A housekeeper finds a used needle in a hotel linen bag. A custodian handles a mop soaked in blood from a workplace injury. Under 29 CFR 1910.1030, these are covered exposures that trigger specific legal obligations. The standard applies to every employer whose workers have occupational exposure to blood or other potentially infectious materials (OPIM), which includes BSCs cleaning healthcare facilities, schools, correctional facilities, hotels, and any other setting where human blood or bodily fluids may be present.
OSHA defines occupational exposure as reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or OPIM that may result from the performance of an employee's duties. For housekeeping, that threshold is crossed routinely in healthcare settings and episodically in most other settings. The 2026 penalty ceiling is $16,550 for Serious violations and $165,514 for Willful or Repeat violations.
What the Standard Requires
The Bloodborne Pathogens standard builds its compliance framework around an Exposure Control Plan (ECP) that is specific to the workplace, not a generic template. It must identify job classifications with exposure, describe methods for eliminating or reducing exposure, and be updated annually and whenever new tasks or procedures are added.
| Obligation | Specific Requirement | CFR Section |
|---|---|---|
| Exposure Control Plan | Written plan, updated annually, accessible to employees and OSHA | 1910.1030(c) |
| Engineering controls | Sharps disposal containers, puncture-resistant bags; reviewed and updated annually | 1910.1030(d)(2) |
| Work practice controls | No recapping by two-handed technique; wash hands after removing gloves | 1910.1030(d)(3) |
| PPE | Gloves, gowns, face protection provided at no cost; replaced when torn or punctured | 1910.1030(d)(3)(x) |
| Hepatitis B vaccination | Offered to all at-risk employees within 10 days of initial assignment, at no cost | 1910.1030(f)(1) |
| Post-exposure evaluation | Confidential medical evaluation and follow-up after any exposure incident | 1910.1030(f)(3) |
| Training | At time of initial assignment and annually; covers ECP, modes of transmission, PPE use | 1910.1030(g)(2) |
| Recordkeeping | Medical records retained 30 years post-employment; training records 3 years | 1910.1030(h) |
The housekeeping-specific provision at 1910.1030(d)(4) requires that contaminated work surfaces be decontaminated with an appropriate disinfectant after contact with blood or OPIM, at the end of the work shift if the surface may have become contaminated, and immediately after spillage. The term "appropriate disinfectant" points to EPA List B (HIV-effective) or List A (tuberculocidal) registered products depending on the pathogen risk profile.
Who It Applies To
The standard covers all employees with occupational exposure. For cleaning contractors, the practical question is whether the specific account exposes workers to blood or OPIM as a reasonably anticipated part of their duties. Healthcare settings, including hospitals, clinics, dental offices, dialysis centers, and long-term care facilities, create definitive exposure. School custodians handling injured students qualify. Hotel housekeepers who regularly encounter blood-contaminated linen or sharps in guest rooms qualify. Office building cleaners who only encounter routine waste generally do not, unless the building serves a medical or research population.
The Exposure Control Plan must list specific job titles and tasks that involve exposure. A blanket designation of "all cleaning employees" without task analysis is a citation waiting to happen. Each ECP must be facility-specific enough that an inspector can verify it matches the actual work environment.
What the Inspector Looks At
OSHA compliance officers follow a predictable inspection sequence for BBP. They will ask for the ECP first, then check whether the hepatitis B vaccination program is documented, then audit training records for timeliness and content.
| Inspector Check | Common Deficiency Found | Citation Level |
|---|---|---|
| Written ECP | Generic template; not updated to reflect current facility layout or tasks | Serious, $16,550 |
| Hep B offer documentation | No record that vaccination was offered within 10 days; no declination form signed | Serious, $16,550 |
| Sharps containers | Sharps container over the fill line; containers not puncture-resistant | Serious |
| Training records | Annual retraining not completed; training records purged before 3-year retention period | Serious |
| PPE availability | Gloves not stocked in sizes that fit all workers; no face protection for splash tasks | Serious |
| Post-exposure follow-up | No documented process for confidential medical evaluation after needlestick | Willful if deliberate omission |
Common Citations and What They Cost
The most frequently issued BBP citation for cleaning contractors is failure to maintain or update the Exposure Control Plan under 1910.1030(c)(1)(iv). Second is failure to document the hepatitis B vaccination offer under 1910.1030(f)(2). Both carry Serious classification and up to $16,550 per instance. A BSC that has not updated its ECP for three years while adding new healthcare accounts is likely to face grouped citations covering multiple deficiencies.
In publicly available OSHA enforcement records searchable through the OSHA IMIS establishment database, multi-state cleaning contractors have reached settlements involving multiple BBP violations across several healthcare facility sites. Penalty reductions through abatement documentation are standard in informal settlement conferences, typically 30 to 50 percent. Where a Repeat classification applies due to a prior BBP citation within three years, the maximum climbs to $165,514 per violation instance.
Tradeoffs and Operator Reality
The hepatitis B vaccination requirement creates a cost friction point that trips up small BSCs. The standard requires the employer to pay for the vaccination series (three shots over six months) for every worker with occupational exposure. At current clinic rates, that runs $150 to $300 per employee for the full series. For a BSC with 30 workers in healthcare accounts and 40 percent annual turnover, the annual vaccination budget can reach $3,000 to $4,000 before factoring in new-hire timing. Some operators manage this by tiering accounts: workers without healthcare exposure remain off the BBP program, while a dedicated healthcare crew maintains full BBP compliance. This is operationally sound and defensible to an inspector, provided the ECP accurately reflects the tiered structure and the task analysis is documented. The tradeoff: if a non-designated worker fills in at a healthcare account, the employer must document that a vaccination was offered before that assignment began.
What to Put in the SOW and Training Matrix
Service contracts for healthcare and other high-exposure accounts should specify that the contractor maintains a facility-specific ECP, names the contractor as responsible for hepatitis B vaccination, and commits to annual BBP training with records available to the facility upon request. The SOW should also define the disinfectant requirements for blood-contact surfaces by reference to the facility's infection control program. Some hospitals specify that the contractor must use a facility-approved List B or List A product rather than the contractor's standard disinfectant.
Training content must cover how BBP are transmitted, what the ECP says, the hierarchy of controls, proper glove and PPE use, sharps disposal procedures, what to do after an exposure incident, and the hepatitis B vaccination program. Generic online BBP courses satisfy the content requirement if supplemented with facility-specific information. The PPE selector helps map glove specifications to specific BBP exposure scenarios.
See the related page on OSHA HazCom 1910.1200 for the disinfectant labeling and SDS requirements that run parallel to BBP compliance. For healthcare-specific environmental cleaning programs governed by CDC and Joint Commission standards, see the healthcare cleaning vertical hub. The full compliance reference index is at Opora Compliance Library.
The OSHA BBP topic page includes the standard text, a small entity compliance guide, and the 2001 Needlestick Safety and Prevention Act revisions. The CDC NIOSH bloodborne pathogens page covers exposure risk data and post-exposure prophylaxis guidance. For PPE requirements that run alongside BBP, see OSHA PPE 1910.132 for Cleaning Crews.
By the Opora Editorial Team · Last updated: 2026