Managing a Bloodborne Pathogen Exposure Case From Report to Closure

A needlestick at 3 a.m. is not a single event you document and forget. Managing a bloodborne pathogen exposure case means opening a file that can stay active for four to six months and generate a paper trail you're legally required to keep for the rest of that employee's career plus 30 years. If you've ever tried to reconstruct where an exposure case stood after a colleague went on leave, you know the real work isn't the first report. It's tracking the open case to a defensible close.

The volume alone makes a repeatable process worth it. CDC/NIOSH estimates roughly 385,000 needlesticks and other sharps injuries a year among U.S. hospital-based staff — about 1,000 a day. Most of your cases will resolve uneventfully. The discipline is in running every one the same way.

Two regimes govern the case, and conflating them is where most exposure cases go wrong. OSHA's Bloodborne Pathogens Standard, 29 CFR 1910.1030, sets the employer's duties — evaluation, recordkeeping, the written opinion. CDC and U.S. Public Health Service guidance drives the clinical follow-up — what to test, when, and whether prophylaxis is warranted. OSHA tells you what you must do; CDC tells the evaluating clinician what good medicine looks like. Keep them in separate lanes.

1. Report and intake

The clock starts when the employee reports. Under 1910.1030(f), you must make a confidential medical evaluation and follow-up immediately available, at no cost to the employee, after a report of an exposure incident. "Immediately available" is not "within the week." Decide in advance where after-hours exposures go — for many facilities that's the emergency department — so no one loses hours working it out at 3 a.m.

At intake, capture the route of exposure precisely: percutaneous (a sharps injury), mucous membrane (a splash to eyes, nose, or mouth), or non-intact skin. Record the device, the task being performed, and how it happened. You'll reuse every one of these details in the sharps log, so collect them once, cleanly.

2. Two logs, not one

This is the step people miss. A contaminated sharps injury usually triggers two OSHA records.

The sharps injury log, required by 1910.1030(h)(5), applies to any employer already required to keep OSHA Part 1904 injury records. It must contain, at minimum, the type and brand of device involved, the department or work area where the incident occurred, and an explanation of how it happened — and it must be maintained to protect the injured employee's confidentiality. This log was added by OSHA's 2001 final rule implementing the Needlestick Safety and Prevention Act, and its purpose is prevention: it's where you spot that three sticks this quarter all involved the same winged steel needle on the same unit.

Separately, the injury itself is recordable on the OSHA 300 Log. Per OSHA, all work-related needlesticks and cuts from sharps contaminated with another person's blood or OPIM must be recorded on the 300 Log as an injury. A contaminated-sharps injury is also a "privacy concern case" under 1904.29(b)(7), so you enter it without the employee's name on the shared log.

The sharps log, the 300 Log entry, and the medical follow-up record together are what "an open case" actually consists of.

3. Source-individual and baseline testing

Where consent and state law allow, the source individual's blood is tested for HBV, HCV, and HIV as soon as feasible, and the exposed employee's baseline blood is collected and tested with counseling, per 1910.1030(f). Source testing is the step most likely to stall: consent requirements vary by state, and you cannot assume you may draw or test a patient's blood automatically. Know your state's rule before an exposure, not during one.

4. Clinical follow-up — the open-case clock

This is the clinician's call, but you're tracking the calendar. Follow-up differs by pathogen.

HIV. Per the 2025 U.S. Public Health Service guidelines, post-exposure prophylaxis (PEP) should start as soon as possible, up to 72 hours after exposure, for a 28-day course. Final testing uses a lab-based HIV antigen/antibody immunoassay plus a nucleic acid test (NAT) at week 12 — a shortened window compared with the 2013 guidelines. Note the two independent deadlines: 72 hours to start PEP, 12 weeks to close.

HCV. No PEP is recommended. Per CDC's 2020 guidance, do baseline anti-HCV with reflex to NAT for HCV RNA as soon as possible (ideally within 48 hours), a follow-up NAT at 3–6 weeks, and a final anti-HCV test at 4–6 months. HCV is why a case can stay open half a year.

HBV. Managed per the employee's vaccination and immune status; confirm the specifics against current CDC hepatitis B post-exposure guidance for each case.

Each of those windows — 3–6 weeks, 12 weeks, 4–6 months — is a scheduled appointment and a reminder. A missed serial draw is the most common way a case quietly falls out of compliance.

5. The written opinion

Within 15 days of completing the evaluation, you must obtain the evaluating healthcare professional's written opinion and give the employee a copy, under 1910.1030(f)(5). Treat this as a hard milestone, not paperwork you get to eventually. It's also a strong signal that the case is moving toward closure.

6. Closure — and what closure does not mean

A case is ready to close when the follow-up testing window is complete (the week-12 HIV test, the 4–6-month final anti-HCV), prophylaxis has been completed or declined, the written opinion has been delivered, and the records are filed for retention.

Closure does not mean the file goes away. The exposed employee's medical record must be kept for the duration of employment plus 30 years under 1910.1020, per 1910.1030(h)(1). The sharps injury log is kept for the 1904 retention period — five years past the calendar year it covers — under 1910.1030(h)(5)(i). The OSHA 300 Log records are held on the same five-year clock, and the 300 Log must be updated for any newly discovered or reclassified case, under 29 CFR 1904.33. Different clocks, same case.

Why the discipline pays off

The stakes aren't only clinical. OSHA's maximum civil penalties are adjusted for inflation each year and run well into five figures per violation — currently $16,550 per serious or other-than-serious violation, $165,514 per willful or repeated violation, and $16,550 per day for failure to abate past the abatement date. A dropped serial test or a missing sharps-log field is exactly the kind of gap an inspection surfaces.

Whether you run this on a spreadsheet and a calendar or in a system like carefoundryESC, the shape is the same: an exposure case behaves like a state machine — open → in follow-up → closed — with timed reminders for each testing window, a structured sharps injury log, and encrypted retention that survives the full 30-year horizon.

FAQ

What exactly is the sharps injury log? A confidential log required by 1910.1030(h)(5) for employers who keep OSHA 1904 records. Each entry records the type and brand of device, the department or work area, and how the injury occurred — so you can spot patterns and target safer devices.

Is a needlestick separate from the OSHA 300 Log? Yes. The sharps log and the 300 Log are distinct. A contaminated needlestick is recordable on the 300 Log as an injury and logged on the sharps injury log — two records from one event.

How do I track an open exposure case? Treat every testing window as a dated task with an owner: the 72-hour PEP decision, the 3–6-week and 12-week HIV/HCV draws, the 4–6-month final anti-HCV, and the 15-day written-opinion deadline. Post-exposure case tracking fails most often when a serial draw lives only in someone's inbox.

When can I close an exposure case? When the clinical follow-up window is complete (per 2025 PHS HIV and CDC 2020 HCV timelines), prophylaxis is finished or declined, and the written opinion is delivered. Then the records move into long-term retention — they don't get deleted.

If your exposure follow-ups live in someone's inbox and a shared spreadsheet, map your own case lifecycle against the six steps above and see where the reminders would have to live. That exercise alone tends to surface the gap before an inspector does.