If an employee is expected, as part of their job, to clean up blood or render first aid, they need bloodborne pathogen training — before that first assignment, and at least once every year after. OSHA does not require a job description to say so. An expectation is enough, and that is where most small employers get caught.

The rule lives in 29 CFR 1910.1030(g)(2). It is short, it is specific, and almost none of it is about healthcare. Below is who is covered, how often the training is due, the fourteen elements the session must contain, and the records you have to be able to produce three years later.

Who legally needs bloodborne pathogen training?

The standard does not list industries and it does not list job titles. It states its own scope in one sentence at 1910.1030(a): this section applies to all occupational exposure to blood or other potentially infectious materials as defined by paragraph (b) of this section.

Everything therefore turns on the definition of occupational exposure at 1910.1030(b), which reads: reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials that may result from the performance of an employee's duties.

Read that carefully, because three words in it do all the work. Reasonably anticipated means you do not wait for the first incident. Duties means the test is about the job, not the industry. And may result means a possibility is sufficient — not a pattern, not a history, not a frequency.

So the question is never whether you run a clinic. It is whether somebody on your payroll is expected to deal with blood. In a restaurant, a warehouse, a gym or a salon, the answer is usually yes for at least one person, and usually nobody has worked out who.

The row that matters most is the third one, because it is the one no employer has written down.

Can an employee be covered without being formally designated?

Yes, and OSHA has said so in its own words. The agency's letter of interpretation of 4 December 1992 takes the question directly. Its first answer states: if an employee is expected, as part of his or her job duties, to render first aid or medical assistance, that employee is covered by the requirements of the standard.

The sentence that follows is the one worth printing out. OSHA continues: such an expectation would constitute a de facto designation of the employee and OSHA, additionally, would require that such an employee receive the appropriate training.

The duty attaches to the expectation, not to the paperwork. If the kit is in the back office and everyone knows the duty manager deals with it, the duty manager has been designated — whether or not anyone ever told them so.

This is why an audit of job descriptions is the wrong place to start. The right question is behavioral: when something happens at 11pm on a Saturday, who picks up the kit? That person is on your training roster, and a tribunal or an inspector will reconstruct the answer from how the business actually runs.

Our step-by-step blood spill cleanup procedure makes the same point from the other direction: the moment you hand the job to a host, a shift lead or a cleaner, you have brought that person inside the standard. This article is what follows from that — the training obligation it creates, and the paperwork that proves you met it.

How does the exposure determination decide who gets trained?

Before there is a training roster, there is a document that produces it. 1910.1030(c)(2) requires each employer who has an employee with occupational exposure to prepare an exposure determination, and it specifies three lists.

1. (c)(2)(i)(A) — a list of all job classifications in which all employees in those job classifications have occupational exposure.
2. (c)(2)(i)(B) — a list of job classifications in which some employees have occupational exposure.
3. (c)(2)(i)(C) — a list of all tasks and procedures, or groups of closely related tasks and procedures, in which occupational exposure occurs and that are performed by employees in the classifications listed under (B).

The structure is deliberate. The (A) list is easy and most small businesses have nobody on it. The real work is the (B) and (C) pair, which is where a restaurant, a school or a warehouse actually lives: a job where exposure is occasional, plus a named list of the tasks that cause it.

Then comes the sentence that overturns most of the reasoning employers bring to this. 1910.1030(c)(2)(ii) reads: this exposure determination shall be made without regard to the use of personal protective equipment.

You cannot write somebody off the list because they wear gloves. The gloves are the control; the determination is the hazard. An employer who reasons that the cleaner is not exposed because the kit contains nitrile gloves has inverted the standard, and has also removed from the training roster the one person most likely to need it.

The determination sits inside the written exposure control plan required by (c)(1), and the plan is a bigger document than this article. Here it matters for exactly one reason: it is the gate. Whoever lands on the (A) or the (C) list is an employee the training paragraphs now cover.

Who is not covered, and where exactly is the line?

Honest scoping is as useful as honest coverage, and the 1992 letter is as clear about the exclusions as it is about the inclusions.

Good Samaritan acts are out. Answering a question about assisting a co-worker with a nosebleed, OSHA states that Good Samaritan acts are not covered under the standard regardless of the particular type of injury involved. An employee who chooses to help, with no duty to do so, is not thereby brought inside the standard.

And the agency pre-empts the obvious objection. It adds that the work-relatedness of the injury is not the determining factor; rather, coverage is invoked when an employee is expected to render assistance as part of his or her job duties. A workplace injury does not create coverage. A workplace duty does.

Housekeeping outside healthcare is usually out — but it is your call, not a default. On the hotel and motel question the letter says OSHA does not generally consider housekeeping staff in non-health care facilities to have occupational exposure. It then declines to leave it there, adding that employers in the hotel industry would have to take into account all circumstances of potential exposure and determine which, if any, employees may come into contact with blood.

That is a determination obligation, not an exemption. The general position gets you a sensible starting point; paragraph (c)(2) still requires you to do the thinking for your own building.

Where the line is genuinely unclear

OSHA gives no number. There is no threshold of incidents per year that converts a Good Samaritan into a designated responder, and no stated frequency below which an expectation stops being an expectation. The distinguishing feature in OSHA's own framing is whether assistance is expected of the employee, and that is a question about how your business is organized rather than about arithmetic.

Practically, the safe reading is this: if you would be annoyed to find out that the employee had not dealt with it, you expected them to. That is a de facto designation and it carries a training obligation.

One thing this article is not about

Vomit, feces and urine are not on the paragraph (b) list of other potentially infectious materials, so 1910.1030 does not reach them unless blood is visibly present or differentiation between fluid types is difficult or impossible under (d)(1). The obligations around a vomiting or diarrheal event in a food business come from the FDA Food Code and your state adoption, and we cover them in who goes home, who you notify, and when you reopen during a norovirus outbreak.

The distinction is worth stating plainly, because the two regimes are routinely confused. Food Code employee health is about keeping a sick worker away from food. Bloodborne pathogen training is about preparing a well worker to handle blood. Different trigger, different document, different clock.

How often is bloodborne pathogen training required?

Two trigger points, one renewal clock, and one event-driven top-up. The paragraph numbering has a gap in it, which is why you will see conflicting citations online, so the designations below are worth taking from the regulation itself.

The renewal clock is the one that catches people. Paragraph (g)(2)(iv) measures from the previous session, not from the start of a calendar year. A team trained on 14 January is due again by 14 January the following year — not by the following December, and not at whatever point in the new year the training budget is approved.

An employer running a December refresher every year is compliant. An employer who trained in January and schedules the next round for the following November is compliant. An employer who trained in January and gets to it in the following February is not, and the training record will say so in writing.

The change trigger is separate from the annual clock

Paragraph (g)(2)(v) is not a renewal; it is an addition. If you introduce a new task that affects exposure — a different cleanup protocol, a new piece of equipment, a service you did not previously offer — the obligation lands at that moment regardless of where you are in the annual cycle.

The practical version for a small business: any time you change what is in the kit, where it lives, or who is expected to use it, you have probably triggered (g)(2)(v). Making that review part of the same conversation as restocking is cheaper than remembering it separately.

It is paid time, and it is not the employee's expense

Paragraph (g)(2)(i) is a three-sentence paragraph and the middle sentence is often overlooked. It requires the employer to train each employee with occupational exposure in accordance with the requirements of the section, and then states: such training must be provided at no cost to the employee and during working hours.

So a course the employee is asked to buy does not discharge the duty, and neither does one they are asked to complete at home on their own time. The third sentence closes the loop by requiring the employer to institute a training program and ensure employee participation in it — participation is the employer's problem, not a matter of whether the employee got around to it.

What must the training session actually contain?

This is the part most off-the-shelf courses handle badly, because two of the fourteen required elements are site-specific and no vendor can supply them. Paragraph (g)(2)(vii) introduces its list with a lead-in that leaves no room: the training program shall contain at a minimum the following elements.

Element (A) is a supply obligation, not a lecture topic. The employee is entitled to an accessible copy of the regulatory text. A slide summarizing the standard is not the standard; a printed or linked copy they can reach without asking is.

Element (D) is the one a generic course cannot deliver. Your exposure control plan is yours — your job classifications, your task list, your kit locations, your reporting route. A national training module has never read it. If the session does not cover your own plan, element (D) is unmet no matter how polished the rest was.

Elements (G) and (H) are also worth separating in your own mind. (G) is the inventory and the handling rules; (H) is the reasoning — why these gloves, why a mask with a face shield rather than safety glasses. An employee who can recite the contents of the kit but cannot say why the apron is in there has had (G) and not (H).

It has to be in a language and at a level they can use

Paragraph (g)(2)(vi) requires that material appropriate in content and vocabulary to the educational level, literacy and language of employees shall be used. For a kitchen or a warehouse crew that is not a formality, and it is not satisfied by handing someone an English workbook and a signature line.

A bilingual instruction sheet inside the kit is a useful job aid and it is not training. It tells somebody what to do in the moment; it does not cover epidemiology, transmission, your exposure control plan, or the post-exposure route. Keep the two separate in your records, because an inspector will.

Does an online course or a video satisfy the standard?

Partly, and the gap is always in the same place. Two requirements sit at the end of paragraph (g)(2) and together they rule out unattended training: (g)(2)(vii)(N) requires an opportunity for interactive questions and answers with the person conducting the training session, and (g)(2)(viii) requires that the person conducting the training be knowledgeable in the subject matter covered by the elements contained in the training program.

OSHA has been asked about this twice and the answers are blunt. Its letter of 28 August 1996 states that training the employee solely by means of a film or video without the opportunity for a discussion constitutes a violation of the regulation. The same letter sets out what a video can legitimately do: it says that while video training programs are certainly appropriate for use as an aid in training, they must be supplemented with the required site specific information, and a person must be accessible for interaction.

The letter of 17 January 2008 goes further and addresses timing. It states that employees must have direct access to a qualified trainer at the time the training is being conducted, and it rejects the workaround most online vendors rely on: where the protocol is for the employee to leave a phone message and wait for a response, OSHA says that would not meet the intent of the standard.

Usefully, the same letter confirms that the trainer does not have to be in the room. It accepts that training conducted by compressed digital video, where the trainer is in one location but is in direct communication with the trainees, would provide for an interactive exchange. Remote is fine. Absent is not.

The three-part test for any course you are considering buying

1. Does it carry your site-specific content? If it cannot cover your exposure control plan, your task list and your kit locations, elements (D) and (E) are still yours to deliver.
2. Is there a named, knowledgeable person behind it? Paragraph (g)(2)(viii) attaches the requirement to a person, and as the next section shows, that person's name and qualifications go into your records.
3. Can an employee reach them while the training is happening? Not a support inbox with a stated turnaround. Access at the time.

The cheapest compliant arrangement for a small employer is usually a hybrid: a bought module for the general content in (B), (C), (I) and (M), delivered in a session where a knowledgeable person covers your own plan and takes questions live. On trainer credentials, OSHA does not demand a clinical qualification — its compliance guidance accepts non-healthcare professionals provided they are knowledgeable in the subject matter.

What training records must you keep, and for how long?

Paragraph (h)(2) is short and it is the part of the standard an inspection reaches first, because it is the only part that leaves evidence. For each training session, four items are required.

Retention is set by (h)(2)(ii): training records shall be maintained for 3 years from the date on which the training occurred. That is a much shorter horizon than the employee medical records under (h)(1)(iv), which run for the duration of employment plus thirty years. Two different clocks, and people mix them up in both directions.

A vendor certificate is usually not a compliant record. Most of them show a name, a date and a course title. That covers (A) and part of (B); it rarely shows the qualifications of the person who delivered the training, and it never shows job titles. Three years later, when the question is whether the shift lead on duty that night had been trained, the certificate answers half of it.

The low-effort fix is a single sheet per session carrying the four fields and a one-paragraph summary of what was covered, filed with your exposure control plan. If the session covered your own plan and your own task list — as elements (D) and (E) require — then the summary is also the evidence that you did.

Where do small employers get this wrong?

1. Assuming the standard is a healthcare rule. Paragraph (a) scopes it to occupational exposure, not to an industry. A restaurant with one designated responder is inside it; a clinic with none would be a strange clinic.
2. Auditing job descriptions instead of expectations. OSHA's de facto designation language means the roster is built from how the business runs, not from what the paperwork says.
3. Counting PPE against the determination. Paragraph (c)(2)(ii) forbids it in terms. Gloves are the control, not a reason to leave somebody off the list.
4. Letting annual drift into a calendar year. Paragraph (g)(2)(iv) measures twelve months from the previous session.
5. Treating an unattended online module as the whole obligation. Elements (D) and (N) are the two no vendor can supply, and they are the two OSHA has written letters about.
6. Charging the employee, or using unpaid time. Paragraph (g)(2)(i) requires training at no cost and during working hours.
7. Keeping certificates instead of records. Four fields, three years, filed where you can find them.

Training is only one of the obligations the standard puts on an employer who has anyone exposed. The equipment side — what has to be available, provided at no cost and accessible in the right sizes — is set out in our breakdown of exactly what 29 CFR 1910.1030 requires your cleanup kit to contain. If you are also working out where first aid supplies end and cleanup supplies begin, OSHA first aid requirements and where a cleanup kit fits draws that line using OSHA's own Appendix A. And if the vocabulary itself is the problem, biohazard cleanup kit versus bodily fluid kit explains which regime governs which mess.

The regulation itself is worth bookmarking rather than paraphrasing: the full text is on eCFR at 29 CFR 1910.1030, and element (A) means your employees are entitled to reach it too.

Frequently Asked Questions (FAQ)

Who needs bloodborne pathogen training?

Any employee with occupational exposure as defined at 29 CFR 1910.1030(b) — reasonably anticipated skin, eye, mucous membrane or parenteral contact with blood or other potentially infectious materials arising from their duties. That includes anyone designated to render first aid as a primary or collateral duty, and anyone expected to clean up blood, whatever their job title says. OSHA treats an expectation as a de facto designation.

How often is bloodborne pathogen training required?

At the time of initial assignment to tasks where occupational exposure may take place, under 1910.1030(g)(2)(ii)(A), and at least annually after that under (g)(2)(ii)(B). Additional training is required separately under (g)(2)(v) whenever a change in tasks or procedures affects an employee's occupational exposure.

Does annual bloodborne pathogen training have to fall within the same calendar year?

No. Paragraph 1910.1030(g)(2)(iv) requires annual training within one year of the employee's previous training, so the clock runs from the last session rather than from January. A team trained in mid-January is due again by mid-January the following year.

Does an online bloodborne pathogen course meet OSHA requirements?

Only if a knowledgeable person is reachable while the training is happening and the session covers your own exposure control plan. Element (N) of 1910.1030(g)(2)(vii) requires an opportunity for interactive questions and answers with the person conducting the training, and OSHA has stated that a protocol requiring the employee to leave a message and wait for a response does not meet the intent of the standard. Remote delivery is acceptable; unattended delivery is not.

Does an employee who voluntarily helps an injured colleague need bloodborne pathogen training?

Not on the basis of that act alone. OSHA has stated that Good Samaritan acts are not covered under the standard regardless of the type of injury involved, and that the work-relatedness of the injury is not what triggers coverage. Coverage follows a duty to assist, not the fact that someone did.

Do restaurant, retail and warehouse staff need bloodborne pathogen training?

Whoever on the team is expected to handle a blood spill does, because the standard is scoped by occupational exposure rather than by industry. In most small businesses that is one or two people — a shift lead, a duty manager or a cleaner — and the common failure is that nobody has been named, trained or recorded.

How long do bloodborne pathogen training records have to be kept?

Three years from the date the training occurred, under 1910.1030(h)(2)(ii). The record must show the dates, the contents or a summary, the names and qualifications of the people who delivered the training, and the names and job titles of everyone who attended. Employee medical records are separate and run far longer, for the duration of employment plus thirty years.

Can an employer charge an employee for the training or require it on unpaid time?

No. Paragraph 1910.1030(g)(2)(i) states that the training must be provided at no cost to the employee and during working hours, and it also makes ensuring employee participation the employer's responsibility rather than the employee's.

Train the person, then equip them

Training is the employer's obligation and no product discharges it. What a kit does is make the trained response possible — and make elements (G) and (H) of the training session something you can run in front of an open box rather than a slide.

The Magnicare Bloodborne Pathogen and Vomit Cleanup Kit and the Bodily Fluid Clean Up Kit in a box carry the same contents: absorbent powder, towels, a full set of PPE including disposable gloves, masks with face shields, shoe covers and aprons, a scraper, biohazard bags, an instruction sheet in English and Spanish, and an incident report form.

Two of those items do double duty on the paperwork side. The bilingual instruction sheet supports paragraph (g)(2)(vi) by putting the in-the-moment steps in a second language, though it is a job aid rather than training. The incident report form gives you somewhere to capture an exposure incident at the time, which is what makes the post-exposure route in elements (K) and (L) a real procedure rather than a paragraph.

Confirm your own disinfectant stock separately. The kit contents listed above are what the product ships with, and an EPA-registered disinfectant whose label carries the claim you need is a purchase you make alongside it, not inside it.

If you are stocking several sites or a mix of front and back of house, the full range is in the blood and bodily fluid cleanup kit collection. Name the responders, book the session, keep the four-field record — and put the kit where the person you named can reach it in under a minute.