Bloodborne Pathogens Training: OSHA Requirements & Annual Recertification (2026)

OSHA 29 CFR 1910.1030 bloodborne pathogens training requirements. Who needs it, what it covers, annual retraining rules, and how to document compliance

Bloodborne pathogens training isn’t just for nurses and paramedics. OSHA’s bloodborne pathogens standard, 29 CFR 1910.1030, applies to any worker with “reasonably anticipated” exposure to blood or other potentially infectious materials (OPIM). That’s a broader group than most employers realize.

First responders, laboratory workers, school nurses, tattoo artists, janitorial workers at healthcare facilities, commercial laundry workers who handle soiled linens, and correctional officers all fall under this standard. So do some construction workers if they’re on sites where blood exposure is a real possibility. If your job regularly puts you in contact with blood or bodily fluids, you likely need this training whether your job title says “medical” or not.

What Counts as Occupational Exposure

OSHA defines occupational exposure as “reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials that may result from the performance of an employee’s duties.”

The phrase “reasonably anticipated” does a lot of work in that definition. An office worker who might theoretically help someone who cuts themselves doesn’t meet this standard. A school custodian who regularly cleans up blood from playground injuries does. The standard is about what your job actually requires you to do, not every remote possibility.

OPIM goes beyond just blood. It includes semen, vaginal secretions, cerebrospinal fluid, synovial fluid, pleural fluid, pericardial fluid, peritoneal fluid, amniotic fluid, any body fluid visibly contaminated with blood, unfixed human tissues or organs, and certain laboratory cell cultures. Saliva is included specifically in dental procedures.

If you’re unsure whether your workers meet the occupational exposure threshold, err toward yes. The training is inexpensive and the exposure control plan (more on that below) will clarify who’s actually covered.

What BBP Training Must Cover

OSHA 29 CFR 1910.1030(g)(2)(vii) specifies exactly what BBP training must include. This is where a lot of generic online courses fall short.

Required content includes:

An accessible copy of the regulatory text and an explanation of its contents
Epidemiology and symptoms of bloodborne diseases, including at minimum HIV, Hepatitis B, and Hepatitis C
How bloodborne pathogens are transmitted
The employer’s Exposure Control Plan and how workers can get a copy
How to recognize tasks that may involve exposure
Use and limitations of engineering controls, work practice controls, and PPE
Proper use, location, removal, handling, decontamination, and disposal of PPE
Basis for PPE selection
Information on the Hepatitis B vaccine, including efficacy, safety, and the fact that the employer offers it free
Post-exposure evaluation and follow-up procedures
Signs, labels, and color-coding requirements under the standard

That last content item on the original list matters the most in practice: workers must have an opportunity to ask questions of the trainer. Not just read a document or click through slides. An actual interaction.

That requirement is where online-only courses get into trouble. OSHA has cited employers for BBP training programs that provide no mechanism for employee questions or interaction with a knowledgeable trainer. OSHA citations for BBP violations can run into the thousands of dollars per violation, see the OSHA fines and penalties guide for current amounts. If you’re using an online course, check whether it includes a live Q&A component, a way to submit questions to a subject matter expert, or access to a trainer. Many cheap online modules don’t. Some OSHA area offices will cite that as non-compliance.

The training must be provided in a language and literacy level workers can understand. If your workforce includes workers whose primary language isn’t English, a module in English only doesn’t satisfy the standard for those workers.

The Hepatitis B Vaccine Requirement

Employers are required to offer the full Hepatitis B vaccine series to all workers with occupational exposure. This must happen at no cost to the employee, after training is complete, and within 10 working days of initial assignment.

Workers can decline. But they must sign a declination form. OSHA provides a standard template in the regulatory text. Keep a copy of every signed declination.

A worker who declines can change their mind later. If they do, the employer must provide the vaccine series at no cost at that point. Workers who have already completed the HBV series or have immunity documented by a healthcare provider don’t need to go through the process again.

This isn’t a recommendation. OSHA requires it. Small employers often miss this requirement entirely because they focus on the training and ignore the medical provisions.

Post-Exposure Evaluation

When a worker has a potential exposure incident, the employer must provide a confidential medical evaluation at no cost. This is non-optional and it isn’t covered by your standard workers’ compensation policy in most cases.

The evaluation must include:

Documentation of the route of exposure and the circumstances of the incident
Testing of the source individual’s blood (with their consent) for HIV and HBV/HCV status
Collection and testing of the exposed worker’s blood, if the worker consents
Post-exposure prophylaxis when medically indicated
Follow-up evaluation and counseling
Written evaluation from the healthcare professional within 15 days

Many small employers discover this requirement only after an exposure incident occurs. By then it’s too late to set up a process in advance. Build a relationship with an occupational medicine clinic before you need one. Know exactly where you’ll send a worker if there’s a needlestick.

All medical evaluations and records must remain confidential. You can know whether a worker received the vaccine and whether they need follow-up care. You can’t access their test results.

The Exposure Control Plan

This is what most employers miss completely. OSHA 1910.1030 requires a written Exposure Control Plan (ECP), not just training.

The ECP must:

Identify all job classifications where workers have occupational exposure
Identify job classifications where some tasks may involve occupational exposure (and specify which tasks)
Document the methods used to implement engineering controls, work practice controls, and PPE requirements
Include procedures for evaluating circumstances of exposure incidents
Be reviewed and updated at least annually
Reflect any new or modified tasks and procedures that affect occupational exposure

Workers must be involved in selecting engineering controls. This isn’t a formality. OSHA inspectors ask about it. Document how you gathered worker input.

The plan doesn’t have to be long. A small clinic or dental office with five workers with occupational exposure can have a two-page ECP. But it must exist in writing, it must be specific to your workplace, and it must be accessible to workers during their shift.

Using a generic template without customizing it to your actual workplace doesn’t satisfy the requirement. OSHA inspectors can and do cite employers who have a plan that doesn’t match their actual operations.

Annual Retraining Requirements

Training must happen at initial assignment and then at least annually after that. “At least annually” means within 12 months of the previous training date, not calendar year.

The annual retraining doesn’t have to cover everything from the initial session if nothing has changed. But if you’ve introduced new procedures, new equipment, or new job categories with exposure, those changes must be covered in retraining.

Annual retraining records must be maintained for three years. Records must include the dates of training sessions, the content or a summary of what was covered, the names and qualifications of the trainers, and the names and job titles of everyone who attended.

If an OSHA inspector shows up and asks for BBP training records, you need to produce them on the spot or within a very short time. “We trained everyone, we just don’t have the records” is the same as not training them from an enforcement standpoint.

Documentation That Protects You

Every component of your BBP compliance program should be documented. That means:

Signed training records with dates, trainer name and qualifications, and attendee signatures
Signed HBV vaccine acceptances or declinations
Your written Exposure Control Plan with the review date
Incident reports for any exposure events and the medical records file (kept separately, confidentially)

OSHA’s general standard for retaining BBP training records is three years. Medical records must be kept for the duration of employment plus 30 years under the general medical records standard at 29 CFR 1910.1020.

Keep these records in separate files. Training records don’t belong in personnel files. Medical records absolutely don’t belong in personnel files.

Frequently Asked Questions

Does a designated first aid responder need bloodborne pathogens training?

Yes. OSHA specifically calls out first aid responders in the bloodborne pathogens standard. If your company has designated workers to provide first aid as part of their job duties, those workers have occupational exposure and need BBP training. This includes industrial first aid responders at manufacturing facilities, not just healthcare workers. Workers in those roles often also complete OSHA 10 general industry training as part of their broader safety orientation.

How long does bloodborne pathogens training take?

Initial training typically takes one to two hours. Annual retraining is often shorter, around 30 to 60 minutes, if no significant changes have occurred in your workplace. The standard doesn’t specify a minimum number of hours. What matters is that all required content is covered and workers have an opportunity to ask questions.

Is online BBP training OSHA compliant?

It can be, but not all online training is. The training must cover all required content under 29 CFR 1910.1030(g)(2)(vii) and must provide workers with an opportunity to ask questions of a knowledgeable trainer. Online courses that offer no interaction with a trainer, just a video and a quiz, may not meet this requirement. Some OSHA area offices have taken that position. If you use online training, confirm it includes a mechanism for employee questions and document that mechanism.

What happens if an employee refuses the Hepatitis B vaccine?

The employee must sign a declination form. OSHA provides a standard declination statement in the regulatory text. File a copy of every signed declination. The employer’s obligation is to offer the vaccine and document the offer, not to force acceptance. The worker can change their mind at any point and receive the vaccine at employer expense.

Do office workers need BBP training?

Generally no. Office workers who have no occupational exposure to blood or OPIM don’t fall under the standard. But if an office worker is also a designated first aid responder who may respond to injuries, they do have occupational exposure and need training. The job duties drive the requirement, not the job title.

How do I document BBP training for OSHA compliance?

Keep a training record for every session that includes the date, a summary of the content covered, the name and qualifications of the trainer, and a signature list of every attendee with their job titles. Store these records for at least three years. OSHA inspectors routinely request training records during site inspections. Keep them somewhere you can retrieve them quickly.

Sources: OSHA Bloodborne Pathogens Standard | 29 CFR 1910.1030 | CDC/NIOSH Bloodborne Infectious Diseases

Pick the Right Credential and Validate Training Quality

Find What You Need

Compare Options

Check State Rules

Verify Provider