Under OSHA’s Bloodborne Pathogens Standard, 29 CFR 1910.1030, an employer must train every employee with reasonably anticipated occupational exposure to blood or other potentially infectious materials (OPIM) — at initial assignment and at least annually thereafter, at no cost, during working hours, with a real opportunity to ask questions. A large share of search traffic for this topic is people looking for a “certificate.” CASRAI does not sell or issue bloodborne pathogens training or certificates; this guide covers what the regulation actually requires, who it covers in a university or research setting, and what documentation you should expect from whatever training your institution or a provider delivers.
What are bloodborne pathogens and OPIM?
OSHA defines bloodborne pathogens as pathogenic microorganisms present in human blood that can cause disease in humans. The standard names hepatitis B virus (HBV) and human immunodeficiency virus (HIV) explicitly as examples, and hepatitis C virus (HCV) is treated the same way in practice even though it postdates the original 1991 rule text.
Other potentially infectious materials (OPIM) is a defined term that extends the standard beyond blood itself. It includes human body fluids such as semen, vaginal secretions, cerebrospinal fluid, synovial fluid, pleural fluid, pericardial fluid, peritoneal fluid, amniotic fluid, saliva in dental procedures, and any body fluid visibly contaminated with blood; unfixed human tissue or organs (other than intact skin); and HIV- or HBV-containing cell or tissue cultures, culture medium, or other solutions. In a research setting, this is the definition that pulls cell culture work, tissue banking, and clinical specimen handling into scope even when no one is drawing blood.
The regulatory basis: OSHA’s Bloodborne Pathogens Standard, 29 CFR 1910.1030
The controlling federal regulation is 29 CFR 1910.1030, promulgated by the Occupational Safety and Health Administration. It applies to any employer with employees who have occupational exposure to blood or OPIM, and it is enforced independently of — and in addition to — biosafety frameworks like the BMBL or the NIH Guidelines. A lab can be fully compliant with its biosafety level practices and still be out of compliance with 29 CFR 1910.1030 if it handles human blood, tissue, or OPIM without a written exposure control plan and a functioning training program.
The standard also contains narrower, more stringent requirements for laboratories and production facilities that specifically culture, produce, or concentrate HBV or HIV (as distinct from clinical or diagnostic labs that merely analyze blood or tissue samples) — additional facility, practice, and containment provisions apply to that narrower category.
Who is covered: exposure-based, not job-title-based
Coverage turns on reasonably anticipated occupational exposure — contact with blood or OPIM that can be reasonably anticipated as a result of performing an employee’s job duties, including contact through skin, eye, mucous membrane, or parenteral contact. It is not determined by department, job title, or degree. In a university or research institution, this routinely includes:
- Wet-lab research staff working with human blood, primary human cell lines, or human tissue
- Clinical and translational research personnel drawing or handling patient specimens
- Some animal-care and veterinary staff, where anticipated exposure exists
- Facilities, custodial, and first-response staff whose duties reasonably anticipate contact with blood (e.g., cleaning up a spill, responding to an injury)
- Student employees performing any of the above as part of paid employment
Students who are not employees of the institution fall outside OSHA’s jurisdiction, which covers employers and employees under the Occupational Safety and Health Act. Many institutions extend equivalent training to student researchers as a matter of institutional policy or accreditation expectation even where OSHA itself does not require it — but the federal mandate itself attaches to employment status and exposure, not enrollment. Institutions in state-plan states (states that run their own OSHA-approved occupational safety and health program, such as California’s Cal/OSHA) may have their own bloodborne pathogens standard that is at least as protective as the federal rule and can extend coverage further, including to public-sector employees not otherwise covered by federal OSHA.
Required elements of the employer’s exposure control program
29 CFR 1910.1030 does not just require training in isolation — training is one piece of a broader written program. The standard requires:
- A written Exposure Control Plan identifying job classifications and tasks with exposure risk, and the plan must be reviewed and updated at least annually and whenever necessary to reflect new or modified tasks and procedures affecting occupational exposure, including annual documented consideration of newer, safer medical devices (e.g., sharps with engineered injury protections).
- Engineering and work-practice controls — sharps disposal containers, safer needle devices, handwashing facilities, prohibitions on recapping needles by hand, and similar controls that reduce exposure at the source.
- Personal protective equipment (PPE) provided and maintained at no cost to the employee, appropriate to the task.
- Hepatitis B vaccination offered to all employees with occupational exposure at no cost, made available within 10 working days of initial assignment, and after the employee has completed the required training. Employees who decline must sign a declination statement (the standard’s Appendix A form); they retain the right to request the vaccine later at no cost if they change their mind.
- Post-exposure evaluation and follow-up provided immediately and confidentially after a reported exposure incident, including documentation of the route and circumstances of exposure, identification and testing of the source individual where feasible, testing of the exposed employee’s blood (with consent), post-exposure prophylaxis when medically indicated, and counseling.
- Labels and signs using the biohazard symbol on containers of regulated waste, refrigerators/freezers holding blood or OPIM, and similar materials.
- A sharps injury log, required of employers who are otherwise required to keep an OSHA injury and illness log under 29 CFR Part 1904, recording the type and brand of device involved, the department or work area, and an explanation of how the incident occurred, maintained in a way that protects the injured employee’s confidentiality. For the response an institution should already have posted for the moment an injury happens, see our needlestick injury first-hour protocol.
- Recordkeeping covering both medical and training records (detailed below).
Training requirements: timing, content, and delivery
Training must be provided at the time of initial assignment to tasks with occupational exposure, and at least annually thereafter — annual retraining is required within one year of the previous session (it does not need to fall on the exact calendar anniversary, but should be reasonably close to it). Additional training is required whenever changes to tasks or procedures affect an employee’s occupational exposure.
The standard sets conditions on how training is delivered, not just how often:
- At no cost to the employee
- During working hours
- By a person knowledgeable in the subject matter as it relates to the specific workplace — a generic module with no site-specific content does not satisfy this alone
- With an opportunity for interactive questions and answers with the person conducting the training. A prerecorded video or purely computer-based module, on its own, does not satisfy the standard; OSHA has stated that a trainee must be able to ask questions and get an answer, which means a knowledgeable person has to be reasonably available during or immediately after self-paced training, and the training must be supplemented with site-specific information (where the written Exposure Control Plan is kept, what to do in the event of an exposure incident at that specific facility, and so on).
The training program’s required content, at minimum, must cover:
- An accessible copy of the regulatory text and an explanation of its contents
- The epidemiology and symptoms of bloodborne diseases
- Modes of transmission of bloodborne pathogens
- An explanation of the employer’s written Exposure Control Plan and how to obtain a copy
- How to recognize tasks and activities that may involve exposure
- The use and limitations of methods that reduce exposure: engineering controls, work practices, and PPE
- PPE types, appropriate use, location, removal, handling, decontamination, and disposal, and the basis for PPE selection
- Information on the hepatitis B vaccine, including its efficacy, safety, method of administration, benefits, and that it is offered free of charge
- Emergency procedures and who to contact in the event of an exposure incident
- The procedure to follow if an exposure incident occurs, including the reporting method and the medical follow-up that will be made available
- Information on the post-exposure evaluation and follow-up the employer must provide
- An explanation of the signs, labels, and color-coding required by the standard
Documentation and recordkeeping
Two separate retention clocks apply, and they are frequently confused:
- Training records must be retained for 3 years from the date the training occurred, and should document the training dates, content or summary, names and qualifications of trainers, and names and job titles of attendees.
- Medical records created under this standard (hepatitis B vaccination status, post-exposure evaluation results, and related medical information) are covered by OSHA’s general medical-records-access rule, 29 CFR 1910.1020, and must be retained for the duration of employment plus 30 years. Medical records must also be kept confidential and separate from personnel files.
For a bloodborne pathogens training certificate specifically: OSHA’s standard itself does not define or require a specific “certificate” document. What it requires is the training record described above. Whether a training provider issues a printable certificate of completion is a feature of that provider’s format, not a separate federal requirement — an institution’s compliance rests on the underlying training record and content meeting the standard, not on the existence of a certificate artifact.
Academic and research-setting specifics
A few points are worth spelling out for university and institutional research settings specifically:
- Employees vs. students. OSHA jurisdiction attaches to employer-employee relationships. Students conducting research who are not employed by the institution are not covered by 29 CFR 1910.1030 directly, though many institutions require equivalent training as institutional policy, a condition of lab access, or to satisfy funder/accreditation expectations. Student employees (research assistants, work-study staff) with occupational exposure are covered the same as any other employee.
- State-plan states. States operating their own OSHA-approved occupational safety and health plan may have a bloodborne pathogens standard that differs in detail from the federal rule (and must be at least as protective), and these state plans are typically the mechanism that extends coverage to public university employees who would otherwise fall outside federal OSHA’s jurisdiction over state and local government employers.
- The Institutional Biosafety Committee (IBC) and Biosafety Officer. Where research involves recombinant or synthetic nucleic acid molecules, an IBC reviews the work under the NIH Guidelines, and the Biosafety Officer typically has operational responsibility for biosafety compliance day to day. Bloodborne pathogens training under 29 CFR 1910.1030 is a distinct, parallel compliance track from IBC/NIH Guidelines review — a protocol can require IBC approval and separately require bloodborne pathogens training if it involves human blood or OPIM, and institutions generally coordinate the two rather than treating either as a substitute for the other. See how IBC oversight compares to other research committees in our IACUC vs. IBC and IRB vs. IBC comparisons.
- Interaction with biosafety level practices. Work with human blood or OPIM of unknown infectious status is commonly conducted at Biosafety Level 2 (BSL-2), per the BMBL. BSL practices (containment equipment, facility design, work practices) and the OSHA bloodborne pathogens program address overlapping but legally distinct requirements; satisfying one does not automatically satisfy the other, and both should be built into the same lab’s onboarding and annual training cycle rather than tracked separately. Chemical hazard training obligations under OSHA’s separate Laboratory Standard / Chemical Hygiene Plan (29 CFR 1910.1450) are a related but distinct compliance track as well — a research lab commonly has to satisfy all three (bloodborne pathogens, chemical hygiene, and IBC/biosafety) as separate, coordinated programs.
Where training is commonly obtained
Most research institutions deliver bloodborne pathogens training through their own Environmental Health and Safety (EHS) office, which is typically the group that maintains the institution’s written Exposure Control Plan and can supply the site-specific information the standard requires (location of the plan, local reporting procedures, local PPE and disposal locations). Institutions also commonly license training content from established compliance-training providers — the CITI Program is one widely used option in the research-institution market, alongside numerous other commercial and non-profit training vendors — typically paired with a live or on-call knowledgeable person to satisfy the interactive-questions requirement described above. CASRAI does not deliver or certify bloodborne pathogens training; check with your institution’s EHS or research safety office for the training your institution has designated as compliant, and for how it documents and retains your training record.
Frequently asked questions
Is bloodborne pathogens training required every year?
Yes. 29 CFR 1910.1030 requires training at initial assignment and at least annually thereafter, with annual retraining due within one year of the previous session.
Does OSHA require a specific training certificate?
No. The standard requires an employer to maintain a training record (dates, content, trainer, and attendee names/titles) for 3 years. Whether a provider issues a certificate of completion is a feature of that provider’s format, not a distinct OSHA requirement.
Are unpaid student researchers required to complete OSHA bloodborne pathogens training?
OSHA’s jurisdiction under 29 CFR 1910.1030 covers employees with occupational exposure. Students who are not employed by the institution are not directly covered by the federal standard, though many institutions require equivalent training as a condition of lab access or under funder/accreditation expectations. Student employees with occupational exposure are covered the same as any other employee.
How long must medical records related to bloodborne pathogens exposure be kept?
Under OSHA’s records-access standard, 29 CFR 1910.1020, medical records created under the bloodborne pathogens standard must be retained for the duration of employment plus 30 years.
Can bloodborne pathogens training be delivered entirely online?
Only if it includes a real opportunity for interactive questions and answers with a knowledgeable person, and is supplemented with site-specific information. A prerecorded video or computer module with no access to a knowledgeable person for follow-up questions does not, on its own, satisfy the standard.
Is bloodborne pathogens training the same as biosafety level (BSL) training?
No. They are separate, legally distinct requirements that commonly apply to the same lab. Bloodborne pathogens training is required under OSHA’s 29 CFR 1910.1030 whenever there is occupational exposure to human blood or OPIM. BSL practices come from the CDC/NIH BMBL and, for recombinant/synthetic nucleic acid work, NIH Guidelines and IBC review. A lab handling human blood at BSL-2 typically needs both.
