Bloodborne pathogens training for home health agencies

Every employee at a home health or home care agency with occupational exposure to blood or other potentially infectious materials needs OSHA bloodborne pathogens training. Under 29 CFR 1910.1030(g)(2), each employee must be trained at initial assignment and then within 1 year of their previous training. The clock is per employee, not per calendar year: sessions in 2026 and 2027 can be 23 months apart and still late.

New or changed tasks that affect an employee's exposure trigger extra training, records are kept 3 years, and the rule binds Medicare-certified home health and private-pay home care alike. A State Plan state may require more.

What does OSHA require for bloodborne pathogens training?

29 CFR 1910.1030 requires training at no cost and during working hours for every employee with occupational exposure, at initial assignment and at least annually after that, with records kept 3 years.

Your due dates hang on (g)(2)(iv):

Annual training for all employees shall be provided within one year of their previous training.

29 CFR 1910.1030(g)(2)(iv)

Is bloodborne pathogens training annual or calendar year?

Annual, counted from each employee's own last session, not by calendar year. Under 29 CFR 1910.1030(g)(2)(iv), each person is due 12 months after the last session they attended.

A single all-staff date works only if nobody's last session is more than 1 year before it. Training someone early always keeps them inside the rule, and their clock restarts from that session; training them after the due date never does.

Your part-time, temporary and per diem staff count too. CPL 02-02-069, OSHA's enforcement directive, says they "are covered and are also to be trained on company time".

Does the rule cover home care and patients' homes?

Does it apply to agencies that are not Medicare certified?

Yes, wherever an employee has occupational exposure. 29 CFR 1910.1030 applies to "all occupational exposure to blood or other potentially infectious materials" and never mentions Medicare, so it binds private-pay home care and Medicare-certified home health alike. OSHA's 22 July 1992 letter to a home health care agency, written before the 1993 Martin decision, says OSHA's applicable regulations "cover all employers, regardless of the work setting".

CPL 02-02-069 lists home healthcare workers among the jobs whose employees "are not automatically covered unless they have the potential for occupational exposure".

Your agency decides which job classes and tasks count, in its own exposure determination under 29 CFR 1910.1030(c)(2), made without regard to personal protective equipment. A companion or homemaker needs the training if their tasks carry occupational exposure, and the determination must then list the job class or those tasks.

In a State Plan state, the state's standard applies. OSHA says State Plans "must be at least as effective as OSHA", so your state may require more. OSHA's hazard communication rule has its own page: the HazCom retraining deadline.

What can OSHA cite you for inside a patient's home?

In a patient's home, OSHA can still cite your training and records. OSHA's enforcement directive CPL 02-02-069, effective 27 November 2001, holds home health employers to "all non-site-specific requirements of the standard", including recordkeeping and "the generic training requirements".

The limit comes from American Dental Association v. Martin, 984 F.2d 823 (7th Cir. 1993). In the directive's words, the decision "upheld the bloodborne pathogens standard but restricted its application in the home health services industry", because the employer does not control the home.

One reading of the directive, not OSHA's text: a home care agency's training is citable either way, because the split puts the generic training requirements on the cited side, and an employer outside the split is held to the whole standard. The directive describes the industry as "companies whose employees provide home health services in private homes" and does not mention non-medical home care.

What changes trigger training before the anniversary?

A change in tasks or procedures that affects an employee's occupational exposure triggers additional training under 29 CFR 1910.1030(g)(2)(v), and that training "may be limited to addressing the new exposures created".

Examples at your agency: a new device you supply, a revised procedure in your own policy, or a client task your exposure determination newly lists.

The exposure control plan has its own clock, separate from each employee's training date. 29 CFR 1910.1030(c)(1)(iv) requires the plan to be reviewed and updated at least annually and whenever tasks, procedures or exposed positions change.

How do you keep and track the training records?

What records does OSHA require, and for how long?

Training records hold 4 fields and are kept 3 years from the training date, under 29 CFR 1910.1030(h)(2). Employees, their representatives, OSHA and NIOSH can ask to see them under (h)(3)(ii).

The trap is the second row. Vaccination status and incident follow-up are confidential medical records under 29 CFR 1910.1030(h)(1) and do not belong in your training tracker. Training records that other rules require are a separate check.

How do you track every employee's due date?

Keep one row per employee, with a due date 12 months after that person's last training; the free tracker below does the counting.

Download the bloodborne pathogens training tracker (Excel, free, no email required)

The Employees tab counts each due date with EDATE and flags it amber at 60 days or fewer (a default in the file, not the rule) and red once overdue. The Sessions tab holds the 4 fields 29 CFR 1910.1030(h)(2)(i) lists, and the file holds no vaccination or incident data.

The fictional example rows that ship in the file:

Can an online course meet the rule on its own?

On its own, no. CPL 02-02-069 says "a generic computer program, even an interactive one, is not considered appropriate unless the employer supplements such training with the site-specific information required (e.g., the location of the exposure control plan and the procedures to be followed if an exposure incident occurs) and a person is accessible for interaction".

For the generic content, yes: the epidemiology, the modes of transmission, how protective equipment works, the hepatitis B vaccine, and signs and labels are the same at every agency.

Your trainer can be remote. A telephone hotline to a qualified trainer meets the access requirement; email counts only when "the trainer is available to answer e-mailed questions at the time the questions arise".

How do you run bloodborne pathogens training in house?

A director of nursing, RN or administrator who owns the exposure control plan can meet the training duty in 29 CFR 1910.1030 with agency staff and free material: about 1 to 2 working days to set up, then the sessions and a few minutes a month on the tracker. CPL 02-02-069 says a generic computer program is "not considered appropriate" unless the employer adds the site-specific information and a person is accessible for interaction.

The free tools: the standard on osha.gov, OSHA's directive CPL 02-02-069, OSHA's letters on computer-based training and trainer access, and the tracker above.

1. Write the exposure determination. Under 29 CFR 1910.1030(c)(2), list the job classes and tasks with occupational exposure, without regard to personal protective equipment. Decide by tasks, not titles: a companion or homemaker belongs on it if their tasks carry exposure. A class missed here never reaches the tracker.
2. Review the exposure control plan. 29 CFR 1910.1030(c)(1)(iv) requires a review and update at least annually and whenever tasks, procedures or exposed positions change. Calendar it separately from training dates.
3. Build the session from the 14 elements in (g)(2)(vii). Use (A) to (N) as the checklist, and write 1 page for (D), (G), (J), (K) and (L), the parts only your agency can answer. Deliver it at no cost, during working hours, in a language and at a literacy level staff understand, (g)(2)(i) and (vi).
4. Name a knowledgeable trainer staff can reach. (g)(2)(viii) and (g)(2)(vii)(N) require one. A telephone hotline meets OSHA's access requirement, and email does only when the trainer answers at the time questions arise. Make sure the number is answered while staff train.
5. Set each employee's due date from their own last session. Enter every exposed employee in the tracker; the next session is due within 1 year of the last, under (g)(2)(iv). Train new hires at initial assignment and anyone whose tasks or procedures change, (g)(2)(ii)(A) and (g)(2)(v). An all-staff date must fall before the earliest due date, never after. If a due date passes during a leave, the text of the standard does not address it; check OSHA's interpretation letters before you rely on a grace period.
6. Record every session and keep it 3 years. Log the 4 fields in (h)(2)(i) and keep each record 3 years from the training date, (h)(2)(ii). Keep hepatitis B status and exposure follow-up out of it, (h)(1).

These times are working estimates, not OSHA figures. The sessions themselves come on top, on paid time.

Which bloodborne pathogens mistakes cost the most?

1. Counting by calendar year. A January 2026 session followed by a December 2027 one is 339 days late under (g)(2)(iv), though staff trained in both years.
2. Buying a course and stopping there. Without your site-specific page and a reachable trainer, the directive's "not considered appropriate" applies.
3. Putting medical data in the training tracker. Hepatitis B status and exposure follow-up are confidential medical records, kept for the duration of employment plus 30 years under (h)(1).

Need this training built for your team? We build the first lesson free from your own policies, with a quiz and a SCORM file for your LMS. Then you get a fixed price for the rest. Get your free first lesson.

Other questions about bloodborne pathogens training

Do companions and homemakers need bloodborne pathogens training?

Only if their duties carry occupational exposure, meaning reasonably anticipated contact with blood or other potentially infectious materials, under 29 CFR 1910.1030(b). The agency's exposure determination under (c)(2) must then list their job class or tasks.

Does an online bloodborne pathogens course count?

Not on its own. OSHA directive CPL 02-02-069 says a generic computer program is "not considered appropriate" unless the agency adds its site-specific information and a person is accessible for interaction.

Can you train everyone on the same date each year?

Yes, if nobody's last session is more than 1 year before that date, because 29 CFR 1910.1030(g)(2)(iv) counts from each employee's previous training.

Do per diem and part-time aides need bloodborne pathogens training?

Yes, if they have occupational exposure. CPL 02-02-069 says part-time, temporary and per diem employees are covered and are to be trained on company time.