Cal/OSHA's Aerosol Transmissible Diseases Standard: A Hospital Guide to Section 5199
Last reviewed Sep 3, 2026
There is no federal equivalent to 8 CCR §5199. If you run employee health in a California hospital, it is the standard that governs most of what you do, and two parts of it are missed more often than the rest combined.
The short answer
Section 5199 covers aerosol transmissible diseases: tuberculosis, measles, varicella, influenza and the rest. Much of it is what a good program already does. The gaps are usually the prescribed declination statements under (h)(5) and the 72-hour and 96-hour exposure clocks under (h)(6)(C), which are not the same as your post-exposure follow-up clock.
What you probably already do
If you run a competent occupational health program, §5199 will feel familiar:
- Annual tuberculosis assessment for covered employees.
- Respirator fit testing annually, and again on any change of make, model or size.
- Post-exposure medical evaluation and follow-up.
- Immunization records for the vaccines the standard covers.
None of that is unusual. Now the parts that are.
Tracking this in a spreadsheet?
carefoundryESC keeps employee health records, exposures and the OSHA 300 log in one place, and generates the forms from the records you already keep. Pricing is published; migration is included.
Declination statements are prescribed forms
Under §5199(h)(5), an employee who declines a vaccine the employer is required to offer must sign a declination statement, and the wording is prescribed: Appendix C1 for routine ATD vaccines, Appendix C2 for seasonal influenza.
The word "prescribed" is doing the work here. A locally written form that captures the same idea in different words is not the statement the regulation requires. If an inspector asks to see declinations, they are looking for the appendix text with a signature under it, and a paraphrase is a finding.
Two practical consequences. First, transcribe the appendix rather than rewriting it, and if your system stores the text, store it verbatim. Second, C1 has a blank for the specific vaccine, and it should never go out empty.
The two clocks that are not your post-exposure clock
This is the part that surprises people, because most programs already have a post-exposure follow-up schedule and reasonably assume it covers them.
It does not. Section 5199(h)(6)(C) adds two separate obligations after an exposure incident:
- Within 72 hours: complete an exposure analysis identifying who had a significant exposure. The analysis records who was included, who was excluded and why, and who made the determination.
- No later than 96 hours: notify the exposed employees.
Your post-exposure medical follow-up is a different thing on a different schedule. These two are about identifying and telling people, quickly, and they are frequently the finding when a case is reviewed.
When the clock starts
From when the employer became aware of the exposure, not from the shift on which it happened. This matters more than it sounds. A tuberculosis case is routinely identified days after the fact, once a culture comes back. Dating the clock from the shift would mean every such case is already overdue the moment you learn about it, which is neither what the regulation says nor a usable way to run a program.
Record retention under 5199
Section 5199(j)(1) routes medical records to §3204: duration of employment plus thirty years. Training records are three years, plan implementation records three years, and engineering control inspection records five years.
Thirty years past termination is a much longer horizon than most systems are designed around, and it is worth checking what any automated cleanup in your record system actually does before it does it.
One more line from the same paragraph that is useful in a security conversation: medical records may not be combined with non-medical personnel files. If your employee health data lives inside the HR system, that is a question you will be asked.
A short checklist
- Pull five declinations at random. Is the text the appendix text, word for word, with the vaccine named?
- Take your last aerosol exposure incident. Can you show the exposure analysis, dated inside 72 hours of when you knew, naming who was excluded and why?
- Can you show the employee notification inside 96 hours?
- Does anything in your systems delete employee medical records before employment plus thirty years?
- Are medical records physically and logically separate from personnel files?
carefoundryESC ships the C1 and C2 statements transcribed from the appendices rather than paraphrased, and runs both clocks from the date you became aware. It is part of the California layer, included in every plan.
Check the current text
Section 5199 and its appendices are on the Department of Industrial Relations site. Read them before relying on this summary, particularly the appendix wording, which is the whole point.