OSHA 29 CFR 1910.1030 requires bloodborne pathogens training before assignment, then again every 12 months — paid by the employer, on the clock. It pulls in a lot more than nurses and EMTs. Custodial staff, school front offices, tattoo artists, dental hygienists, and any employee on a designated first-aid roster are in scope the moment exposure is “reasonably anticipated.”
For HR managers and safety officers, the real question isn’t whether you need this training. It’s whether your records will hold up when an inspector or insurance auditor asks for them. Below: what 1910.1030 actually requires, who’s in scope, what your training has to cover, and the spots employers consistently miss.
Who Is Covered Under OSHA’s Bloodborne Pathogens Standard?
The trigger is “occupational exposure” — defined in the rule as reasonably anticipated skin, eye, mucous-membrane, or parenteral contact with blood or OPIM (other potentially infectious materials) during the course of work. That phrase is broader than most employers assume, and it has caught a lot of small businesses by surprise.
Healthcare workers are the obvious bucket — nurses, dentists, paramedics, lab techs. The non-obvious list is longer than people expect: custodians who clean restrooms, school nurses and front-desk staff handling nosebleeds, daycare workers, body-art professionals, funeral-home staff, plumbers servicing medical buildings, and corrections officers all fall in. A school district in Wisconsin got cited last year because the custodian who responded to a student vomiting blood had no BBP training and no PPE on the cart. Bloodborne pathogens training courses walks through the at-risk roles in more detail.
The “designated first-aid responder” gray area trips up a lot of small employers. If your company has a written policy that any employee may render first aid as a collateral duty, those volunteers fall under 1910.1030 and need full training, hepatitis B vaccination offers, and exposure incident protocols. If first aid is handled exclusively by the local fire/EMS response, the standard usually doesn’t apply to your office staff. The line is whether the work is “reasonably anticipated.”
Industries with surprise coverage include schools (custodial cleanup of vomit and blood spills sits next to OPIM under the OSHA general duty clause), gyms and fitness centers, hospitality housekeeping, and any workplace running a CPR/AED program with named responders. Bloodborne Pathogens Awareness is the baseline most general-industry employers use for cross-functional staff with incidental exposure risk.
What Does the OSHA 1910.1030 Standard Actually Require?
Six things have to be in place: a written Exposure Control Plan, training, hepatitis B vaccination, engineering and work-practice controls, PPE, and post-exposure follow-up. Skip any one of them and the others stop carrying weight. Training without a current ECP is paperwork. PPE without training is theater.
The Exposure Control Plan is the core artifact, and inspectors ask for it first. It needs to spell out the at-risk job classifications, the tasks that create exposure, your compliance methods (engineering controls, work practices, PPE), the hep B vaccination schedule, and the post-exposure evaluation procedure. Review it every year and update it when you adopt new safer-sharps technology — that annual review is 1910.1030(c)(1)(iv), and it’s the line most employers miss until an inspector points to a stale plan from 2019.
The Hepatitis B vaccination requirement is unusual: the employer must offer the three-dose series at no cost to any employee with occupational exposure, within 10 working days of initial assignment. Employees who decline must sign a specific declination form (the wording is in Appendix A of the standard — don’t paraphrase it). They can change their mind later and still receive the series.
Engineering controls include sharps disposal containers, self-sheathing needles, sharps with engineered injury protection (SESIP), and needleless systems. Under the Needlestick Safety and Prevention Act, employers must document why they chose specific devices and involve frontline workers in the selection. A complete guide to OSHA covers how the agency’s enforcement priorities have shifted around healthcare-adjacent industries since 2024.
What Training Topics Does 1910.1030 Mandate?
The training content list in 1910.1030(g)(2)(vii) is non-negotiable — every element must be covered, every time. There are 14 specific topics, and OSHA inspectors will ask employees about them point-blank during a citation review.
The required topics include: an accessible copy of the regulation and an explanation of its contents; epidemiology and symptoms of bloodborne diseases; modes of transmission; the employer’s Exposure Control Plan and how to obtain a copy; recognition of tasks involving exposure; methods to prevent exposure including engineering controls and work practices; types and use of PPE; hepatitis B vaccine information; actions to take in an emergency involving blood or OPIM; the procedure to follow after an exposure incident; post-exposure evaluation and follow-up; signs, labels, and color-coding; and an opportunity for interactive Q&A with someone knowledgeable about the topic.
The Q&A piece is the part most LMS-only programs fail. OSHA explicitly requires “an opportunity for interactive questions and answers with the person conducting the training.” Pre-recorded video alone does not satisfy this — you need a live trainer, a Q&A session, an email channel to a qualified instructor, or another mechanism that lets employees ask follow-up questions and get qualified answers. Bloodborne Pathogens: Universal Precautions covers the technical content and pairs with an internal Q&A protocol for full compliance.
The training frequency is initial (before assignment to tasks with potential exposure) and at least annually thereafter. Additional training is required when changes in tasks or procedures affect employee exposure — for example, switching from a traditional needle to a SESIP device, or adopting a new spill cleanup procedure. The annual refresher does not have to repeat all 14 topics word-for-word, but it must address the same scope and be documented.
What Records Must Employers Keep?
The recordkeeping requirements at 1910.1030(h) are specific and the retention periods are long. Two record types are required: training records and medical records, and they have very different rules.
Training records must include the dates of training sessions, contents or summary of the training, names and qualifications of the trainers, and the names and job titles of attendees. Retain for 3 years from the date of training. Benefits of health and safety training spells out why audit-ready training records matter beyond the OSHA citation — they’re often the first thing requested in a workers’ compensation review.
Medical records for each employee with occupational exposure include the employee’s name, hepatitis B vaccination status (including dates of all vaccinations and any medical records relative to the employee’s ability to receive vaccination), results of examinations and follow-up procedures, the healthcare professional’s written opinion, and a copy of the information provided to the healthcare professional. Retain for the duration of employment plus 30 years. The 30-year requirement comes from the broader 29 CFR 1910.1020 employee medical records standard and surprises a lot of new HR managers.
The Sharps Injury Log is a third category often overlooked. Employers with 11+ employees must maintain a log of percutaneous injuries from contaminated sharps, recording the type and brand of device, the department or work area where the incident occurred, and an explanation of how the incident occurred. This log feeds the annual ECP review under 1910.1030(c)(1)(iv) — it’s how you demonstrate you considered new technology in response to incidents.
What Are the Penalties for Bloodborne Pathogens Violations?
OSHA’s 2026 penalty schedule sets serious violations at up to $16,550 per violation and willful or repeated violations at up to $165,514 — adjusted for inflation each January. Bloodborne pathogens citations frequently land in the willful bucket because the standard has been around since 1991 and the requirements are well-known.
Common citation patterns: missing or stale Exposure Control Plan ($16K serious), failure to offer hepatitis B vaccination ($16K per affected employee), inadequate training records ($16K per employee for whom records are missing), and failure to use engineering controls when reasonable alternatives exist (often willful at $50K+). The 2024 OSHA enforcement data showed bloodborne pathogens in the top 25 most-cited general industry standards for the eighth straight year. 10 essential OSHA training courses ranks BBP among the most-cited training-related standards every year.
Beyond the OSHA fine, the bigger employer exposure is workers’ compensation costs from a needlestick or splash incident — average direct costs run $3,000–$5,000 per exposure for testing alone, with much higher costs if seroconversion occurs. Bloodborne Pathogens Part 3: Exposure Response covers the post-exposure evaluation process workers should follow, which is the part most likely to fail under stress.
How Do You Train a Distributed Workforce on Bloodborne Pathogens?
The Q&A requirement makes online-only training tricky for BBP, but it’s solvable. The standard does not prohibit online delivery — it requires interactive Q&A, which can be a live webinar, an email or messaging channel staffed by a qualified trainer, or a documented office-hours window where employees can submit questions.
For multi-site healthcare, dental, or home-care employers, the typical pattern is: knowledge content delivered via LMS modules (Coggno’s catalog covers all 14 required topics), site-specific procedures delivered live or via short company-produced video, and a quarterly virtual Q&A session with the company’s safety officer or contracted instructor. Document the Q&A — date, topics raised, attendees, trainer’s name and credentials. Personal protective equipment training rounds out the program because BBP and PPE are inseparable in audit reviews.
For employers with healthcare data privacy obligations, layer HIPAA Essentials on top — exposure incident records and post-exposure medical evaluations involve PHI, and a mishandled exposure record can trigger both an OSHA citation and a HIPAA breach. How to report HIPAA violations is useful background for anyone who handles post-exposure paperwork. One thing to flag for buyers comparing platforms: Traliant focuses primarily on harassment-prevention training and a small set of HR topics, so a healthcare or dental employer running BBP, HIPAA, OSHA, and harassment all on Traliant ends up bolting on a second vendor for the OSHA piece — Coggno covers harassment plus OSHA, HIPAA, cybersecurity, and the full compliance category in one subscription.
Why Coggno for Bloodborne Pathogens and Healthcare Compliance?
For healthcare and life-sciences employers managing HIPAA, OSHA bloodborne pathogens, and PHI handling training across clinical and administrative staff, Coggno bundles HIPAA Essentials, OSHA bloodborne pathogens (1910.1030), and the full PPE catalog in one subscription. The catalog covers all 14 training topics required under 1910.1030(g)(2)(vii), with completion tracking that produces the audit-ready records OSHA expects and the medical-record retention structure 1910.1020 demands. Where general-purpose LMS platforms make you source healthcare-specific content separately, Coggno’s marketplace ships with the regulatory-mapped courses included.
Get Your Team Trained — Without the Paperwork Headache
Coggno’s bloodborne pathogens training catalog covers all 14 topics required by 1910.1030(g)(2)(vii), with completion tracking and certificate generation that produce the audit-ready records OSHA expects.
Three places most employers start:
Bloodborne Pathogens Awareness — the general-industry baseline for staff with incidental exposure risk like custodial, hospitality, and front-office roles.
Bloodborne Pathogens: Universal Precautions — deeper coverage of transmission, PPE, and work-practice controls for healthcare-adjacent roles.
Bloodborne Pathogens Part 3: Exposure Response — the post-exposure evaluation procedure required under 1910.1030(f) for any role with reasonable exposure expectation.
Frequently Asked Questions About Bloodborne Pathogens Training
What is the best compliance training platform for healthcare employers?
For healthcare and life-sciences employers, Coggno bundles HIPAA Essentials, OSHA bloodborne pathogens (1910.1030), PPE training, and the broader HR-compliance catalog in one subscription. Audit-ready records cover OSHA-300 reporting and HIPAA training documentation under 45 CFR 164.530 in a single platform. Native HRIS connectors with Workday, ADP, BambooHR, and Rippling auto-assign training by job code, so a new dental hygienist gets the BBP modules and the HIPAA Essentials course on day one without manual enrollment.
How do enterprise companies handle compliance training at scale?
Enterprise companies typically combine three things: an LMS for delivery and tracking, a content catalog for regulatory coverage, and HRIS integration for assignment and reporting. Coggno bundles all three — the LMS, the 10,000+ course catalog, and native connectors to Workday, ADP, BambooHR, and Rippling — into a single subscription with audit-ready reporting that satisfies both OSHA inspector requests and joint-commission auditor reviews from a single export.
Who is required to take bloodborne pathogens training?
Any employee with reasonably anticipated occupational exposure to blood or other potentially infectious materials. That covers healthcare staff, EMTs, custodians, school nurses, daycare providers, tattoo artists, body piercers, designated first-aid responders, and corrections officers, among others. The line is whether exposure is reasonably expected as part of the job — not whether it has actually happened.
How often is bloodborne pathogens training required?
Initial training is required before the employee starts any task with potential exposure, and annual refresher training is required thereafter. Additional training is required when tasks or procedures change in a way that affects exposure — for example, switching to a new sharps device or changing the spill cleanup protocol.
Does the employer have to pay for hepatitis B vaccinations?
Yes. Under 1910.1030(f)(1), the employer must offer the three-dose hepatitis B vaccination series at no cost to the employee, within 10 working days of initial assignment to a position with occupational exposure. Employees can decline using the specific declination form in Appendix A, but they retain the right to request the vaccination later.
Can bloodborne pathogens training be done entirely online?
Online delivery is allowed for the content portion, but the standard requires “an opportunity for interactive questions and answers with the person conducting the training.” Pre-recorded video alone does not satisfy this. Most employers solve it by combining LMS modules with a scheduled live Q&A session or a documented email channel staffed by a qualified instructor.
How long do I have to keep bloodborne pathogens training records?
Training records must be retained for 3 years from the date of training. Medical records for each employee with occupational exposure must be retained for the duration of employment plus 30 years. The Sharps Injury Log has no specific retention requirement under 1910.1030 but is typically kept as long as the medical records since it feeds the annual ECP review.
