A norovirus outbreak in a food business is governed by the FDA Food Code and your state retail food rules, not by OSHA’s bloodborne pathogen standard. Three decisions sit outside the kit: who is excluded from work, who you notify, and when you reopen. The cleanup itself is a written procedure the Food Code requires you to hold in advance.

That last point catches people out. The Food Code does not ask whether you cleaned up well. It asks whether you had written procedures before the event, and whether you followed them. A bucket and a bottle of bleach can produce a clean floor and still leave you out of compliance.

This article covers the outbreak as an institutional event — the employee-health decisions, the notification duties, the closure call and the reopening evidence. If what you need is the step-by-step mechanics of getting a deposit off a floor, that lives in our guide to vomit cleanup kits for restaurants and, for the absorbent and disinfectant chemistry, in our guide to vomit absorbent powder.

Why does OSHA’s bloodborne pathogen standard not cover norovirus?

Because norovirus is not a bloodborne pathogen, and vomit is not automatically covered by the standard that everyone reaches for first. OSHA’s bloodborne pathogen rule applies, in its own words at 29 CFR 1910.1030(a), to all occupational exposure to blood or other potentially infectious materials as defined by paragraph (b) of the section.

So the question becomes what paragraph (b) actually lists. The definition of other potentially infectious materials names semen, vaginal secretions, cerebrospinal fluid, synovial fluid, pleural fluid, pericardial fluid, peritoneal fluid, amniotic fluid and saliva in dental procedures, along with unfixed human tissue and certain cultures. Vomit, faeces and urine are not on that list.

There are two routes by which a vomiting incident does come inside the standard, and both are worth knowing. The first is visible blood. The second is the sentence at 1910.1030(d)(1), headed General, which states that universal precautions shall be observed to prevent contact with blood or other potentially infectious materials, and that under circumstances in which differentiation between body fluid types is difficult or impossible, all body fluids shall be considered potentially infectious materials.

A mixed deposit on a dining-room carpet at 7pm, under low light, with a queue forming, is a textbook case of differentiation being difficult. Treat it as infectious and the question of which standard applies stops mattering at the point of response.

What this means in practice is simple and it is the opposite of what most operators assume. The PPE in your kit is not optional because the bloodborne standard might not apply — it is required by the food-safety rules below, and the bloodborne standard is the one that takes over the moment blood is in the picture. Our comparison of biohazard kits and bodily fluid kits sets out that scope boundary in full.

Which rules actually govern a norovirus event in a food business?

Three layers, and they do different jobs. Mixing them up is why so many operators hold a kit and no plan.

The Food Code is a model. It is not law anywhere until a state or locality adopts it, and the edition they adopted matters more than most people realise. We checked the clean-up provision across two state adoptions while researching this article and found exactly that problem.

The current federal model at § 2-501.11 requires that a food establishment shall have written procedures for employees to follow when responding to vomiting or diarrheal events that involve the discharge of vomitus or fecal matter onto surfaces in the food establishment, and that those procedures shall address the specific actions employees must take to minimize the spread of contamination and the exposure of employees, consumers, food, and surfaces to vomitus or fecal matter. It carries a priority-foundation designation.

Older adoptions based on the 2013 edition say procedures and omit the word written. That single word is the difference between a defensible file and a conversation about what you normally do. Check which edition your jurisdiction adopted before you decide a verbal routine is enough.

Who has to go home, and who makes that decision?

The Food Code puts the duty on two people and gives the decision to one of them. At § 2-201.11(A) the permit holder shall require food employees and conditional employees to report information about their health as it relates to diseases transmissible through food. The reporting duty runs upward, to the person in charge.

The exclusion decision then sits with the person in charge. At § 2-201.12(A)(1) the person in charge shall exclude a food employee who is symptomatic with vomiting or diarrhea. At § 2-201.12(A)(2) the exclusion also applies where the employee is symptomatic with vomiting or diarrhea and diagnosed with an infection from norovirus.

Two things follow that are easy to get wrong:

• Exclusion is not a judgement call about whether someone looks well enough. The trigger is the symptom, not the diagnosis, and not the employee’s own assessment.
• Exclusion means out of the establishment, not moved to the back. Restriction — keeping someone on site away from exposed food, clean equipment and single-service items — is a different and lesser measure, and the code says which one applies when.

In a small operation this is the decision that costs money, which is precisely why it should be written down before the night it happens. A shift lead who has to invent the rule at 7pm will invent the convenient one.

When can an excluded employee come back to work?

There are three different clocks in § 2-201.13, and conflating them is the most common norovirus compliance error we see discussed. They are not alternatives — they apply to different situations.

CDC says the same thing in plainer language for food workers: wait at least 2 days, which it gives as 48 hours, after symptoms stop. The CDC norovirus prevention guidance is the source most inspectors will recognise, and it agrees with the 48-hour figure in the code.

The seven-day clock is the one that surprises operators. A care home kitchen, a hospital cafeteria, a childcare centre and a facility serving immunocompromised people are not running the same rule as a sandwich shop. If you serve a highly susceptible population, assume the longer clock applies and staff your rota accordingly in winter.

Who do you have to notify, and when?

This is the duty most often missed entirely, because nothing about it is visible on the floor. At § 2-201.11(B) the person in charge shall notify the regulatory authority when a food employee is jaundiced, or is diagnosed with an illness due to one of the pathogens the section lists — norovirus among them.

Read the trigger carefully. It is a diagnosis, not an outbreak and not a hunch. One employee with a laboratory-confirmed norovirus infection starts the clock on a phone call, whether or not a single customer has complained.

Separately, CDC asks that outbreaks of acute gastroenteritis be reported. Its norovirus reporting and surveillance guidance states that healthcare providers should report all outbreaks of acute gastroenteritis, including suspected outbreaks of norovirus, to the appropriate state, local, or territorial health department, and that health departments are encouraged to report suspected and confirmed outbreaks through the National Outbreak Reporting System and CaliciNet.

You are not the healthcare provider in that sentence, and the surveillance systems are not yours to file into. What it tells you is where your information ends up and why the health department will have questions that sound like they already know something. Make one named person responsible for the call, and record the time it was made.

When must you stop serving, and how much do you close?

The Food Code answers both halves of that in one provision. At § 8-404.11(A) a permit holder shall immediately discontinue operations and notify the regulatory authority if an imminent health hazard may exist because of an emergency such as a fire, flood, extended interruption of electrical or water service, sewage backup, misuse of poisonous or toxic materials, onset of an apparent foodborne illness outbreak, gross insanitary occurrence or condition, or other circumstance that may endanger public health.

Three words in that sentence do a lot of work. May exist — not does exist. Apparent outbreak — not confirmed. And immediately, which is the same standard of urgency the bloodborne rule uses for decontamination and which leaves no room for waiting until the end of service.

The second half is the part that saves the business. At § 8-404.11(B) a permit holder need not discontinue operations in an area of the establishment that is unaffected by the imminent health hazard. Closure is scoped, not total. A deposit in a dining room does not automatically shut the kitchen, and a deposit near a self-service counter does not automatically shut the restaurant.

Self-service is the exception worth deciding in advance. Open food that customers reach over, serve themselves from and breathe near is the one area where a nearby vomiting incident is hard to argue as unaffected. Write the self-service closure into the procedure so nobody has to win that argument during the incident.

What does the Food Code require the cleanup itself to achieve?

Three provisions in the Supplement to the 2022 Food Code set the standard, and together they explain why ordinary sanitising is not the answer.

First, the threshold. At § 4-1002.11, where pathogens of concern are not controlled by available sanitizers, equipment, food-contact surfaces, non-food-contact surfaces and utensils shall be disinfected — (A) when contaminated with vomitus, fecal matter, blood, or any other bodily fluid that can lead to disease transmission, or (B) during a foodborne disease outbreak or imminent health hazard. Both limbs are priority items.

Second, the method. At § 4-1003.11(A) surfaces shall be disinfected in accordance with the EPA-registered label use directions, and at § 4-1003.11(B) disinfectants applied to a food-contact surface shall be rinsed with potable water unless the label directs otherwise. The label is the regulation. There is no number in the code telling you how long to leave the product on the surface, because the number belongs to the product.

Third, the proof. At § 4-501.116(A) the concentration of the sanitizing or disinfecting solution shall be accurately determined by using a test kit or other device, and at (B) that test kit shall be used in accordance with the manufacturer’s label instructions. A mixed bucket with no test strip is an unverified claim.

For the figures operators ask for most: CDC gives a chlorine bleach solution at a concentration of 1,000 to 5,000 ppm, which it expresses as 5 to 25 tablespoons of household bleach at 5% to 8% per gallon of water, and says to leave bleach disinfectant on the affected area for at least 5 minutes. Those are CDC’s numbers for a bleach solution, not a licence to apply them to a different product.

The disinfection detail, the Food Code definition of disinfection and the EPA List G mechanics are covered in full in our restaurant bodily fluid cleanup kit guide, and the reason an absorbent powder can never carry a disinfection claim is set out in our absorbent powder guide. This article does not restage either.

On waste, one line is enough: a bagged vomit cleanup from a restaurant is normally not regulated medical waste, and the releasability test and red-bag-or-trash decision are set out in our guide to biohazard waste and red bag rules. If there is visible blood in the deposit, the timed blood spill procedure is the one to follow instead.

What belongs in a norovirus cleanup kit, and what has to come from somewhere else?

A norovirus cleanup kit has one job: put everything a single responder needs within arm’s reach so the procedure can start immediately rather than after a trip to three storerooms. Judge a kit by whether it removes delay, not by the number of items printed on the box.

The Magnicare cleanup kit bag and the cleanup kit box hold the same contents: absorbent powder, towels, a full set of PPE — disposable gloves, masks with face shields, shoe covers and aprons — a scraper, biohazard bags, an instruction sheet in English and Spanish, and an incident report form.

Two things have to come from outside the kit, and both are worth confirming against your own stock rather than assuming.

• The disinfectant. Confirm you hold an EPA-registered product with a norovirus claim and a printed contact time. A product chosen for blood is registered against different organisms; check that the one on your shelf carries the claim you now need.
• The test kit. § 4-501.116 requires the concentration to be determined with a test kit or other device. Test strips are cheap, they are specific to the chemistry, and an inspector can ask to see them.

One honest note on the OSHA framing you will see on cleanup kits generally, including ours. The bloodborne pathogen standard is a real and correct reference point for a kit of this kind, because blood is the case it governs. For a norovirus event with no blood present, the obligations in this article come from the Food Code and your state adoption instead. The kit is the right kit; the citation that makes you buy it is not the citation that governs the outbreak.

If you want to stock the response without assembling it yourself, the cleanup kit collection holds the bag, the box and the red biohazard bags for containment.

When is it safe to reopen, and how do you evidence the decision?

If the regulatory authority suspended your permit or you closed under § 8-404.11, reopening is not your decision to make alone — it runs through the authority that was notified. Where you scoped the closure yourself and the permit was never touched, you are reopening on your own judgement, and judgement is exactly what needs a record.

There is no federal reopening checklist for norovirus and no federal number of hours. Anyone who quotes you one is quoting a state rule, a trade body or their own habit. What the Food Code does give you is the written procedure at § 2-501.11, and the only way to show you followed it is a contemporaneous record.

The minimum useful record, written the same shift:

1. Time and location of the event, and the time the area was closed.
2. Which areas were taken out of service, and the reasoning if self-service stayed open.
3. Who cleaned, what PPE they wore, and whether anyone had contact.
4. Which product was used, at what concentration, how it was verified, and for how long it stayed on the surface.
5. Where the waste went.
6. Which employees were excluded or restricted, on what date, and the earliest date each becomes eligible to return.
7. Who was notified, at what time, and what they said.

That last line is the one people skip and the one that matters most six weeks later. An undated decision is indistinguishable from no decision. The incident report form that ships in the kit covers most of this, and the exclusion dates are the field to add by hand.

Norovirus season runs from roughly November to March. The procedures, the test strips, the disinfectant with the right claim and the named person who makes the phone call are all cheaper and easier to put in place in October than on the night.

Frequently Asked Questions (FAQ)

Does OSHA require a norovirus cleanup kit?

No. OSHA has no standard that names norovirus and no standard that requires a cleanup kit by name. The bloodborne pathogen standard at 29 CFR 1910.1030 governs blood and the materials listed in its paragraph (b), and vomit is not on that list unless blood is visible or body fluid types cannot be differentiated. The obligations for a norovirus event in a food business come from the FDA Food Code as adopted by your state.

How long must a food employee stay off work after vomiting or diarrhea?

Under Food Code 2-201.13(D)(2) reinstatement requires that more than 48 hours have passed since the employee became asymptomatic. CDC gives the same figure as waiting at least 2 days after symptoms stop. Establishments serving a highly susceptible population work to a longer clock of more than 7 calendar days under 2-201.13(E)(2).

Do I have to tell the health department about one sick employee?

If that employee has been diagnosed with an illness due to norovirus, yes. Food Code 2-201.11(B) requires the person in charge to notify the regulatory authority when a food employee is diagnosed with an illness due to one of the listed pathogens. The trigger is a diagnosis, not an outbreak and not a number of cases.

Does a vomiting incident mean I have to close?

Not necessarily, and not necessarily all of it. Food Code 8-404.11(A) requires a permit holder to immediately discontinue operations and notify the regulatory authority where an imminent health hazard may exist, including the onset of an apparent foodborne illness outbreak. But 8-404.11(B) says a permit holder need not discontinue operations in an area unaffected by the hazard, so closure is scoped to the affected area.

Is bleach the only option for norovirus?

No, but it is the option CDC gives numbers for. CDC describes a chlorine bleach solution at 1,000 to 5,000 ppm, expressed as 5 to 25 tablespoons of household bleach at 5 to 8 percent per gallon of water, left on the affected area for at least 5 minutes. EPA List G identifies registered antimicrobial products effective against norovirus, and the Food Code requires any disinfectant to be used according to its EPA-registered label directions.

Is vomit regulated medical waste?

Usually not. A bagged vomit cleanup from a restaurant is normally ordinary waste rather than regulated medical waste, and the test turns on releasability rather than appearance. Visible blood changes the analysis, and so can your state medical-waste rules, so check locally before you assume either answer.

Do I need written procedures, or is staff training enough?

The current federal model Food Code at 2-501.11 requires written procedures, and it carries a priority-foundation designation. Some older state adoptions based on the 2013 edition require procedures without the word written. Check which edition your jurisdiction adopted, and write them down regardless, because a written procedure is the only version an inspector can read.

Can the same disinfectant cover both blood and norovirus?

Only if its EPA-registered label says so. EPA maintains separate lists for separate claims, and a product registered against bloodborne pathogens is not automatically effective against norovirus. Read the label for the specific organism claim and the contact time, and keep a product on hand that carries the claim you actually need.

Build the plan before the season starts

Norovirus is not a cleanup problem with a paperwork annex. It is an employee-health and notification problem with a cleanup in the middle of it, and the parts that get businesses into trouble are the exclusion clock, the phone call and the missing record.

Get the response itself out of the way first. The cleanup kit bag and the cleanup kit box each put absorbent powder, towels, gloves, masks with face shields, shoe covers, aprons, a scraper, biohazard bags, bilingual instructions and an incident report form in one place, so a single person can carry the whole response to the area and start immediately.

Then add the two things the kit cannot give you: a disinfectant whose label carries a norovirus claim and a printed contact time, and a test kit to prove the concentration. Write the procedure, name the person who calls the health department, and put the exclusion dates on the form. That is a plan an inspector can read in October rather than reconstruct in January.