What Does the Bloodborne Pathogens Standard Require?

Every year OSHA fines hundreds of businesses over its bloodborne pathogens rule — and usually not because they didn't care, but because they couldn't tell what it actually asked of them. The rule isn't long. It's just written for lawyers rather than for the person who has to follow it.

So here it's as a list of things rather than as a regulation. If you're an employee, this is what you're owed. If you run the place, it's the same list from the other side.

Duties on one side, entitlements on the other

The standard creates duties for employers. That sounds like it's somebody else's problem until you notice the shape of it: every duty it places on an employer is a thing an employee is entitled to. Training you don't pay for. Equipment that fits. A vaccine offered rather than mentioned. Somebody to tell, and a process that runs afterward.

It's worth being clear about what it is not. It is not a certification scheme and it does not license anybody. It sets requirements on workplaces, and the question of who satisfies them is a separate one from what they are.

The test the law applies

The test is whether contact with blood or other infectious material is a reasonably anticipated part of your job — not whether it has happened, and not whether it's likely today. If it's a foreseeable part of the work, you're covered.

Your employer is required to make that determination in writing, by job role, rather than leaving it to individuals to work out. So the honest answer to "am I covered?" is often: your employer has already decided, and you're entitled to know what they decided.

It's emphatically not a healthcare-only rule. Custodial and cleaning crews, schools, corrections, transit, childcare, laundry, waste handling, tattoo and body-art studios, and anyone designated as a workplace designated first aid responder are all realistically in scope. For cleaning crews specifically the applicability question has its own answer, because it turns on assignment rather than on the building you work in.

One boundary worth knowing: helping someone as a good Samaritan is generally not covered. If you step in at an accident outside your assigned duties, that's a different situation from cleaning a spill as part of your job — and conflating the two would misstate what your employer owes you either way.

There's one assumption that catches small employers repeatedly, and it isn't carelessness — it's a sensible generalization from the rest of workplace regulation, where small-business exemptions genuinely do exist.

The written plan, and your right to read it

Every covered employer must have a written exposure control plan. Not an intention, not a folder of training certificates — a document that says who is at risk, what is being done about it, and what happens when something goes wrong. It has to be reviewed and updated at least annually, and whenever tasks or procedures change.

That last line is the practical value of knowing this. A plan that exists but can't be located when asked for is, for every purpose that matters to you, a plan that doesn't exist — and the moment you need to know who to tell isn't the moment to start looking for it.

Training: what it has to include

The training obligation is more specific than most people expect, and the specifics are where employers most often fall short.

• When you're assigned to the work — before exposure, not at some point afterward.

• At least once a year after that, and again if your tasks change enough to alter your risk.

• At no cost to you, and during working hours — not on your own time and not out of your own pocket.

• Covering the specifics of your workplace — the plan, the controls you actually have, and what to do after an exposure.

• With an opportunity for interactive questions and answers with someone knowledgeable about the subject.

That last requirement is the one people are surprised by, and it's worth reading carefully rather than through: the standard asks for a way to ask questions and get answers from someone who knows the material. It's a requirement about access to a person, not about a format.

The vaccine you should be offered

Of everything in this rule, this is the most concrete thing you're owed. The vaccine must be offered to you, at no cost, within 10 working days of being assigned to covered work — before exposure rather than after it.

You may decline, and if you do you'll be asked to sign a declination form. That form isn't a waiver of anything and it isn't permanent: you can change your mind later and still receive the vaccine at no cost. People who declined years ago frequently don't know that.

It's worth knowing why this vaccine in particular: of the three viruses this rule is organized around, hepatitis B is the most readily transmitted at work and the only one you can be protected against in advance.

The rest of the duties, briefly

The remaining duties are less commonly known and no less real.

• Protective equipment — provided at no cost, in a size that fits and accessible where the work is, then cleaned, repaired or replaced as needed and disposed of, all at their expense. What to wear and when is a decision, not an inventory.

• Engineering and work-practice controls — sharps containers, safer devices, and procedures that reduce exposure. These come before relying on people being careful.

• A sharps injury log, where the employer is required to keep one.

• Labels and signs on regulated waste, contaminated equipment and storage.

• Post-exposure evaluation and follow-up — confidential, at no cost. What that actually involves.

• Records kept — medical records for the duration of employment plus 30 years, and training records for 3 years.

When an employer doesn’t do it

Enforcement works by inspection and citation, with penalties attached. The more useful thing to know is what people actually get cited for, because it doubles as a checklist: no written plan, no annual training, no vaccine offer, and no records — the paperwork obligations rather than the dramatic failures. That's worth noticing if you run somewhere. The gap is rarely the equipment; it's the document nobody wrote.

If you're an employee and something here is missing, the first step is usually asking — a surprising amount of non-compliance is an employer who didn't know rather than one who declined. Beyond that, you can raise a complaint, and it's unlawful for your employer to retaliate against you for doing so. That covers raising a safety concern with your employer, filing a complaint, and taking part in an inspection; retaliation means firing, demotion, threats, or cutting your pay or hours. The remedies include getting your job back and being paid what you lost.

There's a catch in that protection and it's worth knowing before you need it, because it's short: a retaliation complaint has to be filed within 30 days of the thing you're complaining about. Not thirty working days — thirty. So the protection is real and the window isn't generous, which makes "wait and see whether it settles down" the one response that can cost you it.

Your state may ask for more

Roughly half the country runs its own workplace-safety plan rather than being covered directly by the federal one. The rule for those is simple in principle: a state plan may be stricter than the federal standard, but never weaker.

So everything above is a floor rather than a ceiling, and your state may add to it — extra training requirements, extra record-keeping, or specific rules for particular industries. This page doesn't list which states do what, deliberately: that changes, and a list that goes stale is worse than knowing to check. Your state's occupational-safety agency is the place to look.

Put it into practice

Training scenario:

You run a small residential cleaning company — you, a supervisor, and eleven cleaners across a mix of offices, two gyms and a medical practice. A client's facilities manager has asked for a copy of your bloodborne pathogens exposure control plan before renewing the contract. You've never been asked for one. What you do have is a folder of certificates from an online course three of your staff took when you won the medical practice account four years ago.

Walking it through:

The four: there's no written exposure control plan — which is what the client asked for and the easiest to notice. Training hasn't been annual; four years ago isn't a cycle. It covered three of eleven staff, when the determination should be by role and most of these roles are foreseeably exposed. And there's no sign anybody has been offered the hepatitis B vaccine.

The one that matters most is the vaccine. The missing plan is a document you can write this week, and the training is a booking. The vaccine is the only item on that list that would have protected somebody in advance — and it's the one nobody was asking about, because clients ask for paperwork and paperwork is what gets noticed.

Worth noticing too: the trigger here was a customer, not an inspection. That's the ordinary way small employers discover this, and it's why the paperwork duties dominate the citation lists — not because the physical controls are usually fine, but because a missing document is the thing that gets found.