If you handle a needle, mop a clinic floor, change a soiled dressing, or run a tattoo shop, the federal rule that keeps you alive lives in one regulation: 29 CFR 1910.1030. OSHA wrote it after a wave of HIV and hepatitis B infections among healthcare workers in the late 1980s, and the agency has refined it twice since. The standard is short by federal-register standards — about a dozen pages — but it touches almost every job that could put human blood or other potentially infectious material onto a worker’s skin, eyes, or scrubs.
The rule has a reputation for being dry. It is not. Once you strip away the legalese, the bloodborne pathogens standard is a workplace safety story about three deadly viruses, a vaccine that costs the boss nothing, and a written plan that has to live somewhere other than a forgotten binder. Miss any of those pieces and you’re looking at a serious or willful citation — and far worse, a worker who didn’t get post-exposure care in time.
This guide walks the entire standard from the perspective of the people who actually have to follow it: nurses, EMTs, lab techs, dental assistants, custodians at correctional facilities, school nurses, body-art artists, and anyone whose job description includes the words “reasonably anticipated occupational exposure.” You’ll see who is covered, what the Exposure Control Plan must contain, why the HBV vaccine is offered at zero cost to you, how OPIM got into the regulation, and what happens in the 12 hours after a needlestick.
Along the way we’ll flag the questions that show up on the OSHA bloodborne pathogens certification exam — not because we want to spoil the test, but because the same questions are the ones supervisors get wrong in real audits.
One framing point before the details. The bloodborne pathogens rule is what OSHA calls a performance-based standard. It tells the employer what outcome to achieve — no occupational exposure — but mostly leaves how to get there up to the workplace. That flexibility is why a 600-bed hospital’s plan looks nothing like a small dental practice’s, even though both must satisfy the same paragraph numbers. Performance language also means the inspector judges the program by results: was anyone exposed, were they protected, did the records hold up.
The standard lists three pathogens by name and then opens the door for everything else with one of the most-cited acronyms in occupational health: OPIM, short for “other potentially infectious materials.” The named three are hepatitis B virus (HBV), hepatitis C virus (HCV), and human immunodeficiency virus (HIV). Each carries a different infection profile, a different survival time outside the body, and a different post-exposure protocol — details we’ll get to.
OPIM matters because it stretches the rule beyond a tube of red blood. The OSHA definition pulls in semen, vaginal secretions, cerebrospinal fluid, synovial fluid, pleural fluid, pericardial fluid, peritoneal fluid, amniotic fluid, saliva in dental procedures, any body fluid visibly contaminated with blood, and any unfixed tissue or organ from a living or dead human. It also includes HIV/HBV cultures and culture media used in research settings. Yes, human tissue is covered — that one trips up morgue staff and pathology technicians who assume the rule only addresses fluids.
What the standard does not include: sweat, tears, urine, feces, vomit, and nasal secretions — unless they contain visible blood. That carve-out shocks people the first time they see it. It exists because the named bloodborne pathogens are not present in meaningful titers in those fluids. Universal precautions still get used on them for general infection control, but they don’t fall under 1910.1030.
HBV is the toughest of the three. It can persist on a dried surface for roughly seven days and still cause infection, which is why hospital surface disinfection schedules don’t treat dried blood as harmless. HCV is even more durable in some studies — viable particles have been recovered up to three weeks later on syringe surfaces. HIV degrades fastest; meaningful infectivity drops off within hours on most dry surfaces. None of that means the cleaning crew should triage by virus — treat every spill as if all three are present. That’s the heart of the universal precautions approach.
Per 29 CFR 1910.1030(b): “Bloodborne pathogens means pathogenic microorganisms that are present in human blood and can cause disease in humans. These pathogens include, but are not limited to, hepatitis B virus (HBV), hepatitis C virus (HCV), and human immunodeficiency virus (HIV).” The phrase but are not limited to is doing real work — the standard adapts as new bloodborne agents appear (think Ebola, Marburg, the next emerging hemorrhagic fever).
The next question is who has to follow the rule. The standard applies to all employees with reasonably anticipated occupational exposure to blood or OPIM. That phrase is broader than it looks. It doesn’t mean “people who actually got blood on them last week.” It means anyone whose job duties create a foreseeable path to contact — even if it has never happened.
Healthcare is the obvious bucket: registered nurses, doctors, dentists, dental assistants, phlebotomists, lab technologists, medical assistants, paramedics, and anyone in a clinic procedure room. But the standard reaches much further. First responders — firefighters, police officers, lifeguards trained to give first aid — fall inside it. So do correctional officers, school nurses, athletic trainers, funeral home staff, tattoo artists, body piercers, housekeepers and laundry workers in healthcare or correctional settings, and HIV/HBV research lab personnel.
What about good-Samaritan first aid by an untrained office worker? Generally outside the scope. But the moment a designated first-aid responder is identified by job title or training, that person is covered and triggers the entire program — including the offer of the HBV vaccine. Employers sometimes try to dodge the standard by refusing to designate a first-aid responder; OSHA reads through that fiction quickly.
Note that the standard explicitly covers exposures that may result from the performance of an employee’s duties. Some inspectors call this the “reasonably anticipated” test — a useful shorthand. It captures rare but foreseeable contacts (a custodian who occasionally cleans up a vomit-and-blood mix) just as cleanly as it covers daily exposures (a phlebotomist drawing blood every fifteen minutes).
A written list of every job classification with occupational exposure, plus the tasks and procedures that create it. Must be specific to the workplace — a generic template copied off the internet fails an audit. The list distinguishes "all duties exposed" jobs (RNs) from "some duties exposed" jobs (a unit clerk who occasionally handles paperwork from a treatment room).
How the employer will implement Universal/Standard Precautions, engineering controls (sharps containers, safer needle devices, splash guards), work practice controls (no recapping, hand hygiene, sharps placement), and PPE selection. Engineering controls take priority — OSHA wants the hazard removed before relying on gloves or masks.
Procedure for offering the hepatitis B vaccine to all exposed employees within 10 working days of assignment, at no cost. Confidential medical evaluation and follow-up after any exposure incident, including source-individual testing where consent allows, baseline blood draw, and CDC-aligned prophylaxis.
The plan must be reviewed and updated at least annually — and whenever new positions or procedures change the exposure picture. The 2001 update added a requirement to document consideration of safer medical devices, and to maintain a sharps injury log (separate from OSHA 300 in most cases) for employers with more than ten employees.
The training pillar is where most small employers stumble. The standard requires training at the time of initial assignment, then annually within twelve months of the previous session — not “sometime next calendar year.” The clock is twelve months from the last documented session. Inspectors check the dates against the certification roster.
Content has to be tailored to the audience. A canned slide deck doesn’t pass if the employees can’t read English and the trainer can’t answer questions in their language.
The training must explain the epidemiology and symptoms of bloodborne diseases, the modes of transmission, the Exposure Control Plan and where to find it, methods to recognize tasks involving exposure, how to use PPE, the meaning of color-coded labels and signs, the HBV vaccine offer, and the steps to follow after an exposure incident. The trainer must be knowledgeable — OSHA explicitly says watching a video alone, without a live person available for questions, doesn’t cut it.
Records get kept for three years (training) and the duration of employment plus thirty years (medical). Medical records include hepatitis B vaccine status, post-exposure evaluations, and any healthcare professional’s written opinion. Those records stay confidential and don’t go in the regular personnel file. Confusing the two record sets is one of the most common citation-worthy mistakes during an OSHA audit.
For workplaces sitting for the OSHA bloodborne pathogens certification — usually a 1- to 2-hour course leading to a printed card or digital credential — expect to be tested on training frequency, the difference between Universal and Standard Precautions, OPIM definitions, sharps disposal, and the post-exposure timeline. Those five buckets account for roughly 80% of the test bank questions on most certification platforms.
The original concept: treat all human blood and OPIM as if known to be infectious. OSHA adopted Universal Precautions in 1991. The newer term, Standard Precautions, comes from the CDC and broadens the principle to all body substances (not just bloodborne ones). For the OSHA standard, the two are functionally interchangeable — the agency formally accepted Standard Precautions as equivalent in a 1999 directive.
Safer sharps devices (retracting needles, blunted suture needles), self-sheathing IV catheters, needleless connectors, sharps disposal containers within arm’s reach of every use point. The 2001 Needlestick Safety and Prevention Act amendment forced employers to evaluate and adopt safer devices each year and document the front-line employee input that drove the choice.
How the work gets done: no recapping or bending of needles by hand, one-handed scoop method only when recapping is unavoidable, sharps placed directly in disposal containers, hand hygiene immediately after glove removal, no eating or applying cosmetics in work areas where blood may be present, and specimens transported in leak-proof labeled containers.
Gloves, gowns, face shields, masks, eye protection, resuscitation devices, and surgical caps where appropriate. The employer pays for it, sizes it correctly, cleans or replaces it, and disposes of contaminated PPE per the standard. Employees are not allowed to take contaminated PPE home for laundering — that’s a strict 1910.1030 prohibition.
PPE deserves a closer look because field auditors find more gaps here than anywhere else. The standard says PPE must be “appropriate” — meaning it doesn’t allow blood or OPIM to pass through to the skin, eyes, mouth, or work clothes under normal conditions of use for the duration the protection is needed. A latex glove that splits the first time the wearer flexes a fist isn’t appropriate. Neither is a paper face shield that fogs up so badly the user can’t see what they’re doing.
Latex allergies forced an industry-wide shift toward nitrile and other synthetic gloves. The employer must make alternatives available to any employee with documented sensitivity at no additional cost. Reusable PPE — like a face shield or splash gown sent through institutional laundry — gets handled by the employer, who must contract with a laundry that knows how to process potentially infectious linens. Bagging requirements (red bags, biohazard labels) apply both in-house and during transport.
Sharps disposal has its own micro-standard. Containers must be puncture-resistant, leak-proof on the sides and bottom, closable, labeled or color-coded, and located as close as feasible to the immediate area where sharps are used. Replace them before they reach the fill line marked by the manufacturer — usually around three-quarters full. Don’t reach into them. Don’t open them. And never, ever recap a needle by holding the cap in the off hand, no matter how careful you think you are. The one-handed scoop method exists for a reason and is on every certification exam.
The hepatitis B vaccine offer is one of the standard’s most generous provisions. Within 10 working days of initial assignment to a job with occupational exposure, the employer must offer the three-dose HBV vaccine series at no cost to the employee, during working hours, by or under the supervision of a licensed healthcare professional.
An employee who declines must sign a specific declination statement — the wording is dictated by Appendix A of the standard. The declination remains in the medical file, and the employee can request the vaccine later at no charge if they change their mind. Documenting that offer (and the declinations) is one of the four most-cited training-record items in any OSHA inspection.
Sharps injury logs entered the standard via the 2001 Needlestick Safety and Prevention Act. Employers with more than ten employees must log every percutaneous injury from a contaminated sharp, recording the device type, the brand, the work area where the incident occurred, and a brief description — while keeping the employee’s identity confidential. The log feeds the annual review of safer-device adoption: if last year’s log shows three sticks from the same brand of insulin syringe, the employer better be able to show what they evaluated to fix it.
Recordkeeping is where many small dental and veterinary practices — veterinary is a great example of a workplace that often slips outside the scope, since 1910.1030 covers human blood — underestimate the burden. The medical record retention requirement of duration of employment plus thirty years is the longest of any OSHA standard. Most facilities outsource it to the occupational health provider for that reason.
What does an inspector actually look at? In a typical bloodborne pathogens audit, the compliance officer asks for the Exposure Control Plan, the training records for the last twelve months, the sharps injury log, the hepatitis B vaccine offer/declination forms, and the annual review documenting the consideration of safer medical devices. If any of those five buckets is incomplete, expect citations. The most frequently cited paragraph numbers in recent years have been 1910.1030(c)(1)(i) (plan not in place), 1910.1030(g)(2)(i) (training not provided or not documented), and 1910.1030(f)(2)(i) (HBV vaccine not offered).
Penalty exposure is real. A serious bloodborne pathogens citation can run up to about $16,000 per item under current penalty schedules; a willful citation pushes well into six figures per item. Multiply by job classifications — an unimplemented plan affecting twelve employees can be twelve separate items — and the bill stacks fast. The bigger cost, though, is usually civil. A documented failure to train, vaccinate, or evaluate after an exposure becomes the foundation of a personal-injury or wrongful-death case if a worker seroconverts.
State-plan states sometimes go further. California and Washington run bloodborne pathogen standards that mirror 1910.1030 closely but add their own twists — California’s ATD (Aerosol Transmissible Diseases) standard layers another set of requirements on top of bloodborne for many of the same job classifications. If you work in one of the 22 states with an OSHA-approved state plan, read your state rule alongside the federal one. The federal standard is the floor; your state may sit higher.
Certification platforms outside OSHA itself — the National Safety Council, the American Red Cross, ASHI, plus a number of online-only vendors — sell bloodborne pathogens cards that satisfy the training requirement. OSHA does not issue or endorse any particular card. Any course that covers the items listed in paragraph (g)(2)(vii) of the standard and provides for an instructor to answer questions can qualify. The card itself is just convenient proof of attendance; the underlying training records still have to live with the employer for three years.
The most-tested exam questions follow predictable patterns. How long can bloodborne pathogens survive on a surface? — HBV up to 7 days, HCV potentially longer, HIV hours. What does OPIM stand for? — Other Potentially Infectious Materials. What is the primary purpose of the standard? — to eliminate or minimize occupational exposure to bloodborne pathogens. When must the HBV vaccine be offered? — within 10 working days of initial assignment, at no cost. Who pays for PPE? — the employer. Recognize those five facts and you’ve got the spine of every certification quiz on the market.
If you’re a supervisor or compliance lead writing your first Exposure Control Plan, don’t treat 1910.1030 as paperwork. The plan is the operating manual that determines whether an exposure incident ends with a coffee-room story or a chronic infection. Build it around real job titles in your shop. Schedule the safer-device review on the calendar. Designate a medical evaluator before someone gets stuck, not at 2 a.m. the night of the incident.
Looking for more on OSHA’s broader rule set? Our deep-dive on OSHA standards covers the umbrella structure, while the hazard communication standard explainer walks through HazCom — another rule with major intersections with bloodborne work, especially around chemical disinfectants used to clean blood spills. The OSHA 300 log guide explains how needlesticks intersect (or don’t) with the broader injury recordkeeping system. And if you need certification, the OSHA certification overview lists card paths.
The bloodborne pathogens standard rewards employers who treat it as a living program rather than a binder. The Exposure Control Plan that comes out best in an inspection is the one that has annotations from the last device-evaluation meeting, the most recent training roster taped to the inside cover, and the post-exposure evaluator’s phone number written legibly enough that a night-shift charge nurse can read it under panic-quality lighting. The standard doesn’t require any of those touches. It just rewards them.
Workers protected by 1910.1030 should know two things by heart. First: every glove, every sharps container, every dose of hepatitis B vaccine, and every post-exposure evaluation is paid by the employer — not the worker, not the worker’s insurance. Second: the post-exposure clock starts ticking the second the skin gets pierced.
HIV PEP works best within two hours, and the standard exists in part to make sure that two-hour window doesn’t close while someone is hunting for a binder. If the system fails the worker, OSHA wants to know — the agency’s complaint hotline is open 24/7 and the standard’s whistleblower protections are some of the strongest in federal labor law.
OSHA hasn’t materially rewritten 1910.1030 since the 2001 needlestick amendment. The 2010 letter on hepatitis C testing and the 2013 letter on dental water-line management nudged interpretation but kept the framework. Expect that to hold until the next emerging-pathogen wave forces a refresh. In the meantime, the rule reads the same way it did twenty years ago: identify the exposure, plan the controls, offer the vaccine, train the people, document everything, and never assume a fluid is clean just because it looks that way.