Bloodborne Pathogens Program for Contractors: 29 CFR 1910.1030 Compliance

Most contractors assume the OSHA Bloodborne Pathogens standard at 29 CFR 1910.1030 applies only to hospitals, clinics, and EMS. It does not. Any worker with occupational exposure — defined as "reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials (OPIM) that may result from the performance of an employee's duties" — is covered. That sweeps in designated first aid responders, custodial and janitorial crews, demolition workers exposed to syringes in vacant buildings, plumbers cleaning sewage, and any crew where a tourniquet might be applied at a jobsite injury.

ISN, Avetta, and Veriforce reviewers know the regulation and increasingly mark BBP sections deficient when contractors omit it on the assumption that "we are not a medical employer." This guide walks through exposure determination, the written exposure control plan, universal precautions, engineering and work practice controls, the HBV vaccination offer, post-exposure follow-up, the sharps injury log, and training requirements.

Why Non-Medical Contractors Are Often Covered

OSHA's exposure determination test is functional, not industry-based. If any employee has reasonably anticipated occupational exposure, the standard applies. Common contractor scenarios:

• Designated first aid responders — any employee assigned or expected to render first aid as a collateral duty (foreman with a first aid kit, safety lead). The "Good Samaritan" carve-out is narrow and does not protect designated responders
• Custodial and janitorial — cleaning restrooms, handling waste, picking up discarded sharps in tenant or municipal facilities
• Demolition and remediation — needles in walls and crawlspaces of vacant residential or commercial buildings, especially in urban renovation
• Plumbing, sewer, and water — exposure to sewage, blood-contaminated wastewater
• Animal control / vegetation crews in some jurisdictions

OSHA CPL 02-02-069 (the BBP Compliance Directive) is the inspection playbook. CSHOs evaluate the written exposure control plan, training, the HBV offer, the sharps injury log, and post-exposure procedures. Reviewers in ISN and Avetta apply the same lens.

Exposure Determination — 1910.1030(c)(2)

The first task in the written program. Without it nothing else works. The exposure determination must:

• List job classifications in which all employees have occupational exposure (e.g., Designated First Aid Responder)
• List job classifications in which some employees have occupational exposure, and within those classifications the tasks and procedures in which exposure occurs (e.g., Foreman — cleanup of jobsite injury blood)
• Be made without regard to the use of personal protective equipment — i.e., assume the gloves are not on

This is the section reviewers read first. A contractor that lists "Not Applicable" while assigning first aid responders to every crew gets sent back immediately. Build the exposure determination before drafting policy.

The Written Exposure Control Plan — 1910.1030(c)(1)

The Exposure Control Plan (ECP) is the written program required at 1910.1030(c)(1). It must contain:

• The exposure determination
• The schedule and method for implementing each section of the standard — methods of compliance, HBV vaccination, post-exposure evaluation, communication of hazards, recordkeeping
• The procedure for evaluating the circumstances of an exposure incident
• An annual review and update reflecting new or modified tasks and procedures, and changes in technology that reduce exposure (engineering controls evaluation)
• Documentation of the annual consideration and implementation of safer medical devices (revised 2001 under the Needlestick Safety and Prevention Act)
• Solicitation of input from non-managerial employees responsible for direct patient care or potentially exposed to injuries from contaminated sharps in the identification, evaluation, and selection of effective engineering and work practice controls

The ECP must be accessible to employees and made available to OSHA on request. The annual review and revision is the most-flagged element in reviewer comments — without a dated annual review, the plan fails on its face.

Universal Precautions and Methods of Compliance — 1910.1030(d)

Universal precautions is the foundation: treat all human blood and OPIM as if known to be infectious for HIV, HBV, and other bloodborne pathogens, regardless of the perceived status of the source individual. Where differentiation is impossible (e.g., emergency response), all body fluids are treated as potentially infectious.

Methods of compliance, in OSHA's order of preference:

1. Engineering controls — sharps containers (puncture-resistant, leakproof, labeled or color-coded), self-sheathing/safety needles, needleless systems, biohazard bags. The standard requires annual evaluation of safer devices
2. Work practice controls — no recapping needles by hand, no eating/drinking/smoking/applying cosmetics in exposure areas, hand hygiene immediately after glove removal, no mouth pipetting
3. Personal protective equipment — gloves (latex/nitrile), gowns, face shields/masks, CPR pocket masks with one-way valves. PPE is "appropriate" only if it does not permit blood or OPIM to pass through
4. Housekeeping — written cleaning and decontamination schedule, EPA-registered tuberculocidal or hospital-grade disinfectant, sharps containers replaced before overfilling

For contractors, the engineering control list is short — sharps containers in first aid kits, biohazard bags for cleanup waste, CPR barrier devices. List them by name in the ECP.

Hepatitis B Vaccination — 1910.1030(f)

Every employee with occupational exposure must be offered the HBV vaccine series at no cost, at a reasonable time and place, within 10 working days of initial assignment. The series is three doses (0, 1, and 6 months) and confers long-term protection.

If an employee declines, they must sign the specific declination statement in Appendix A of the standard — verbatim. The decliner retains the right to receive the vaccine later at no cost. Reviewers want to see the signed declination form on file (or proof of vaccination/titer) for every covered employee. A generic "I decline" line on a hire packet does not satisfy the standard — the wording must match Appendix A.

Pre-screening for antibody titer is not required, and the vaccine cannot be made a condition of employment. If a routine booster becomes recommended by the U.S. Public Health Service, the employer must offer it.

Post-Exposure Evaluation and Follow-Up — 1910.1030(f)(3)

When an exposure incident occurs (specific eye, mouth, mucous membrane, non-intact skin, or parenteral contact with blood or OPIM), the employer must make available immediately:

• Documentation of the routes of exposure and circumstances
• Identification and documentation of the source individual, unless infeasible or prohibited by state law
• Source individual's blood tested as soon as feasible (with consent where required) for HBV/HCV/HIV
• Results provided to the exposed employee
• Collection and testing of the exposed employee's blood for HBV/HCV/HIV serological status
• Post-exposure prophylaxis when medically indicated, per current U.S. Public Health Service recommendations
• Counseling and evaluation of any reported illness
• Healthcare professional's written opinion provided to the employer within 15 days of completed evaluation

The ECP must name the post-exposure healthcare provider (occupational clinic, urgent care, hospital ER) and contain the procedure for getting the exposed employee evaluated immediately — not the next business day. Speed matters because PEP for HIV is most effective within hours.

Sharps Injury Log — 1910.1030(h)(5)

Required since 2001 for employers covered by 1904 recordkeeping. The log must contain:

• The type and brand of device involved in the incident
• The department or work area where the incident occurred
• An explanation of how the incident occurred

The log must be maintained in a manner that protects employee confidentiality and is retained for the duration of employment plus 30 years (per 29 CFR 1910.1020 for medical records). Most contractors with light exposure never have an entry — but the log must exist with a documented zero-incident year-end summary.

Hazard Communication of Biohazards — 1910.1030(g)(1)

Containers of regulated waste, contaminated laundry, and refrigerators/freezers containing blood or OPIM must carry the fluorescent orange or orange-red biohazard label with the biohazard symbol. Red bags or red containers may be substituted. Sharps containers must be labeled or color-coded and meet the engineering criteria above (closable, puncture resistant, leakproof, located as close as feasible to the area of use).

Training — 1910.1030(g)(2)

Required at initial assignment and at least annually thereafter. Additional training when modifications affect exposure. The training must be interactive — opportunity for questions and answers with a knowledgeable instructor. Pure video, web-only, or read-and-sign training does not satisfy the standard unless paired with access to a qualified person for questions.

Required content (1910.1030(g)(2)(vii)):

• An accessible copy of the regulatory text
• General explanation of epidemiology and symptoms of bloodborne diseases
• Modes of transmission
• Explanation of the exposure control plan and how to obtain a copy
• How to recognize tasks and activities that may involve exposure
• Use and limitations of methods of control — engineering controls, work practices, PPE
• Information on PPE — types, use, location, removal, handling, decontamination, disposal
• Information on the HBV vaccine
• Actions to take and persons to contact in an emergency involving blood or OPIM
• Procedure to follow if an exposure incident occurs, including reporting and the medical follow-up that will be made available
• Information on post-exposure evaluation and follow-up the employer is required to provide
• Explanation of signs, labels, and color coding
• Opportunity for interactive questions and answers

Document each session: date, content, instructor name and qualifications, attendee names. Keep training records for 3 years from the date of training (1910.1030(h)(2)).

What Reviewers Flag Most Often

• Program omitted entirely on grounds that the contractor "is not medical"
• No exposure determination, or exposure determination conducted with PPE in mind
• Designated first aid responders not identified
• HBV declination uses generic wording instead of Appendix A verbatim
• Post-exposure procedure says "see a doctor" without naming a clinic or timeline
• No annual review of the ECP
• No documented annual evaluation of safer engineering controls (sharps with safety features)
• Training listed as initial only, missing annual refresher
• Sharps injury log absent, even as a zero-entry log

BBP fits alongside other health-and-safety programs reviewers expect from a contractor. See our HazCom program guide, the respiratory protection program guide, the fall protection program for RAVS, and the first-time ISNetworld setup checklist.

The Bottom Line

A bloodborne pathogens program that survives prequalification review starts with an honest exposure determination. If you assign first aid responders, do janitorial, demolish vacant property, or work in sewage — you are covered. Build the ECP around 1910.1030 by paragraph: exposure determination at (c)(2), methods of compliance at (d), HBV vaccination at (f) with the Appendix A declination, post-exposure evaluation at (f)(3), labeling at (g)(1), training at (g)(2), and the sharps injury log at (h)(5). Date the annual review. Train interactively. Reviewers can read the regulation as well as you can — show them you have too.

PrequalPilot tracks BBP training rosters, HBV vaccination status and declinations, and ECP annual review dates — with 60/30/7-day expiry alerts so nothing lapses between ISN audits. See pricing →