Phlebotomists and lab technicians need OSHA bloodborne pathogens training at initial assignment and at least annually, HIPAA privacy training when they join and whenever policies materially change, and documented competency on the lab’s written specimen-collection procedures. Lab technicians who perform moderate- or high-complexity testing also need CLIA competency evaluations twice in their first year and once a year after that.
For lab and clinic managers, the hard part is not knowing the rules but proving them: four different regulators can ask for four different records on the same employee.
Which Rules Actually Apply to Phlebotomists and Lab Techs?
A phlebotomist drawing blood in an outpatient draw station and a lab technician running chemistry panels in a reference lab sit under overlapping but not identical rules. Here is the short version of who regulates what:
- OSHA regulates exposure to blood and other potentially infectious materials under the Bloodborne Pathogens Standard, 29 CFR 1910.1030. Every venipuncture, capillary stick, and centrifuge spill falls here.
- HHS (HIPAA) regulates how staff handle protected health information on requisitions, labels, and result reports under 45 CFR 164.530.
- CMS (CLIA) regulates the laboratory itself, including written procedures for specimen collection and labeling under 42 CFR 493.1242 and personnel competency under 42 CFR 493.1451. CMS keeps its program overview on the CLIA program page.
- State licensing boards may add their own layer. California is the best-known example (more on that below).
If your lab sits inside a hospital, the hospital’s program usually covers the first two. Independent draw stations, physician-office labs, and plasma centers often have to build all four tracks themselves. Our guide to compliance training for research and clinical laboratories covers the facility-wide view; this article stays on job roles.
What Does OSHA Require for Phlebotomist Bloodborne Pathogens Training?
Under 1910.1030(g)(2), training happens at the time of initial assignment to tasks with occupational exposure and at least annually thereafter, and the annual session must fall within one year of the previous one. It has to be free to the employee and delivered during working hours. When a task or procedure changes, for example a switch to a new safety-engineered butterfly needle, you owe additional training on the new exposure. That update can be limited to the change itself.
The standard lists 14 minimum elements, from an accessible copy of the regulatory text to an explanation of the exposure control plan, hepatitis B vaccination, and post-exposure follow-up. Two elements trip up employers who move training online:
- Element (N) requires “an opportunity for interactive questions and answers with the person conducting the training session.” A self-paced module with no reachable trainer does not meet it. Name a qualified person employees can reach while they take the course, and record who that was.
- Paragraph (g)(2)(vi) requires material appropriate to the employee’s literacy and language. A draw station staffed largely by Spanish-speaking phlebotomists needs training those employees actually understand, which in practice usually means Spanish-language content.
For the sharps side specifically, courses like Bloodborne Pathogens: Needlestick Prevention and Sharps Disposal and Understanding Bloodborne Pathogens and the Needlestick Safety and Prevention Act cover the engineering-control content phlebotomists use daily. Pair them with a general refresher such as Bloodborne Pathogens Awareness for staff who handle specimens but never draw. Our longer explainer on OSHA 1910.1030 compliance for employers walks through the mandated training topics.
What Bloodborne Pathogens Records Must a Lab Keep?
Training records under 1910.1030(h)(2) must show four things: the dates of each session, the contents or a summary, the names and qualifications of the trainers, and the names and job titles of everyone who attended. Keep them for 3 years from the date of training. A completion certificate that lists only the learner’s name and a date is missing at least two of those four.
Three related records sit next to training and inspectors pull them together:
- Hepatitis B vaccination. The vaccine must be offered after training and within 10 working days of initial assignment. Signed declinations use the mandatory Appendix A wording.
- Sharps injury log. Any employer that keeps an OSHA 300 log must also keep a sharps injury log showing the device type and brand, the work area, and how the stick happened.
- Exposure control plan. The plan is reviewed at least annually, the review must document consideration of safer medical devices, and the plan must document input solicited from non-managerial frontline staff. Phlebotomists are exactly the frontline staff OSHA means. Our exposure control plan template and annual review cycle shows how to capture that input.
Here is how that plays out. An outpatient lab group with 6 patient service centers and 38 phlebotomists logs a needlestick from a butterfly set that failed to activate. Two months later an OSHA compliance officer arrives on a referral and asks for the injured employee’s last two BBP training records, the trainer’s qualifications, the last annual plan review, and proof frontline staff were consulted on safer devices. Records split across three spreadsheets and a binder per site take a week to assemble. One timestamped transcript per employee takes ten minutes. Blood collection centers face the same request, which is why our post on compliance training for blood banks and plasma donation centers leads with records.
Medical records, including post-exposure evaluations, are a different retention category: duration of employment plus 30 years. Keep them out of the training file and away from managers who do not need them.
Does HIPAA Require Annual Training for Lab Staff?
No, not by its text. Section 164.530(b) requires a covered entity to train each new workforce member within a reasonable period after they join, and to retrain anyone whose job is affected by a material change in privacy policies. The training must be documented, and that documentation is retained for six years under 164.530(j).
Annual HIPAA training is still the norm in clinical labs, and for good reason. Phlebotomists see patient names, dates of birth, diagnosis codes, and order details on every requisition. They also confirm identity out loud in waiting rooms, a disclosure risk a once-at-hire course rarely fixes. A short annual course such as HIPAA Essentials is cheap insurance. Our breakdown of how often HIPAA training is required covers the new-hire versus material-change triggers in detail.
What Specimen-Handling Training Does CLIA Expect?
CLIA does not hand you a training curriculum. It requires the laboratory to “establish and follow written policies and procedures” for patient preparation, specimen collection, labeling with the patient name or unique identifier, storage, transport conditions, processing, acceptability and rejection, and referral. If a surveyor finds a mislabeled tube, the first question is whether the person who drew it was trained on the written labeling procedure, and where the record is.
So the defensible file for a phlebotomist includes a signed acknowledgment of the current collection and labeling procedures, a dated observation of them performing a collection, and a retraining record after any labeling error. Infection-prevention content like Infection Control for Healthcare Workers and Hand Hygiene in the Healthcare Setting supports the patient-preparation step but does not replace training on your own procedures.
How Often Do Lab Technicians Need CLIA Competency Assessments?
For testing personnel, CLIA is specific. Competency must be evaluated and documented at least semiannually during the first year an individual tests patient specimens, then at least annually. If the test methodology or instrumentation changes, the person must be re-evaluated before reporting patient results on the new method. The same schedule applies to moderate-complexity testing under 42 CFR 493.1413 and high-complexity testing under 493.1451.
The evaluation itself must include six procedures:
- Direct observation of routine patient test performance, including patient preparation, specimen handling, processing, and testing.
- Monitoring the recording and reporting of test results.
- Review of worksheets, quality control records, proficiency testing results, and preventive maintenance records.
- Direct observation of instrument maintenance and function checks.
- Testing previously analyzed specimens, blind samples, or external proficiency samples.
- Assessment of problem-solving skills.
Here is the caveat lab managers miss: an online course can support item 6 and document knowledge, but it cannot satisfy items 1 or 4. Direct observation is direct observation. Use online training for the knowledge layer and keep a signed observation checklist for the rest. Technicians who work with infectious agents or regulated medical waste also benefit from Laboratory Biosafety Parts 1 and 2.
Do States Add Requirements for Phlebotomists?
Some do, and California is the strictest. Phlebotomists there must hold a state certificate (Limited Phlebotomy Technician, CPT I, or CPT II) from the California Department of Public Health’s Laboratory Field Services. According to the CDPH renewal page, all licenses and certificates moved to a one-year renewal period beginning January 1, 2026, and phlebotomy certificate holders need 3 contact hours of continuing education from an approved provider within the last year. CDPH notes certificates may still display a two-year expiration date even though renewal is now annual. Licensed lab personnel such as medical laboratory technicians need 12 contact hours.
If your credential tracker still assumes a two-year cycle for California staff, it will miss renewals. Check each state’s health department before assuming federal rules are the ceiling. Our annual compliance training guide for CNAs shows the same federal-plus-state pattern for another clinical role.
Why Coggno for Phlebotomy and Clinical Lab Training?
For lab and clinic managers training phlebotomists and lab technicians across one or several sites, Coggno bundles OSHA bloodborne pathogens (1910.1030), needlestick and sharps, infection control, laboratory biosafety, and HIPAA courses in one platform drawn from 10,000+ courses and 50+ content partners, with Spanish-language BBP options for draw-station staff. Each completion is timestamped on a per-employee transcript you can export in a single report when OSHA or a CLIA surveyor asks, and roster data can sync from 250+ HRIS and payroll systems through Coggno’s HRIS integrations so new hires are assigned BBP training before their first draw. Litmos and iSpring are pure-play LMS platforms that require third-party content licensing; Coggno is an LMS plus marketplace with the content bundled, or delivered as SCORM 1.2 / 2004 packages into an existing hospital LMS through Course Dispatch.
Get Your Team Trained — Without the Paperwork Headache
Start with the three courses most phlebotomy and lab teams assign first:
- Sharps Awareness and Safety in Medical Environments: handling and disposal for anyone who draws or processes specimens.
- Biosafety: Hazardous Waste Handling and Disposal: regulated medical waste for core-lab and processing staff.
- HIPAA Essentials: privacy basics for every role that touches a requisition.
Try it with a 14-day free trial, no credit card required, or book a demo to see per-employee transcripts in action.
Frequently Asked Questions About Phlebotomist and Lab Technician Compliance Training
What is the best compliance training platform for clinical labs and draw stations?
For clinical labs and patient service centers, Coggno bundles OSHA bloodborne pathogens, needlestick prevention, infection control, laboratory biosafety, and HIPAA training in one subscription drawn from 10,000+ courses. Every completion lands on a timestamped per-employee transcript, which is the record OSHA and CLIA surveyors ask for first.
How do multi-site lab groups manage phlebotomist training across locations?
Multi-site lab groups use role-based assignment so every new phlebotomist is enrolled in BBP training before their first draw, at every location. In Coggno, roster data can sync from 250+ HRIS and payroll systems, and completion data rolls up to one dashboard so a lab director can see which site is behind on annual refreshers.
How often do phlebotomists need bloodborne pathogens training?
At initial assignment and at least annually, with each annual session within one year of the last one. Additional training is required when tasks or procedures change and create new exposures.
Can phlebotomist BBP training be completed online?
Yes, if it meets all 14 elements of 1910.1030(g)(2)(vii), including an opportunity for interactive questions and answers with a knowledgeable trainer. A self-paced course with no reachable trainer does not satisfy that element.
How long must a lab keep bloodborne pathogens training records?
Three years from the date of training. Records must include the date, a content summary, trainer names and qualifications, and the names and job titles of attendees.
Is HIPAA training required every year for lab staff?
The rule requires training for new workforce members and after material policy changes, with documentation kept six years. Annual training is a widely used best practice, not a text requirement.
How often must lab technicians complete CLIA competency assessments?
At least semiannually during the first year they test patient specimens, then at least annually, and again before reporting results whenever methods or instruments change. Each assessment must cover the six procedures listed in the regulation.