OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030): The Complete Guide for Biohazard Cleanup Companies

Disclaimer: This article is educational content for biohazard cleanup business owners. It is not legal advice. Regulations change, state plan states adopt their own rules, and every operation has unique facts. Consult a qualified attorney, certified industrial hygienist, or compliance officer before finalizing your written programs or responding to a citation.

1. What 29 CFR 1910.1030 Actually Is

The Bloodborne Pathogens Standard is the core federal rule governing occupational exposure to blood and other potentially infectious materials. It was published by the Occupational Safety and Health Administration in 1991 and revised in 2001 under the Needlestick Safety and Prevention Act. The standard lives at Title 29 of the Code of Federal Regulations, Part 1910, Section 1030.

In plain English, the rule says: if your employees might get blood, body fluids, or infectious tissue on their skin, in their eyes, or through a needlestick while doing their job, you must build a system to reduce that risk and document everything.

Who It Applies To

Paragraph 1910.1030(a) applies the standard to “all occupational exposure to blood or other potentially infectious materials.” For biohazard cleanup, that is essentially every job a technician performs: unattended deaths, suicides, homicides, accidents, hoarding with human waste, rodent droppings containing hantavirus, sewage backups, and any cleanup involving regulated medical waste. If you run a biohazard cleanup operation, you are covered — full stop.

Why Biohazard Cleanup Falls Squarely Under the Rule

OSHA defines “occupational exposure” at 1910.1030(b) as “reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or OPIM that may result from the performance of an employee’s duties.” Trauma scene remediation is the textbook example. Even if you personally do not touch blood on a given job, the reasonable anticipation test is what triggers coverage for every technician on the roster.

2. The Exposure Control Plan (ECP)

Paragraph 1910.1030(c)(1)(i) requires every covered employer to establish a written Exposure Control Plan. This is not optional and is the single most-cited missing document in biohazard cleanup inspections.

Required Components of the ECP

1. Exposure determination — a list of all job classifications in which all employees have occupational exposure (e.g., Biohazard Technician, Lead Remediator), and job classifications in which some employees have occupational exposure, plus the tasks and procedures that cause exposure. Required by 1910.1030(c)(2).
2. Schedule and method of implementation for compliance with engineering controls, work practice controls, PPE, housekeeping, regulated waste, laundry, HBV vaccine offer, post-exposure evaluation, communication of hazards (labels/signs), information and training, and recordkeeping.
3. Procedure for evaluating circumstances of an exposure incident — 1910.1030(c)(1)(iii)(C).
4. Annual review and update. The ECP must be reviewed and updated at least annually and whenever new tasks or procedures affect occupational exposure — 1910.1030(c)(1)(iv).
5. Input from non-managerial employees responsible for direct patient care (or in our industry, field technicians) when selecting engineering and work practice controls.
6. Documentation of annually-considered safer medical devices — sharps with engineered sharps injury protections.
7. Accessibility: the plan must be accessible to employees on request and to OSHA on request — 1910.1030(c)(1)(v).

Template Sections for a Biohazard Cleanup ECP

• Cover page with company name, effective date, and responsible person
• Purpose and scope
• Exposure determination by job title and task
• Methods of compliance — universal precautions, engineering controls, work practice controls, PPE
• Hepatitis B vaccination program
• Post-exposure evaluation and follow-up procedures
• Communication of hazards — labels, signs, training
• Recordkeeping procedures
• Sharps injury log template
• Annual review signature page

Real-world citation note: OSHA inspectors routinely ask owners to produce their ECP within the first 15 minutes of an on-site inspection. “We have one, it’s just in the truck” is not an acceptable answer.

3. Employee Training Requirements

Training is governed by 1910.1030(g)(2). It is the most common area where small biohazard shops fall short because the rule is specific and time-sensitive.

When Training Must Occur

• At the time of initial assignment to tasks where occupational exposure may occur — before the employee’s first job with potential exposure. In practice, this means within 10 working days of hire if they are being put into the field.
• At least annually thereafter. Annual refresher training must be within 365 days of the previous training.
• Additional training when modifications of tasks or procedures, or new tasks or procedures affect occupational exposure.

Required Training Content — 1910.1030(g)(2)(vii)

1. An accessible copy of the standard and explanation of its contents
2. General explanation of the epidemiology and symptoms of bloodborne diseases
3. Explanation of the modes of transmission of bloodborne pathogens
4. Explanation of the employer’s Exposure Control Plan and how to obtain a copy
5. How to recognize tasks and activities that may involve exposure
6. Explanation of the use and limitations of methods that will prevent or reduce exposure (engineering controls, work practices, PPE)
7. Information on types, proper use, location, removal, handling, decontamination, and disposal of PPE
8. Explanation of the basis for selecting PPE
9. Information on the Hepatitis B vaccine — efficacy, safety, method of administration, benefits, and that it is offered free of charge
10. Information on the appropriate actions and persons to contact in an emergency involving blood or OPIM
11. Explanation of the procedure to follow if an exposure incident occurs, including reporting and medical follow-up
12. Information on the post-exposure evaluation and follow-up the employer is required to provide
13. Explanation of the signs, labels, and color coding required
14. Opportunity for interactive questions and answers with the trainer — this is why self-paced videos alone do not satisfy the rule

Trainer Qualifications

Per 1910.1030(g)(2)(viii), the trainer must be “knowledgeable in the subject matter covered… as it relates to the workplace.” A third-party online module is not enough by itself — you need a qualified live trainer (in person or interactive virtual) available for the Q&A portion.

Training Record Retention

Training records must be kept for 3 years from the date of training — 1910.1030(h)(2)(ii). Each record must include:

• Dates of the training sessions
• Contents or a summary of the training
• Names and qualifications of persons conducting the training
• Names and job titles of all persons attending

4. Hepatitis B Vaccination

Under 1910.1030(f)(1)(ii), the employer must make the HBV vaccine and vaccination series available at no cost to the employee, at a reasonable time and place, under the supervision of a licensed healthcare professional, and according to current CDC recommendations.

Timing

The vaccine must be offered within 10 working days of initial assignment to a job with occupational exposure — 1910.1030(f)(2)(i) — unless the employee has previously received the complete series, antibody testing shows immunity, or the vaccine is contraindicated.

Declination

Employees can refuse, but only after being offered the vaccine and only by signing the exact declination statement in Appendix A of the standard. Do not paraphrase. The statement reads, in part: “I understand that due to my occupational exposure…I may be at risk of acquiring hepatitis B virus (HBV) infection… I decline hepatitis B vaccination at this time.” An employee who declines retains the right to accept the vaccine later at no charge.

What It Costs the Employer

The three-dose HBV series typically costs $75–$200 per employee at occupational medicine clinics or pharmacies in 2026. Post-vaccine titer testing (antibody verification) is recommended by CDC 1–2 months after the final dose for healthcare personnel, and many biohazard operators follow the same practice.

5. PPE Requirements

Paragraph 1910.1030(d)(3) requires the employer to provide, at no cost to the employee, appropriate PPE when there is occupational exposure.

Standard PPE for Biohazard Cleanup

• Gloves — nitrile (not latex) for most tasks, double-gloved for heavy contamination. Cut-resistant inner gloves for sharps-heavy scenes.
• Face and eye protection — full-face respirator or goggles plus surgical mask/face shield when splashing, spraying, or aerosols are reasonably anticipated.
• Gowns / Tyvek suits — fluid-resistant coveralls, typically Tyvek 400 or equivalent. Taped seams at wrists, ankles, and hood for heavy contamination.
• Shoe covers / boot covers — fluid-resistant, taped to suit.
• Respirators — when respirators are used, 29 CFR 1910.134 (the Respiratory Protection Standard) also applies. This means a written respiratory protection program, medical evaluation, fit testing, and training. An N95 filtering facepiece respirator still triggers medical evaluation (though fit testing is still required for tight-fitting facepieces).

Employer-Provided and Laundered

Per 1910.1030(d)(3)(iv), the employer must clean, launder, or dispose of PPE at no cost to the employee. Technicians cannot be asked to take contaminated Tyvek home to wash. Either dispose of as regulated waste or use a commercial medical laundry service.

When PPE Fails

If a garment is penetrated by blood or OPIM, 1910.1030(d)(3)(v) requires removal “as soon as feasible.” Penetrated PPE must be disposed of as regulated waste or cleaned before reuse.

6. Engineering and Work Practice Controls

Engineering controls (1910.1030(d)(2)) are the equipment and physical changes that isolate or remove the hazard. Work practice controls are procedures that reduce the likelihood of exposure.

Key Controls for Biohazard Cleanup

• Universal precautions — treat all human blood and certain body fluids as if known to be infectious. Per 1910.1030(d)(1), this approach is required.
• Sharps containers — FDA-cleared, puncture-resistant, leakproof, color-coded red or labeled with the biohazard symbol. Located as close as feasible to use. Required by 1910.1030(d)(4)(iii)(A).
• Prohibition on recapping needles — 1910.1030(d)(2)(vii). Recapping, bending, or removing contaminated needles is prohibited unless no alternative is feasible.
• Hand hygiene — handwashing facilities or antiseptic hand cleanser plus towels/towelettes when soap and water are not feasible. Hands must be washed immediately after removing gloves — 1910.1030(d)(2)(v).
• Prohibition on eating, drinking, applying cosmetics, smoking, or handling contact lenses in work areas where there is reasonable likelihood of occupational exposure — 1910.1030(d)(2)(ix).
• Safer sharps devices — employers must solicit input from non-managerial frontline workers on the identification, evaluation, and selection of effective engineering and work practice controls, and must document this in the ECP — 1910.1030(c)(1)(v).

7. Regulated Medical Waste (RMW)

OSHA defines regulated waste at 1910.1030(b) as: (1) liquid or semi-liquid blood or OPIM; (2) contaminated items that would release blood or OPIM in a liquid or semi-liquid state if compressed; (3) items caked with dried blood or OPIM capable of releasing these materials during handling; (4) contaminated sharps; and (5) pathological and microbiological wastes containing blood or OPIM.

Storage and Containment

Under 1910.1030(d)(4)(iii)(B), regulated waste must be placed in containers that are:

• Closable
• Constructed to contain all contents and prevent leakage of fluids
• Labeled or color-coded — red bags or the biohazard symbol per 1910.1030(g)(1)(i)
• Closed prior to removal

Labeling

The biohazard symbol must be fluorescent orange or orange-red, with lettering and symbols in a contrasting color, and affixed as close as feasible to the container. Red bags or red containers may be substituted for labels — 1910.1030(g)(1)(i)(E).

Transport and Disposal

OSHA does not regulate off-site disposal of medical waste. That falls under the EPA (historically under the Medical Waste Tracking Act) plus state and U.S. Department of Transportation rules when crossing state lines. In practice:

• Use a licensed medical waste transporter (Stericycle, Daniels Health, or a regional hauler)
• Maintain manifests — most states require them to be retained 3 years
• DOT 49 CFR Part 173.196 classifies most regulated medical waste as UN3291 “Regulated Medical Waste, n.o.s.”
• Each state has a primary regulator for medical waste — often the state environmental agency or department of health. Confirm before opening a new market.

State-Specific Disposal Rules

States diverge significantly. New York has one of the strictest regimes via its Environmental Conservation Law Article 27, Title 15. California regulates under the Medical Waste Management Act (H&S Code 117600–118360). Texas regulates via 25 TAC Chapter 1, Subchapter K. Before dispatching crews across state lines, verify the receiving state’s manifest, storage, and transporter rules. See the companion playbook on biohazard job SOPs.

8. Post-Exposure Protocols

An exposure incident means a specific eye, mouth, other mucous membrane, non-intact skin, or parenteral (needlestick) contact with blood or OPIM. The clock starts the moment it happens.

Within 2 Hours

CDC guidelines recommend post-exposure prophylaxis for HIV be initiated ideally within 2 hours of exposure, and no later than 72 hours. Translate this into your written procedure: an exposed technician needs to be moving toward a licensed healthcare provider immediately, not waiting until end of shift.

Employer Obligations — 1910.1030(f)(3)

1. Make immediately available a confidential medical evaluation and follow-up at no cost to the employee
2. Document the route(s) of exposure and the circumstances of the incident
3. Identify and document the source individual, unless identification is infeasible or prohibited by state law
4. Obtain consent and test the source individual’s blood as soon as feasible to determine HBV and HIV infectivity (state consent laws apply)
5. Provide the exposed employee with the source’s test results and information about applicable disclosure laws
6. Collect and test the exposed employee’s blood, with consent, for HBV and HIV serological status
7. Offer post-exposure prophylaxis per current USPHS recommendations
8. Offer counseling and evaluation of any reported illness

Healthcare Professional’s Written Opinion

Per 1910.1030(f)(5), the employer must obtain a written opinion from the healthcare professional within 15 days of the completed evaluation. For post-exposure, the opinion is limited to: (1) documentation that the employee was informed of the results; and (2) documentation that the employee was told about any medical conditions resulting from exposure that require further evaluation or treatment. All other findings remain confidential.

9. Recordkeeping Requirements

Recordkeeping is governed by 1910.1030(h) and it is the area where small operators get burned years after the fact. The retention periods are long.

Medical Records — 1910.1030(h)(1)

For each employee with occupational exposure:

• Name and social security number
• Copy of the employee’s HBV vaccination status including dates and any medical records relative to ability to receive vaccination
• Copy of all results of examinations, medical testing, and follow-up procedures
• Employer’s copy of the healthcare professional’s written opinion
• Copy of the information provided to the healthcare professional

Retention: duration of employment plus 30 years — per 29 CFR 1910.1020. These records must be kept confidential and disclosed only with the employee’s written consent or as required by law.

Training Records — 1910.1030(h)(2)

Retention: 3 years from the date the training occurred.

Sharps Injury Log — 1910.1030(h)(5)

Employers with 11 or more employees who are required to keep OSHA 300 logs must also maintain a Sharps Injury Log. The log must contain, at minimum:

• Type and brand of device involved in the incident
• Department or work area where the incident occurred
• Explanation of how the incident occurred

The log must be maintained in a way that protects the confidentiality of the injured employee and retained for 5 years following the end of the calendar year covered.

10. OSHA Fines and Enforcement (2026 Amounts)

OSHA penalties are adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act. As of January 2026, maximum penalties are approximately:

• Other-than-serious violation: up to $16,550 per violation
• Serious violation: up to $16,550 per violation
• Failure to abate: up to $16,550 per day beyond the abatement date
• Willful or repeated violation: up to $165,514 per violation, with a minimum of $11,823 for willful

Common Citation Examples in Biohazard Cleanup

1. No written Exposure Control Plan — 1910.1030(c)(1)(i)
2. ECP not reviewed or updated annually — 1910.1030(c)(1)(iv)
3. HBV vaccine not offered within 10 days of assignment — 1910.1030(f)(2)(i)
4. Training not provided at initial assignment or annually — 1910.1030(g)(2)
5. Training records missing required elements — 1910.1030(h)(2)
6. No Sharps Injury Log — 1910.1030(h)(5) (for qualifying employers)
7. Regulated waste containers not closable or leakproof — 1910.1030(d)(4)(iii)(B)
8. No post-exposure evaluation procedure in place — 1910.1030(f)(3)
9. Respirator use without a written Respiratory Protection Program — cited under 1910.134(c)
10. PPE not provided at no cost or not laundered by employer — 1910.1030(d)(3)(iii)–(iv)

11. State Plan States

Twenty-two states plus Puerto Rico operate their own OSHA-approved State Plans that cover private-sector employers. Six additional states and the U.S. Virgin Islands have State Plans that cover only state and local government employees. State Plans must be at least as effective as federal OSHA, but many are stricter.

State Plans You Need to Know

• California (Cal/OSHA) — enforces Title 8, Section 5193 (Bloodborne Pathogens), plus the Aerosol Transmissible Diseases Standard (Section 5199), which federal OSHA has not adopted. The ATD standard can apply to biohazard work involving TB, measles, or novel pathogens.
• Washington (DOSH) — WAC 296-823 is Washington’s bloodborne pathogens rule. It is essentially aligned with federal but has distinct recordkeeping expectations.
• Oregon (Oregon OSHA) — OAR 437-002, adopts federal standard with state amendments.
• Michigan (MIOSHA), North Carolina, Kentucky, Tennessee, South Carolina, Indiana, Minnesota, Iowa, Nevada, Utah, Wyoming, Alaska, Hawaii, Arizona, New Mexico, Vermont, Maryland, and Puerto Rico round out the private-sector State Plans.

If you operate across state lines — common in biohazard cleanup — check each state’s plan before dispatching. Penalty schedules and training nuances differ.

12. HIPAA Considerations

The Health Insurance Portability and Accountability Act does not automatically apply to every biohazard cleanup company. It applies when you become a Business Associate of a Covered Entity — typically a hospital, clinic, long-term care facility, or health plan.

When HIPAA Applies to Your Company

• You have a contract with a hospital to perform cleanup in patient-care areas
• You perform work inside a Covered Entity where you may encounter Protected Health Information (PHI) — patient names, charts, insurance info, bloodwork on counters
• You are hired by an insurance company or healthcare provider who gives you PHI (e.g., decedent’s medical info at an unattended death in a nursing home)

Business Associate Agreement (BAA)

If HIPAA applies, you must sign a BAA with the Covered Entity before the work begins. The BAA spells out permitted uses of PHI, safeguards, breach notification, subcontractor flow-down, and termination. Under the HITECH Act, Business Associates are directly liable for HIPAA violations — civil penalties range from $141 to $2,134,831 per violation category, per year (2026 adjusted amounts per HHS).

Practical Safeguards

• Train technicians: if you see paperwork, charts, or prescriptions at a scene, do not photograph, discuss, or share them
• Job photos: blur or exclude any identifying documents, labels on medications, or name placards
• Secure any PHI collected incidentally and return or destroy it per your BAA
• Use encrypted job management software if patient info might be logged

13. IICRC Certifications

The Institute of Inspection, Cleaning and Restoration Certification is a non-profit standards body. IICRC certifications are not government-issued, but several states (notably Florida and California) and a large number of insurance carriers require or strongly prefer IICRC-certified technicians for biohazard and restoration work.

Certifications Relevant to Biohazard Cleanup

• IICRC S540 — Standard for Trauma and Crime Scene Cleanup. The industry’s foundational document for decomposition, blood, suicide, homicide, and accident scenes. Covers PPE selection, decontamination procedures, odor control, and disposal.
• IICRC S500 — Standard for Professional Water Damage Restoration. Essential for sewage backup jobs (Category 3 black water) that often overlap biohazard work.
• IICRC S520 — Mold Remediation. Relevant when biohazard scenes involve extended moisture or hoarding.
• AMRT — Applied Microbial Remediation Technician. Covers mold, bacteria, and other microbial contamination.
• ASD — Applied Structural Drying. Useful adjunct certification for sewage and biohazard-with-water jobs.
• WRT — Water Damage Restoration Technician. Prerequisite for AMRT in many cases.

How IICRC Complements OSHA Compliance

OSHA tells you what must be done (offer HBV, write an ECP, provide PPE). IICRC S540 tells you how to execute a trauma scene — the process, sequence, verification, and quality thresholds. Inspectors, insurance adjusters, and plaintiff attorneys use IICRC S540 as the “reasonable professional standard” benchmark. Certify your technicians, document their status, and reference S540 in your written SOPs.

14. State Licensing Overview

Unlike mold remediation, there is no single federal license for biohazard cleanup. State licensing is uneven:

• Florida — Biomedical Waste Transporter registration required with the Department of Health if you transport regulated waste off-site. Additional requirements for mold remediation (separate license) and potentially for hoarding work involving sewage.
• California — Trauma Scene Waste Management Practitioner registration required under H&S Code 118321. Must register with California Department of Public Health, meet training requirements, and maintain a written health and safety plan.
• Texas — No specific biohazard cleanup license, but a Medical Waste Transporter registration with TCEQ is required for transport. Mold remediation licensing is separate under TDLR.
• New York — Regulated Medical Waste Transporter permit through DEC. No biohazard-specific license but city-level requirements in NYC exist.
• Illinois, Oregon, Michigan, Massachusetts — No biohazard-specific licenses, but medical waste transporter registration typically required.
• Most other states — No specific biohazard license, but medical waste transport permits, general contractor or business licenses, and local permits may apply.

Before entering any new state, call the state environmental agency and state department of health and ask: “What licenses, permits, or registrations does my company need to do biohazard and trauma scene cleanup in this state?” Get the answer in writing.

15. Insurance Requirements

Your insurance stack is a compliance tool, not just a cost center. Under-insuring a biohazard operation is a quick route to personal bankruptcy after a single bad claim.

Minimum Coverage Framework (2026 Market)

• General Liability (CGL) — minimum $1M per occurrence / $2M aggregate. Most commercial clients and insurance referral programs require this.
• Professional Liability (E&O) — $1M per claim minimum. Covers errors in cleanup verification, missed contamination, or negligent remediation claims.
• Pollution Liability / Contractors Pollution Liability (CPL) — $1M–$2M. Critical for biohazard work. Standard CGL policies exclude pollution-related claims, and bloodborne pathogens often fall under that exclusion. CPL fills the gap.
• Workers’ Compensation — required by law in every state except Texas (where it is optional but strongly recommended). Rates for biohazard/cleanup are high because of the job classification codes.
• Commercial Auto — $1M combined single limit for trucks and vans, plus hired/non-owned auto coverage.
• Umbrella / Excess — $1M–$5M over CGL, Auto, and Employer’s Liability.
• Cyber Liability — increasingly required if you handle PHI under a BAA.

Work with a broker who specializes in environmental or restoration contractors. Ask for a Certificate of Insurance with specific bloodborne pathogen and pollution coverage language — many commercial and municipal contracts require it in the bid package.

16. Top 10 Compliance Mistakes in Biohazard Cleanup

1. Written ECP that hasn’t been updated in years. Dated 2019, no annual review signature. Automatic citation.
2. HBV vaccine never actually offered — owner assumed technicians got it during military or prior jobs. Without documentation and a signed declination using the exact Appendix A language, it counts as never offered.
3. Training records missing trainer qualifications. Training happened, but the record doesn’t list who taught it or their credentials.
4. Online training only. No opportunity for interactive Q&A with a knowledgeable person.
5. No Sharps Injury Log at companies with 11+ employees.
6. Respirator use without 1910.134 program. N95s thrown in the truck, no medical evaluation, no fit test, no written program.
7. Technicians washing Tyvek suits at home. Clear violation of 1910.1030(d)(3)(iv).
8. Regulated waste left in truck overnight without proper secondary containment, labeling, or temperature control.
9. Post-exposure procedure that exists on paper but not in practice. No standing relationship with an occupational medicine clinic, no after-hours plan, no company card for emergency travel.
10. No annual consideration of safer sharps devices documented in the ECP, with input from frontline employees. Small shops forget this exists.

17. Annual Compliance Audit Checklist

Run this every January or on the anniversary of your ECP effective date. Assign a single compliance owner and block a half-day for it.

• [ ] ECP reviewed, dated, and signed by responsible person within the past 12 months
• [ ] Exposure determination reviewed against current job titles and tasks
• [ ] Documented consideration of safer sharps devices with frontline employee input
• [ ] HBV vaccine offered within 10 working days of assignment for every new hire in past 12 months
• [ ] Signed declination forms (using Appendix A language) on file for any refusals
• [ ] Initial training completed for every new hire with occupational exposure
• [ ] Annual refresher training completed for every existing exposed employee within 365 days of prior training
• [ ] Training records contain: date, content summary, trainer name and qualifications, attendee names and job titles
• [ ] Written Respiratory Protection Program current if respirators are used
• [ ] Medical evaluations and fit tests current for every respirator user
• [ ] Sharps Injury Log maintained (if 11+ employees)
• [ ] Medical records for exposed employees retained for duration of employment plus 30 years
• [ ] Training records retained 3 years
• [ ] Sharps Injury Log retained 5 years
• [ ] Post-exposure protocol tested or tabletop-exercised in past 12 months; occupational medicine clinic contact verified
• [ ] Medical waste manifests on file for every pickup in past 3 years
• [ ] PPE inventory adequate; contaminated PPE laundered by employer or disposed of as regulated waste
• [ ] Biohazard labels and red-bag supplies stocked and compliant with 1910.1030(g)(1)
• [ ] State Plan-specific requirements reviewed (if in a State Plan state)
• [ ] Business Associate Agreements current with every healthcare client
• [ ] IICRC certifications current for every technician (if relied upon for contracts)
• [ ] Insurance certificates current with correct named insured, policy limits, and endorsements
• [ ] State licenses and medical waste transporter permits current
• [ ] OSHA 300 / 300A / 301 logs updated (if 11+ employees and not in partially-exempt industry)

Putting It All Together

OSHA compliance in biohazard cleanup is not a binder on a shelf. It is the operating system that lets you bid hospital contracts, satisfy insurance adjusters, win referral partnerships, and keep your technicians healthy. Build it right once, maintain it on a schedule, and you remove the single largest hidden liability in this business.

If you are just starting out, begin by drafting your ECP, getting every technician trained and HBV-offered, and standing up a relationship with a local occupational medicine clinic for post-exposure response. From there, build out IICRC certifications, licensing, and a referral network on top of a compliant foundation. To get more contracts flowing in, make sure your company is listed on BioCleaners Directory so hospitals, coroners, and property managers can find you.

Frequently Asked Questions

Do I need an Exposure Control Plan if I’m a sole proprietor with no employees?

Federal OSHA’s Bloodborne Pathogens Standard applies to employers with one or more employees who have occupational exposure. A true one-person operation with no employees is generally not covered by 1910.1030. However, once you hire your first technician — W-2 or certain 1099 arrangements that OSHA views as employer-employee in substance — you are covered. State licensing, medical waste transport permits, and IICRC standards still apply regardless of employee count, and most commercial clients require a written ECP in the bid package even for sole proprietors.

How often do I have to update my Exposure Control Plan?

At least annually, and whenever new tasks or procedures affect occupational exposure — 1910.1030(c)(1)(iv). Best practice is to sign and date a review sheet on the same date each year. If you add a new service line (for example, adding sewage remediation or meth lab decontamination), update the plan immediately, not at the next annual review.

Can I use an online course to satisfy annual BBP training?

Online content alone does not fully satisfy 1910.1030(g)(2). The rule requires an opportunity for interactive questions and answers with a person knowledgeable in the subject matter as it relates to your workplace. You can use an online course as the content delivery vehicle, but you must pair it with a live (in-person or interactive virtual) Q&A session led by a qualified trainer, and document that the Q&A happened with attendee names and trainer credentials.

What happens if an employee refuses the Hepatitis B vaccine?

They must sign the specific declination statement in Appendix A of 29 CFR 1910.1030 — not a paraphrase. Keep the signed form in their medical file for the duration of employment plus 30 years. The employee retains the right to accept the vaccine later at no cost. Do not pressure, discipline, or treat differently any employee who declines — that itself can trigger a retaliation complaint.

How big are typical OSHA fines for a biohazard cleanup company?

As of 2026, a single serious violation tops out at $16,550, and willful or repeat violations reach $165,514 per violation. An inspection that finds a missing ECP, no training records, and no HBV documentation commonly results in three or more serious citations — a five-figure penalty before any willful findings. Informal settlements often reduce the proposed penalty by 30–60% if the employer abates quickly and shows good faith, but the citation itself still appears in OSHA’s public database, which impacts future contracting.

Is IICRC certification legally required to do biohazard cleanup?

In most states, no — IICRC is a private standards body, not a government licensing authority. However, it functions as the de facto industry standard. Insurance carriers, hospital procurement departments, and plaintiff attorneys benchmark your performance against IICRC S540 (Trauma and Crime Scene). A few states and many municipalities reference IICRC standards in their procurement specs. Practically speaking: certify at least your lead technicians, and treat S540 as the professional standard of care your work will be judged against.

Does HIPAA apply to my biohazard cleanup company?

Only when you become a Business Associate of a Covered Entity — typically a hospital, nursing home, clinic, or health plan. A residential unattended death cleanup for a homeowner does not trigger HIPAA. A contract to clean patient rooms at a hospital does. When HIPAA applies, sign a Business Associate Agreement before work begins, train technicians on PHI handling, and carry cyber/privacy insurance. Violations can reach $2 million+ per category per year.

What’s the difference between federal OSHA and a State Plan state?

Twenty-two states plus Puerto Rico operate their own OSHA-approved State Plans for private-sector employers. State Plans must be at least as effective as federal OSHA but can be stricter. California (Cal/OSHA), Washington (DOSH), and Oregon OSHA are the most notable examples — each has additional or more detailed bloodborne pathogen and aerosol transmissible disease requirements. If you operate across state lines, verify the receiving state’s plan before dispatching crews. Inspections in State Plan states are conducted by state inspectors, not federal OSHA.