CDC Post-Exposure Follow-Up Windows: The Current Testing Schedule for HIV, HBV, and HCV

If you learned a single "baseline, 6-week, 3-month, 6-month" cadence early in your career, hold onto it as history — not as your current protocol. The post-exposure follow-up testing schedule is no longer one string of draws that covers all three bloodborne pathogens. That uniform sequence tracked the old (2013) HIV schedule, and it never really described how hepatitis B and C are managed anyway. Today HIV, HBV, and HCV run on three different clocks, and a clinic that still books everyone into the same series is either over-testing or missing the windows that actually matter.

Here is what current CDC and U.S. Public Health Service (USPHS) guidance calls for, pathogen by pathogen, plus how to keep three divergent timelines straight when exposures start stacking up.

Why the follow-up exists at all

Post-exposure follow-up isn't a courtesy — it's a federal requirement. Under OSHA's Bloodborne Pathogens Standard, after any exposure incident the employer must make available a confidential medical evaluation that includes documenting the route and circumstances, testing the source individual's blood after consent, testing the exposed employee's blood after consent, and providing post-exposure prophylaxis "when medically indicated, as recommended by the U.S. Public Health Service" 29 CFR 1910.1030(f)(3). None of that is optional, and none of it is billable to the employee.

The clinical reason for serial testing is the seroconversion window: a negative test on the day of the needlestick doesn't rule out an infection that hasn't declared itself yet. So we draw a baseline, then test again at the intervals where a new infection would show up.

The universal first step: baseline testing, ASAP

Whatever the exposure, draw a baseline as early as you can — ideally before the source results are even back. For HCV, CDC is specific: test the exposed worker for anti-HCV with reflex to a nucleic acid test (NAT) for HCV RNA if positive, "as soon as possible, preferably within 48 hours" CDC MMWR 2020;69(RR-6). For HIV and HBV the language is "as soon as possible" rather than a hard 48-hour figure — don't generalize the 48-hour number to all three. Baseline establishes the worker's status at the time of exposure, which you'll need if anything converts later (and which OSHA will expect in the record).

HIV: the 2025 schedule change you can't miss

The biggest shift is here. In September 2025 the USPHS published updated occupational-HIV guidelines that shortened the follow-up schedule and eliminated the old six-month (and interim four-month) endpoints Kofman AD et al., Infection Control & Hospital Epidemiology 2025;46(9):863-873.

The current schedule:

• Baseline: rapid or lab-based fourth-generation HIV Ag/Ab combination immunoassay, as soon as possible.
• Final test: lab-based HIV Ag/Ab immunoassay plus a NAT at week 12 post-exposure.

For an adherent worker with an uncomplicated exposure, that's it — one final endpoint at 12 weeks. Interim testing (Ag/Ab plus NAT) at weeks 4–6 is now reserved only for workers who started PEP more than 24 hours after a single exposure or who missed doses. If you're still routinely calling people back at 6 weeks, 3 months, and 6 months for HIV, you're running an obsolete protocol.

HCV: driven by the source

Hepatitis C follow-up hinges on what the source patient is. After the baseline anti-HCV with reflex NAT:

• If the source is HCV RNA positive, or the source couldn't be tested / is unknown, test the worker with a NAT for HCV RNA at 3–6 weeks. If that's negative, do a final anti-HCV at 4–6 months CDC MMWR 2020;69(RR-6).
• If the source is anti-HCV positive but HCV RNA negative, follow-up of the exposed worker is not recommended (absent concerns about specimen integrity).

That last point saves a lot of unnecessary draws — a source who cleared or was successfully treated poses no transmission risk. It also means you can't finalize the HCV plan until source results are back, so build the source workup into your day-one steps.

HBV: driven by vaccine response, with an HBIG trap

Hepatitis B doesn't follow a serial-viral-load model at all. Give post-exposure prophylaxis — HBIG and/or hepatitis B vaccine — as soon as possible; the effectiveness of HBIG given more than 7 days after exposure is unknown, so treat 7 days as the practical outer limit CDC/ACIP MMWR 2018;67(RR-1).

Follow-up is about confirming immunity, not catching seroconversion. Check anti-HBs 1–2 months after the final vaccine dose; a concentration of ≥10 mIU/mL is protective. The trap: do not test anti-HBs for 4–6 months after HBIG, because passively acquired antibody from the immune globulin will produce a misleadingly "protective" result CDC/ACIP MMWR 2018;67(RR-1). Draw too early after HBIG and you'll read someone else's antibodies.

Prevention beats all of this: OSHA requires the hepatitis B vaccine be offered within 10 working days of initial assignment, at no cost, to everyone with occupational exposure 29 CFR 1910.1030(f)(2)(i).

Three clocks at a glance

HBV timing caveat (not a trigger): HBV follow-up isn't gated on source status the way HCV is — it confirms vaccine response. But never draw anti-HBs within 4–6 months of HBIG; passive antibody will confound the result. Key the titer to the final vaccine dose, not the exposure date.

Tracking so nothing slips

Three pathogens, source-dependent branching, and one window (HBV) that's blocked for months after HBIG — this is exactly where a manual calendar fails. A single needlestick can generate an HIV week-12 draw, an HCV 3–6 week NAT plus a 4–6 month anti-HCV, and an HBV titer keyed to a vaccine dose date. Miss one and you have both a clinical gap and a compliance gap.

Schedule each window per pathogen and per exposure the day you open the case, with automated reminders tied to the actual event date (exposure date for HIV/HCV, final-dose date for HBV). And keep it durable: OSHA requires employee medical records be retained for the duration of employment plus 30 years 29 CFR 1910.1030(h)(1)(iv). A sticky note won't survive that. This is one of the workflows we built structured exposure follow-up tracking into carefoundryESC to handle, but the principle holds in any system: per-pathogen scheduling, automated reminders, and an auditable trail.

FAQ

Is the old 6-month HIV test still required? No. For HIV, the 2025 USPHS guidance eliminated the 6-month (and 4-month) endpoints; the final test is at week 12, with interim testing at weeks 4–6 only for late-PEP or missed-dose cases ICHE 2025;46(9):863-873.

When can I check hepatitis B immunity after giving HBIG? Not for 4–6 months. Passive antibody from HBIG confounds the result. Check anti-HBs 1–2 months after the final vaccine dose instead CDC/ACIP MMWR 2018;67(RR-1).

Do I always need HCV follow-up? No. If the source is anti-HCV positive but HCV RNA negative, follow-up of the exposed worker isn't recommended CDC MMWR 2020;69(RR-6).

Guidance in this area moves — the HIV schedule changed as recently as September 2025. Use this as a working reference, but confirm each case against the most current CDC/USPHS guidance and your occupational-health provider before you finalize a follow-up plan.