There is no OSHA spill report form. OSHA prescribes the contents of the records a bodily fluid incident creates, not a format — and it splits what most businesses call the incident report into three separate records: an operational record you design yourself, a confidential medical record under 29 CFR 1910.1030(h)(1), and, for some employers, a sharps injury log under (h)(5).

Those three records have three different audiences and three different retention clocks. Putting them on one sheet of paper is the single most common mistake in small-business bloodborne pathogen paperwork, and it is the one that can turn a tidy filing habit into a confidentiality problem.

This article is about what to write down after a blood, vomit or other bodily fluid incident, and where each piece of it belongs. It assumes you already have a written plan; if you do not, start with our fill-in exposure control plan template and come back.

Is there an OSHA spill report form?

No. OSHA does publish forms, but they belong to a different rule. 29 CFR 1904.33 names the OSHA 300 Log, the annual summary and the OSHA 301 Incident Report forms, and 29 CFR 1904.29 is titled simply Forms. Those are injury and illness recordkeeping forms for every industry, not bodily fluid forms.

The bloodborne pathogens standard works differently. It never prescribes a layout. It names records and then lists what each one must contain, which is why a search for an official template comes back empty and why every free download you find online is somebody’s invention rather than OSHA’s.

That is good news, because it means the operational record is yours to design around your own premises. It is also a trap, because the two records that are prescribed have contents and retention periods you cannot improvise.

A fourth record may also exist: an entry on the OSHA 300 Log under Part 1904. It is not a bodily fluid record as such, and it is the least informative of the four by design. That is covered further down.

Where does the incident report fit in your exposure control plan?

1910.1030(c)(1)(ii)(C) requires the plan to contain the procedure for the evaluation of circumstances surrounding exposure incidents. Read that carefully: the plan has to contain the procedure, not the form. The form is what the procedure produces.

The printed text of that sub-item continues with a cross-reference to paragraph (f)(3)(i) of the standard, which is the post-exposure evaluation itself. The evaluation pathway that follows an exposure incident — the testing, the healthcare professional, the written opinion — is a separate subject and is not covered here.

What matters for your paperwork is the join. Your plan names a procedure; the procedure says who fills in what, when, and where it is filed. If your plan says an incident is documented and you have no document, the plan is not merely incomplete — it contradicts itself. Our exposure control plan template sets this out as a numbered plan entry, and this article is the form that entry points at.

What should the operational incident record capture?

Nothing in 1910.1030 prescribes the contents of an operational cleanup record, so what follows is our recommendation rather than a regulatory requirement. It is built backwards from the things you will later wish you had written down: the restock, the decision about whether blood was involved, and the question of who was standing where.

Two of those rows do work beyond the obvious. Any equipment declined exists because 1910.1030(d)(3)(ii) permits a narrow exception where an employee temporarily and briefly declined protective equipment, and ends by requiring that the circumstances be investigated and documented. Our guide to protective equipment for bodily fluid cleanup works through that paragraph in full; the point here is simply that the duty to document it lands on this form.

Kit used and consumed exists because the standard treats restocking as part of the cleanup rather than as housekeeping. Our step-by-step blood spill procedure covers the timing; the record is what makes it happen. The waste route row is the one an inspector is most likely to ask about, and our guide to red bag and trash decisions by waste type is the reference for filling it in.

Notice what is not on that list: no diagnosis, no vaccination status, no test result, no description of anybody’s health. Those belong in a different record, filed in a different place, and the next two sections explain why keeping them off this sheet is not fussiness.

What must the confidential medical record contain?

1910.1030(h)(1)(i) requires the employer to establish and maintain an accurate record for each employee with occupational exposure. The phrasing repays attention: the record attaches to an employee, not to an incident. One person with years of occupational exposure has one medical record that grows, however many spills they clean up.

(h)(1)(ii) then lists five things it must include.

Read the list for what it leaves out. There is no narrative field, no account of how the incident happened, no location, no list of who else was present. The medical record is a file of clinical documents and vaccination dates. It is not the story of the spill.

That is the clearest practical answer to the question people actually ask. The incident narrative lives on the operational record; the clinical paperwork lives here; and the two are joined by a date and a name rather than by being stapled together.

Why can one sheet of paper breach confidentiality?

1910.1030(h)(1)(iii) requires that employee medical records be kept confidential and not disclosed or reported without the employee’s express written consent, with a closing exception only as required by this section or as may be required by law.

Now put that next to how small businesses actually file things. The incident sheet goes in a binder in the office, or in a shared drive folder, because that is where the shift paperwork goes and because several people need to read it to restock the kit and brief the next shift.

If that sheet also carries a vaccination date, a test result or a note about somebody’s immunity, then the act of filing it where colleagues can read it is a disclosure. Nobody had to show it to anyone. The filing cabinet did the disclosing.

The operational record is written to be read by the people who run the shift. The medical record is written to be read by almost nobody. A document cannot be both, which is why it has to be two documents.

In practice that means one storage place with a lock and a named person responsible for it, and a second, ordinary place for the shift paperwork. The lock is not there to satisfy an auditor; it is there because (h)(1)(iii) makes the employer responsible for the file rather than for intentions.

The sharps injury log has its own version of the same rule, and the OSHA 300 Log has a third version. All three are described below. The pattern is consistent: the more widely a record is read, the less it is allowed to say about an identifiable person.

How long must each record be kept?

This is where mixing records becomes expensive rather than merely untidy. The retention periods are not close to each other.

One wrinkle is worth flagging as a reading rather than a quotation. (h)(1)(iv) sits inside (h)(1) Medical Records and says the employer shall maintain the records required by paragraph (h) for that thirty-year-plus period, while (h)(2)(ii) separately gives training records three years. Read together, the long clock is the medical-records clock and the training records keep their own shorter one. Our guide to who needs bloodborne pathogen training deals with the training side.

The consequence is simple and it decides your filing. A document containing medical content cannot be destroyed on a five-year cycle, and a document on a five-year cycle cannot contain medical content. If both live on one sheet, one of the two rules gets broken whichever date you shred it on.

Who has to keep a sharps injury log, and what goes on it?

1910.1030(h)(5)(ii) sets the gate, and it is a gate rather than a general duty: the requirement applies to any employer who is required to maintain a log of occupational injuries and illnesses under 29 CFR part 1904. If Part 1904 does not require you to keep that log, this paragraph does not add a sharps injury log on top. Check Part 1904 for its own scope and its exemptions rather than assuming either way.

Where the gate is open, (h)(5)(i) requires the employer to establish and maintain a sharps injury log for recording percutaneous injuries from contaminated sharps, and requires that the information be recorded and maintained in such manner as to protect the confidentiality of the injured employee. The same paragraph says the log shall contain, at a minimum, three things.

The word brand is doing real work there, and it is the part people leave blank. Our reading — stated as a reading, not as a quotation — is that a log recording which brand of device caused which injury is the evidence base for the annual duty at (c)(1)(iv)(B) to document consideration of safer devices. A log that says only needle cannot support that decision, and the plan entry that duty belongs to then has nothing behind it.

Note also what the three required items do not include: no name, no job title, no employee number. The one thing (h)(5)(i) positively requires about the injured person is that they be protected from identification. The three fields are a minimum, so you may add more — but every field you add is a field that has to survive the confidentiality test.

What happens clinically after a sharps injury, and the deadlines that run from it, are a separate subject from the log and are not covered here.

When does an exposure incident go on the OSHA 300 Log?

29 CFR 1904.8 is titled Recording criteria for needlestick and sharps injuries, and paragraph (a) is unusually direct. You must record all work-related needlestick injuries and cuts from sharp objects, you must enter the case on the OSHA 300 Log as an injury, and — in the same paragraph — you may not enter the employee’s name on the OSHA 300 Log, with a cross-reference to the privacy-case rules at 1904.29(b)(6) through (b)(9).

Two sub-items narrow it. 1904.8(b)(2) ties the duty to cuts, lacerations, punctures and scratches that involve contamination with another person’s blood or other potentially infectious material; a clean object is recordable only if it meets the general criteria in 1904.7. And 1904.8(b)(4) covers being splashed or exposed to blood or other potentially infectious material without being cut or scratched, which is recorded as an illness if it results in a diagnosed bloodborne illness or otherwise meets the 1904.7 criteria.

So a vomit cleanup with no cut and no diagnosis is usually not a 300 Log entry at all. A needlestick from a contaminated sharp always is. The difference matters, because the moment it becomes a log entry the privacy rules take over.

1904.29(b)(6) says that for a privacy concern case you may not enter the employee’s name on the OSHA 300 Log and that you should instead enter privacy case in the space normally used for the employee’s name. 1904.29(b)(7) then lists six categories, and 1904.29(b)(8) confirms that this is a complete list of all injuries and illnesses considered privacy concern cases for part 1904 purposes.

Two of those six can apply to a single bloodborne pathogen incident at once: the sharps injury itself under (v), and a later diagnosis under (iv). That is why the 300 Log entry is the thinnest of all these records, and it is deliberate rather than an oversight.

Two further provisions finish the job. 1904.29(b)(9) says that where you have a reasonable basis to believe the information could identify the person, you may use discretion in describing the injury or illness on both the OSHA 300 and 301 forms. And 1904.29(b)(10) requires that before giving the log to anyone not entitled to the names, you must remove or hide the employees’ names and other personally identifying information.

Put the whole sequence together and the architecture is obvious. The detail that cannot go on the posted log has to exist somewhere, and the somewhere is the confidential medical record described above. Thinning the log does not thin your obligation to know what happened.

Can an employee ask to see their own record?

Yes, and the mechanics sit in a different standard. 29 CFR 1910.1020 is titled Access to employee exposure and medical records, and its paragraph (e) is headed Access to records. Both 1910.1030(h)(3)(iii) and (h)(1)(iv) route you to it.

1910.1020(e)(1)(i) requires that when an employee or designated representative requests access, the employer shall assure that access is provided in a reasonable time, place, and manner. If you cannot reasonably provide access within fifteen (15) working days, you must apprise the requester of the reason for the delay and the earliest date the record can be made available.

How you provide it is your choice of three, set out at (e)(1)(iii): a copy of the record is provided without cost, the necessary copying facilities are made available without cost, or the record is loaned to the employee or representative for a reasonable time to enable a copy to be made. Under (e)(1)(v) you may charge reasonable, non-discriminatory administrative costs for additional copies of a record already provided free — not for the first one.

There is a quieter duty in the same standard that catches more businesses out. Paragraph (g) is headed Employee information, and (g)(1) requires that, upon an employee first entering into employment and at least annually thereafter, employees are informed of the matters it lists — beginning, at (g)(1)(i), with the existence, location, and availability of any records covered by this section.

That has a practical consequence worth sitting with. If you have to tell every employee once a year where their records are kept, then the answer has to be a real place with a real name attached to it. A business that has never decided where the medical file lives cannot comply with (g) even if it has never had an incident.

One historical oddity is worth knowing so it does not look like an error. 1910.1030(c)(1)(iii), the paragraph requiring the plan to be accessible, cross-references 29 CFR 1910.20(e) — an older section number for the access to records rule, which now appears at 1910.1020. We set that out when we built the plan template; it is a numbering artefact, not a different rule.

Frequently Asked Questions (FAQ)

Is there an official OSHA bodily fluid incident report form?

No. OSHA publishes forms for its injury and illness recordkeeping rule — the OSHA 300 Log and the OSHA 301 Incident Report, both named in 29 CFR 1904.33 — but 29 CFR 1910.1030 prescribes the contents of the records it requires rather than a format. The operational record of a bodily fluid cleanup is yours to design.

Does the incident report form that comes in a cleanup kit satisfy OSHA?

It is a job aid, not a compliance record on its own. The Magnicare kits list an instruction sheet and an incident report form in English and Spanish, which is a sensible place to capture what happened at the scene. The confidential medical record at 1910.1030(h)(1) and the sharps injury log at (h)(5) are separate records with their own prescribed contents.

Do we need an incident record if nobody was exposed?

1910.1030 ties its medical record to employees with occupational exposure, and the plan entry at (c)(1)(ii)(C) to exposure incidents, so a cleanup with neither does not create those records. An operational record is still worth keeping: it is what tells you the kit was used, what to restock before the next shift, and what to show an inspector or an insurer.

Can one form hold both the medical details and the operational details?

It should not. 1910.1030(h)(1)(iii) requires employee medical records to be kept confidential and not disclosed without the employee’s express written consent, so a single sheet filed where a shift manager can read it puts you on the wrong side of that paragraph. Two records, two places.

How long do we keep a bodily fluid incident report?

It depends which record you mean. 1910.1030(h)(1)(iv) sets at least the duration of employment plus 30 years for the medical record. Training records get three years under (h)(2)(ii). The sharps injury log runs on the Part 1904 clock at 29 CFR 1904.33, which is five years following the end of the calendar year the records cover.

Do we have to put the injured employee’s name on the OSHA 300 Log?

Not for a needlestick or a cut from a contaminated sharp. 29 CFR 1904.8(a) says you may not enter the employee’s name, and 1904.29(b)(6) tells you to enter the words privacy case in the space normally used for it. 1904.29(b)(9) also lets you use discretion in describing the injury or illness on both the 300 and the 301 forms.

Does a small business have to keep a sharps injury log?

1910.1030(h)(5)(ii) applies the duty to any employer who is required to maintain a log of occupational injuries and illnesses under 29 CFR part 1904. If Part 1904 does not require you to keep that log, this paragraph does not add a sharps injury log either — check Part 1904 for its own scope and exemptions rather than assuming.

Can an employee get a copy of their own medical record, and who pays?

Yes. 29 CFR 1910.1020(e)(1)(i) requires access in a reasonable time, place and manner, and if you cannot provide it within fifteen working days you must apprise the employee of the reason for the delay and the earliest date the record can be made available. Under (e)(1)(iii)(A) a copy is provided without cost; (e)(1)(v) allows reasonable, non-discriminatory administrative costs for additional copies of a record already provided free.

Keep the record with the kit

Every record in this article starts at the same moment: somebody picks up a kit. If the kit is in the wrong cupboard, or the form is not with it, the paperwork gets written from memory an hour later, and written-from-memory is what inspectors and insurers are good at spotting.

Both Magnicare cleanup kits are built for that moment. The Bloodborne Pathogen and Vomit Cleanup Kit (BAG) and the Bodily Fluid Clean Up Kit (BOX) each list absorbent powder, towels or wipes, disposable gloves, face masks with shields, shoe covers, aprons, a scraper and biohazard disposal bags, plus an instruction sheet and an incident report form in English and Spanish. The form in the box is where the operational record begins.

Two sensible additions from your own stores: confirm you hold a disinfectant suitable for the surfaces you are cleaning, since the kits do not list one, and decide now which locked place the medical file will live in. Neither costs anything and both are questions you would rather answer today than on the day.

If you are still working out which kit belongs where, our comparison of biohazard and bodily fluid kits is the place to start, and the full 29 CFR 1910.1030 kit requirements guide covers what the standard expects a kit to do. Browse the whole range in the blood and bodily fluid cleanup kits collection.

Primary sources used in this article: 29 CFR 1910.1030, 29 CFR 1910.1020 and 29 CFR 1904.8. Paragraph designations were checked against two independent reproductions of the Code of Federal Regulations before publication.