OSHA for medical offices: bloodborne pathogens and the needle stick injury protocol

What is the needle stick injury protocol for a medical office?

For splashes, CDC adds two steps: flush the nose, mouth or skin with water, and irrigate eyes with clean water, saline or sterile irrigants. The rest of the protocol, in order:

Sources: CDC/NIOSH; 29 CFR 1910.1030 and part 1904; 2025 PHS guideline; CDC hepatitis B and C exposure guidance. Read Oct 20, 2026.

Accidental needle stick protocol: how fast must HIV PEP start?

The 2025 guideline replaces the 2013 one: new drug regimens, shorter follow-up testing, no routine drug-toxicity labs. It is written for the treating clinician, who decides each case:

• Source status: PEP starts without waiting for the source patient’s HIV result, and stops, with follow-up testing, if the source tests HIV negative.
• Tests: a fourth-generation HIV antigen/antibody test plus creatinine, AST and ALT as soon as possible (repeated only if abnormal or symptoms appear); final HIV tests (antigen/antibody and NAT) at week 12, with interim tests at weeks 4–6 only if PEP started more than 24 hours after a single exposure or doses were missed.

The guideline puts the average risk of HIV transmission after a percutaneous exposure to HIV-infected blood at 0.23%, and about 0.09% after a mucous membrane exposure. Under CDC’s hepatitis B guidance, a worker with a documented vaccine response (anti-HBs of 10 mIU/mL or more) needs no post-exposure prophylaxis.

What does the OSHA needlestick protocol require of the employer?

Under 29 CFR 1910.1030(f), the employer provides the evaluation and follow-up free to the worker, at a reasonable time and place, by or under a licensed physician or other licensed healthcare professional, following current U.S. Public Health Service recommendations, with lab tests at an accredited laboratory, also free.

• The referral packet: a copy of the standard, a description of the worker’s duties, the documentation of the route and circumstances, the source’s results if available, and the medical records the employer keeps, vaccination status included.
• The written opinion is limited to two facts: that the worker was told the results, and about any condition from the exposure that needs further evaluation or treatment. Every other finding stays confidential.

Florida normally requires telling a person that an HIV test is planned and that they may decline it, but s. 381.004(2)(h)10., F.S. says that rule does not apply to testing someone whose blood or body fluids caused a “significant exposure” (by needlestick, instruments or sharps, or on mucous membranes or skin) to medical personnel, a term that includes an employee of a health care professional. The conditions:

• the exposure is documented under a licensed physician’s supervision, only in the worker’s personnel record;
• the worker or the employer pays for the HIV test;
• the worker is tested too, or shows a negative HIV test from the 6 months before the exposure;
• anyone who receives the results keeps them confidential;
• if the source won’t come in, a court can order the test on a physician’s sworn statement.

Whether the statute covers a particular exposure is a question for your attorney.

What does OSHA’s bloodborne pathogens standard address?

It covers every employer whose employees have occupational exposure: “reasonably anticipated” contact with blood or other potentially infectious materials in their duties. Its center is a written exposure control plan that:

• lists the job classifications and tasks with exposure, the schedule for meeting each part of the standard, and the procedure for evaluating exposure incidents;
• is accessible to employees;
• is reviewed and updated at least once a year and whenever tasks or positions change, documenting each year the “consideration and implementation” of safer medical devices;
• documents that frontline, non-managerial staff exposed to sharps were asked for input on those devices and work practices.

Opening an office? The plan belongs on the opening checklist (start a medical practice). The hepatitis B vaccine is offered free to every exposed employee after training and within 10 working days of initial assignment, and no prescreening can be made a condition (HR and staff training covers onboarding). Training comes at initial assignment and within one year of the last session; its content and records are on compliance training.

What are the 5 OSHA requirements for sharps containers?

Under 29 CFR 1910.1030(d)(4)(iii)(A), a container for contaminated sharps is:

1. closable;
2. puncture resistant;
3. leakproof on the sides and bottom;
4. labeled or color-coded;
5. in use, easily accessible and as close as feasible to where sharps are used, kept upright, and “Replaced routinely and not be allowed to overfill.”

A contaminated sharp is “any contaminated object that can penetrate the skin,” so the lancets from waived fingerstick tests (CLIA waiver) belong in the same containers. Contaminated needles may not be bent, recapped or removed unless no alternative is feasible or a specific procedure requires it, and shearing or breaking them is prohibited ((d)(2)(vii)).

Florida’s biomedical waste rule, Rule 64E-16.004, F.A.C., adds:

• sharps go into a sharps container at the point of origin;
• a container is sealed when full: at the fill line, or when nothing more fits without cramming;
• the biohazard symbol on a sharps container is at least 1 inch across;
• the office stores biomedical waste no more than 30 days, counted from the first non-sharps item placed in a red bag or container, or from sealing a container that holds only sharps.

Do medical offices log needlesticks on the OSHA 300 Log?

“You must record all work-related needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material”

The case is entered as an injury, as a privacy case without the worker’s name. But many offices keep no 300 Log at all (29 CFR 1904.1, 1904.2):

• Partially exempt industries: offices of physicians (NAICS 6211), dentists (6212) and other health practitioners (6213), outpatient care centers (6214) and medical and diagnostic laboratories (6215), unless OSHA or BLS asks in writing.
• Small companies: 10 or fewer employees at all times during the last calendar year.
• The sharps injury log (device type and brand, work area, how it happened) is required only of employers that keep the 300 Log.

Exempt or not, every employer reports a work-related death to OSHA within 8 hours, and an in-patient hospitalization, amputation or loss of an eye within 24 hours, by phone to the nearest area office, at 1-800-321-6742 or online.

What is OSHA in healthcare, and who enforces it in Florida?

Florida has no OSHA-approved State Plan, so federal OSHA covers most private employers; state and local government workers aren’t covered by federal OSHA. For penalties proposed after Jan 15, 2025 (no 2026 adjustment), a serious or other-than-serious violation costs up to $16,550, a willful one $11,823 to $165,514 and a repeated one up to $165,514 (29 CFR 1903.15(d)).

OSHA is one of several agencies a compliance program answers to; HHS enforces HIPAA and keeps the exclusion list.

What you can do today

1. Post CDC’s first-aid steps at every sharps area, with the phone number of the clinic that sees exposed workers.
2. Name that clinic or occupational health service, evenings and weekends included, and keep the referral packet with the exposure control plan.
3. Date this year’s plan review, with the safer-device evaluation and the frontline staff input written into it.
4. Walk the rooms with the five container rules above and Florida’s 30-day storage limit.
5. Check each exposed employee’s hepatitis B file for a vaccine record or a signed Appendix A declination.
6. Look up your NAICS code and last year’s peak headcount to see whether you keep the 300 Log, and save 1-800-321-6742 for the 8- and 24-hour reports.

Advixor’s compliance training service develops and coordinates required workforce compliance training, OSHA and infection control included, and helps maintain the training records.