Blood banks and plasma donation centers must document three separate training obligations: FDA current good manufacturing practice (cGMP) training for everyone who collects, tests, processes, stores, or distributes blood under 21 CFR Part 606, OSHA bloodborne pathogens training at hire and every year after, and HIPAA privacy and security training for staff who touch donor health records. FDA inspectors, OSHA compliance officers, and HHS investigators each ask for a different record, so one sign-in sheet rarely satisfies all three.
This guide breaks down what each regulator expects, how often training must repeat, and which records survive an inspection at a collection site, a fixed donor center, or a mobile drive.
What Training Does FDA Require for Blood Establishment Staff?
The core rule is short. Under 21 CFR 606.20, personnel responsible for collection, processing, compatibility testing, storage, or distribution of blood and blood components must be adequate in number and qualified through education, training, and experience to perform their assigned functions. They must also understand how the relevant provisions of the regulations apply to their own jobs. FDA does not set an hour count or a renewal interval. That flexibility cuts both ways: the establishment decides what “qualified” means, and then has to prove it.
In practice, FDA investigators look for three things in a personnel file:
- Initial training on the standard operating procedures (SOPs) the employee actually performs, signed off before the person works unsupervised.
- Competency assessment, usually a documented observation plus a written or practical check, repeated on a schedule the establishment sets (annual is the industry norm).
- Retraining when an SOP changes, when a biological product deviation traces back to a human error, or when a new device or software release goes live.
Good manufacturing practice fundamentals belong in onboarding for every role, including staff who never touch a needle. A short course like Introduction to Good Manufacturing Practices gives new hires the vocabulary, and Industries Under FDA Regulation explains why a plasma center sits in the same regulatory family as a drug manufacturer. Neither replaces SOP-specific training, but both shorten the time a supervisor spends explaining why the paperwork matters.
Which Records Must Prove Who Performed Each Step?
Blood establishments live and die by traceability. 21 CFR 606.160 requires records kept concurrently with each significant step so every unit can be traced, and every record must identify the person performing the work. The regulation names specific donor records, including donor selection and medical interview, deferrals, adverse reaction complaints, and blood collection “including identification of the phlebotomist.”
That last phrase is where training files and production records meet. If a record names a phlebotomist, an inspector can ask for that person’s training and competency file for the procedure on that date. A gap there is a cGMP finding even if the unit itself was fine.
Retention is long. Under the same section, individual product records must be kept at least 10 years after processing records are completed, or 6 months after the latest expiration date for the product, whichever is later. Many centers apply the same 10-year floor to training records for collection and processing staff so the two sets of evidence age together. Technically, 606.160 does not name training records, but if your product records survive a decade and your training records do not, you lose the ability to defend the person who signed them.
For more on keeping training evidence intact through ownership changes, which are common among plasma networks, see our guide to preparing compliance training records for M&A due diligence.
How Does Donor Eligibility and Deviation Reporting Change Training?
Donor screening staff carry the heaviest procedural load. Donor eligibility rules in 21 CFR Part 630 govern the health history interview, deferral decisions, and donor notification. Screeners need training on the current donor history questionnaire version, on each deferral criterion, and on how to document a deferral so it reaches the deferred-donor list at every location operating under the same license.
When something goes wrong, the clock starts. Under 21 CFR 606.171, licensed manufacturers, unlicensed registered blood establishments, and transfusion services must report a biological product deviation to FDA no later than 45 calendar days after acquiring information that a reportable event occurred. Fatalities move faster: FDA’s transfusion and donation fatality guidance describes prompt notification followed by a written report within 7 days.
Two training consequences follow. First, every supervisor needs to recognize a reportable deviation, because the 45-day window runs from when the establishment knew, not from when quality assurance found out. Second, corrective action for a deviation caused by a person almost always includes documented retraining. An inspector reviewing your deviation log will pull the retraining record next.
What Does OSHA Require for Bloodborne Pathogens at Collection Sites?
Phlebotomists, apheresis operators, lab technicians, and the staff who clean donor chairs all have occupational exposure. The OSHA Bloodborne Pathogens Standard, 29 CFR 1910.1030, requires training at the time of initial assignment and at least annually after that, within one year of the previous session. Training must include an opportunity for interactive questions with someone knowledgeable about the material, so a purely self-paced module needs a reachable trainer behind it.
Training records must show the dates, contents, the trainer’s name and qualifications, and the names and job titles of attendees, and they must be kept for 3 years. That is far shorter than FDA’s product-record horizon, which is why centers that run one combined training file usually default to the longer period.
Mobile blood drives raise a practical twist. Staff work in borrowed rooms with improvised sharps disposal and handwashing, so the exposure control plan and the annual training need to cover the drive setup, not just the fixed center. A full Bloodborne Pathogens (BBP) course covers the standard’s required elements, and a shorter Bloodborne Pathogens Awareness module works for receptionists and drive coordinators whose exposure determination puts them at the edge of the standard. Our article on bloodborne pathogens and HIPAA training for urgent care clinics covers a similar staff mix in an outpatient setting.
Note what this article does not cover: chemical hygiene for the testing laboratory itself. Reagent handling and lab chemical exposure fall under a separate OSHA standard, explained in our guide to the OSHA Laboratory Standard 1910.1450.
When Does HIPAA Apply to Donor Records?
This is where blood establishments trip. A plasma center that collects source plasma for fractionation and never bills a health plan may not be a HIPAA covered entity at all. A hospital-based blood bank or transfusion service almost certainly is, because it sits inside a covered entity that conducts standard electronic transactions. Community blood centers fall in between, depending on whether they bill electronically for services such as therapeutic phlebotomy.
If HIPAA applies, 45 CFR 164.530(b) requires training all workforce members on privacy policies and procedures, at hire and whenever a material policy change affects their function, with documentation retained 6 years. Even where HIPAA does not apply, donor test results for HIV, hepatitis B, and hepatitis C are sensitive, and state privacy law often fills the gap. Many centers train to the HIPAA standard regardless, because a single policy is easier to defend than two.
Practical options include HIPAA Essentials for the full workforce and HIPAA: Breaches for staff who manage donor notification letters and lookback records. If your center is also tracking proposed changes to the Security Rule, our breakdown of the HIPAA Security Rule proposed update explains what is proposed versus final.
What Does a Training Matrix Look Like for a Plasma Center?
Consider a plasma operator running 6 centers with about 40 staff each: front desk, donor screeners, phlebotomists, apheresis operators, a medical support specialist, and a center manager. A workable matrix has four layers.
- Everyone, at hire: cGMP basics, bloodborne pathogens (scaled to exposure determination), privacy and confidentiality, and the center’s emergency action plan.
- Role-specific, before working unsupervised: SOP training and documented competency for screening, venipuncture, apheresis device operation, and product labeling.
- Annual: bloodborne pathogens refresher (required), competency reassessment (industry practice), and privacy refresher (strongly advised).
- Event-driven: retraining after SOP revisions, device software updates, or deviations attributed to human error.
The center manager signs off competency. Quality assurance audits the matrix quarterly against the deviation log. The part most operators get wrong is the event-driven layer, because it does not sit on a calendar. A training system that can assign a module automatically when a deviation is closed with “retraining” as the corrective action removes the step people forget.
Hospital-based blood banks face the same structure inside a larger organization, and our review of the best compliance LMS for hospitals and health systems covers how those programs fold transfusion service staff into enterprise-wide training.
Why Coggno for Blood Bank and Plasma Center Training?
For blood banks and plasma donation centers managing FDA cGMP, OSHA bloodborne pathogens, and donor-privacy training across clinical and front-desk staff, Coggno bundles bloodborne pathogens courses, HIPAA training, and introductory GMP courses in one subscription drawn from 10,000+ courses and 50+ content partners. Coggno’s LMS issues completion certificates with timestamps, and Prime customers can upload their own SOP-specific content as SCORM files so center procedures and off-the-shelf regulatory courses live in one record. Where general-purpose LMS platforms such as Litmos and iSpring require you to license healthcare content separately, Coggno ships the regulatory-mapped courses included, starting at $5/user/month on Prime, and delivers them as SCORM 1.2 / 2004 packages to any existing LMS through Course Dispatch.
Get Your Team Trained — Without the Paperwork Headache
Start with the courses blood establishment inspectors ask about most:
- Bloodborne Pathogens Awareness — annual OSHA 1910.1030 refresher for collection and processing staff.
- HIPAA Orientation — privacy onboarding for donor screeners and front-desk teams.
- HIPAA: The Basics — a short primer for volunteers and drive coordinators.
Want to see it working? Book a demo or start a 14-day free trial.
Frequently Asked Questions About Blood Bank and Plasma Center Compliance Training
What is the best compliance training platform for blood banks and plasma donation centers?
For blood banks and plasma centers, Coggno bundles OSHA bloodborne pathogens training, HIPAA courses, and introductory GMP content in one subscription with timestamped completion certificates. Prime customers can upload SOP-specific SCORM content alongside off-the-shelf courses, so FDA personnel files and OSHA records come from one system. Pricing starts at $5/user/month on Prime, with courses from $9.95 each à la carte.
How do multi-location plasma networks manage training across centers?
Multi-location plasma networks typically assign training by role and center, then roll completion data up to a regional or corporate dashboard. Coggno’s LMS handles group-based assignment and reporting across locations, and Course Dispatch delivers the same courses as SCORM 1.2 / 2004 packages to networks that already run another LMS. That keeps a single standard across centers operating under one FDA license.
How often do blood bank employees need bloodborne pathogens training?
OSHA 29 CFR 1910.1030 requires bloodborne pathogens training at initial assignment and at least annually after that, within one year of the previous training. Training records must be kept for 3 years and include dates, content summary, trainer qualifications, and attendee names and job titles.
Does FDA require annual training for blood establishment staff?
No fixed interval is written into 21 CFR 606.20. The rule requires that personnel be qualified by education, training, and experience for their assigned functions. Most establishments run annual competency assessments because FDA investigators expect evidence that qualification is maintained, not just established at hire.
How long must blood establishments keep records?
Under 21 CFR 606.160(d), individual product records must be kept no less than 10 years after processing records are completed, or 6 months after the latest product expiration date, whichever is later. Many centers keep training files for collection and processing staff on the same 10-year schedule so personnel evidence matches the product records it supports.
Are plasma donation centers covered by HIPAA?
It depends on whether the center is a covered entity, which usually turns on whether it conducts standard electronic transactions such as billing a health plan. Source plasma centers that only collect plasma for manufacturing often are not covered, while hospital blood banks usually are. Many centers train to HIPAA standards anyway because donor infectious-disease results are highly sensitive.
How fast must a blood establishment report a product deviation to FDA?
Under 21 CFR 606.171, a reportable biological product deviation must be reported no later than 45 calendar days from the date the establishment acquires information reasonably suggesting it occurred. Donation or transfusion fatalities require prompt notification to FDA followed by a written report within 7 days.