water. Flush eyes with clean water or saline if mucous membrane exposure occurred. Do not apply bleach or other disinfectants to wounds.
Incident Documentation
Document the route of exposure, circumstances, and identify the source individual (if possible). Use incident report forms specified in the ECP.
Source Individual Testing
With consent, the source individual’s blood is tested for HIV, HBV, and HCV. If consent is not obtained, document that it was requested. If the source individual is already known to be infected, testing is not necessary.
Medical Evaluation
The exposed employee is referred to a qualified healthcare professional for evaluation, baseline blood testing, and determination of whether post-exposure prophylaxis (PEP) is appropriate. The employer provides the healthcare professional with a copy of the BBP standard, the exposure incident report, the employee’s vaccination status, and results of source testing.
Follow-Up
The healthcare professional provides a written opinion to the employer within 15 days, limited to: whether the vaccine is recommended, whether the employee received the vaccine, and confirmation that the employee was informed of the evaluation results and any conditions requiring further treatment. No other findings or diagnoses may be disclosed to the employer.
Post-exposure prophylaxis for HIV (PEP) is most effective when started within 2 hours and must be started within 72 hours. Hepatitis B immune globulin (HBIG) should be administered within 24 hours for unvaccinated individuals. Delayed response to an exposure incident can mean the difference between preventing and not preventing infection. Your ECP should specify exactly where employees go for emergency post-exposure care — not just “see a doctor.”
Recordkeeping Requirements
OSHA requires three categories of records related to the BBP standard:
| Record Type | Contents | Retention Period | Access |
|---|---|---|---|
| Medical Records | Employee name, SSN, HBV vaccination status, post-exposure evaluation results, healthcare professional written opinions | Duration of employment + 30 years | Confidential. Only available to the employee, OSHA, and the employee’s designated representative with written consent. |
| Training Records | Dates of training sessions, content/summary of training, names and qualifications of trainers, names and job titles of attendees | 3 years from date of training | Available to employees, employee representatives, and OSHA upon request. |
| Sharps Injury Log | Type and brand of device, department/work area where incident occurred, description of the incident | 5 years (per OSHA 300 Log retention) | Must protect employee privacy. Available to OSHA inspectors. |
Medical records must be retained for the duration of employment plus 30 years. This is one of the longest retention requirements in any OSHA standard. If an employee works for you for 5 years, you must keep their BBP medical records for 35 years total. If you close the business or transfer records, OSHA’s requirements for record transfer apply (29 CFR 1910.1020).
Penalties for Violations
OSHA’s penalty structure for BBP violations is significant, and penalties are assessed per violation — meaning a single inspection can result in multiple citations and cumulative fines:
| Violation Type | Maximum Penalty (2026) | Examples |
|---|---|---|
| Other-Than-Serious | $16,131 per violation | Training records incomplete, ECP not updated within past year |
| Serious | $16,131 per violation | No ECP, no PPE provided, no HBV vaccination offered, employees untrained |
| Willful | $161,323 per violation | Knowing and intentional disregard of the standard after being warned |
| Repeat | $161,323 per violation | Same or substantially similar violation within 5 years of a previous citation |
| Failure to Abate | $16,131 per day | Failing to correct a cited violation by the abatement date |
In practice, a single OSHA inspection at a non-compliant business can easily generate $50,000–$100,000+ in combined penalties. A restaurant with no ECP, no training, no PPE, and no vaccination program could face four separate serious violations totaling over $64,000 from a single visit.
Full Compliance Checklist
Use this checklist to verify your organization’s compliance with every major requirement of 29 CFR 1910.1030:
Exposure Control Plan
PPE & Engineering Controls
Training & Vaccination
Housekeeping & Waste
Post-Exposure & Records
Frequently Asked Questions
Does the BBP standard apply to my small business?
If you have even one employee with reasonably anticipated occupational exposure to blood or OPIM, the standard applies. There is no small-business exemption. This includes any employee designated to provide first aid, any custodial staff, and anyone who might clean up a blood spill as part of their duties.
Do we need an Exposure Control Plan if we just have a first-aid kit?
If you have designated employees to administer first aid (which means they could contact blood), then yes, you need an ECP covering those employees. Having a first-aid kit without an ECP and trained, vaccinated responders is itself a compliance risk.
Can we do BBP training online?
Online training can be a component, but it must include an interactive Q&A session with a knowledgeable person. A video or slideshow with no live interaction does not satisfy the standard. Many organizations use an online module followed by a live (in-person or virtual) Q&A session.
What if an employee refuses the Hepatitis B vaccine?
The employee must sign OSHA’s prescribed declination statement (the exact wording is in Appendix A of the standard). The employee retains the right to accept the vaccine at any later date, at the employer’s expense. You cannot force vaccination, but you must document the offer and the refusal.
How often does the Exposure Control Plan need to be updated?
At least annually, and whenever new procedures, tasks, or positions with exposure risk are introduced. OSHA also requires that the annual review include consideration of commercially available safer needle devices and that non-managerial employees with exposure risk have input into the evaluation.
Can we just hire a cleanup company instead of training employees?
Hiring a professional biohazard cleanup company for blood spill response is an excellent strategy and can reduce your compliance burden. However, if employees could encounter blood before the cleanup company arrives (first aid, securing the area), those employees still need training, PPE, and vaccination. Many businesses use a hybrid approach: trained first responders for immediate safety, with professional cleanup for decontamination.
What counts as an “exposure incident”?
OSHA defines an exposure incident as “a specific eye, mouth, other mucous membrane, non-intact skin, or parenteral contact with blood or other potentially infectious materials that results from the performance of an employee’s duties.” This includes needlesticks, blood splashing into eyes, and contact with blood through cuts or abrasions on hands.
What are the most common BBP violations OSHA cites?
Based on OSHA inspection data, the most frequently cited violations are: (1) no written Exposure Control Plan, (2) failure to provide annual training, (3) ECP not updated annually, (4) failure to offer Hepatitis B vaccination, and (5) inadequate PPE availability. These are all “easy wins” for compliance — none require expensive infrastructure.
Sources: OSHA 29 CFR 1910.1030 — Bloodborne Pathogens Standard (full text); OSHA Bloodborne Pathogens Safety and Health Topics Page; OSHA Penalty Amounts (2026); NIOSH Bloodborne Infectious Diseases.
Need Help With Blood Cleanup Compliance?
Many businesses outsource blood spill cleanup to certified biohazard companies rather than building internal programs. BioCleaners Directory connects you with OSHA-compliant providers who handle decontamination, waste disposal, and documentation — reducing your liability and keeping your employees safe.
