Needlestick and Post-Exposure Protocol: A Step-by-Step Guide for Healthcare

A nurse comes to your office at 4:45 on a Friday. She just stuck herself recapping a needle after drawing blood from a patient down the hall. She's rattled, she's not sure whether the patient's still in the building, and the ER is her only after-hours option. What you do in the next hour matters more than almost anything else in your bloodborne-pathogen program, because a needlestick post-exposure protocol runs on a clock: the useful treatment window is measured in hours, not days.

This guide walks the workflow start to finish — the first five minutes, the evaluation, the decision about prophylaxis, and the paperwork that keeps you out of an OSHA citation. Everything below is anchored to primary sources. Treat it as a companion to your facility's own exposure control plan, not a replacement for it or for a clinician's judgment.

A note on currency: In September 2025 the U.S. Public Health Service published new guidelines for managing occupational HIV exposures and PEP, superseding the 2013 guidance. The HIV sections below reflect the 2025 changes. If your protocol still lists 4-to-6-month HIV follow-up testing or older three-drug regimens, it's out of date.

What are the immediate steps after a needlestick?

Speed is the theme that connects every step, and it starts with first aid the injured worker can do at the point of use.

For a needlestick or a cut, CDC advises washing the wound with soap and water. For a splash to the nose, mouth, or skin, flush with water. For the eyes, irrigate with clean water, saline, or sterile irrigants.

Here's the part that surprises people, so say it out loud in your training: do not squeeze the wound and do not pour on bleach, alcohol, or other antiseptics to "clean it out." CDC states there is no evidence that squeezing or applying caustic agents reduces transmission risk. Milking a finger and dousing it in bleach is folklore. It doesn't lower risk, and it can worsen tissue damage.

Then — immediately — report to a supervisor and get to the designated evaluator: your employee health office, occupational medicine, or the ER after hours. This is where the clock matters. If HIV prophylaxis turns out to be indicated, it should start as soon as possible and no later than 72 hours out. Every hour a worker spends "waiting until Monday" or "seeing how it feels" is an hour off that window. Build the reflex now, before the 4:45 injury: everyone knows who the evaluator is, and the source patient is identified before they leave the unit.

Not every contact is an exposure incident, but don't try to make that call at the bedside. OSHA defines an exposure incident as specific eye, mouth, mucous-membrane, non-intact skin, or parenteral contact with blood or other potentially infectious material during work duties. When in doubt, route it to the evaluator and let the clinician decide.

Who evaluates the exposure?

Not you, and not the injured worker. The evaluation is a licensed-clinician job, and OSHA is specific about how it has to be offered.

Under 29 CFR 1910.1030(f)(3), after an exposure incident the employer must make a confidential medical evaluation and follow-up immediately available to the exposed employee, conducted by or under the supervision of a licensed healthcare professional, and at no cost to the employee. "Immediately available" is why after-hours coverage can't be an afterthought — a 72-hour drug can't wait for the clinic to open.

The evaluation has to follow the U.S. Public Health Service recommendations current at the time it takes place. That single clause is what quietly obligates you to keep pace with the 2025 PHS update — "we've always done it this way" isn't a defense when the standard points at whatever guidance is current today.

The clinician also arranges source-patient testing. OSHA requires that the source individual's blood be tested as soon as feasible, after consent, to determine HBV and HIV status. This is a real edge case worth planning for: if the source patient refuses or has already been discharged, you manage the exposure based on the clinical risk assessment rather than confirmed source status — document the attempt and move forward.

When the evaluation is complete, the evaluating professional issues a written opinion, and the employer must provide the employee a copy within 15 days. That written opinion is limited by design — it says whether HBV vaccination was recommended and that the employee was informed of results, not the full clinical detail.

When is post-exposure prophylaxis needed?

The three pathogens each call for a different response. The evaluating clinician runs the risk assessment for all three; your job is to make sure the workflow gets the worker in front of that clinician fast enough for it to matter.

HIV

Risk depends on the source patient's status and the severity of the exposure — a deep hollow-bore stick from a viremic source is a different conversation than a superficial scratch. When PEP is indicated, the 2025 PHS guidelines say to start as soon as possible, up to 72 hours after exposure, for a 28-day course.

Preferred regimens are now single-tablet-friendly: bictegravir/emtricitabine/tenofovir alafenamide, or dolutegravir plus two NRTIs (tenofovir alafenamide or tenofovir disoproxil fumarate, with emtricitabine or lamivudine).

Two 2025 changes are worth flagging to your medical director. First, shared clinical decision-making is now recommended when the source patient has a documented undetectable viral load — the clinician and worker can weigh foregoing or discontinuing PEP rather than defaulting to a full 28 days. Second, follow-up HIV testing now concludes at 12 weeks using a lab-based Ag/Ab immunoassay plus NAT, shortened from the older 4-to-6-month schedule.

Hepatitis B

For HBV, the decision hinges on the exposed worker's vaccination and anti-HBs status against the source's HBsAg status; management may involve HBV vaccine, HBIG, or both. The best move here happens long before any injury: OSHA requires employers to offer the hepatitis B vaccine series free of charge, within 10 working days of assignment, to staff with occupational exposure. Most of your clinical workforce should already be protected and carry a documented anti-HBs response on file from post-vaccination serologic testing — so at the moment of exposure you already know who's a documented responder and who needs post-exposure treatment. Confirm the exact post-vaccination testing interval and the post-exposure decision framework against current CDC hepatitis B guidance with your evaluating clinician.

Hepatitis C

There is no vaccine and no post-exposure prophylaxis for hepatitis C. Management centers on baseline testing and scheduled follow-up testing so that infection is identified early and referred for treatment. The program takeaway: "there's no PEP" is not the same as "there's nothing to do" — the follow-up testing schedule is the intervention, and it has to be tracked to completion. Confirm the specific testing intervals and the treatment pathway against current CDC hepatitis C occupational-exposure guidance with your evaluating clinician.

How is the incident documented?

This is where good programs get cited anyway — the care was fine, the paperwork was thin. There are effectively three records, and they're not interchangeable.

The confidential medical record. Document the route(s) of exposure, the circumstances, the source's identity and results, and the worker's results and counseling. Under the standard, this record is retained for the duration of employment plus 30 years, per 29 CFR 1910.1020. Thirty years past termination — plan your retention accordingly.

The sharps injury log. Separate from the medical record, 1910.1030(h)(5) requires logging, at minimum, the type and brand of device, the department or work area, and an explanation of how the incident occurred. This is your engineering-control feedback loop: if butterfly needles in the ED keep showing up, the log is what tells you.

The OSHA 300 Log. A contaminated needlestick is a recordable injury under 29 CFR 1904.8. Enter it as a privacy case — omit the employee's name. If the worker is later diagnosed with a bloodborne disease, you reclassify the entry from injury to illness.

Keeping three linked records straight by hand, across shifts and years, is exactly the kind of task that slips. Occupational-health platforms like carefoundryESC exist to keep the medical record, the sharps log, and the OSHA 300 entry tied to one incident so a follow-up test due at 12 weeks doesn't fall off a spreadsheet — but the discipline matters far more than the tool.

Why the workflow is worth writing down

The penalty math is a decent motivator for leadership. For 2026, OSHA's maximums are $16,550 per serious violation and $165,514 per willful or repeat violation, unchanged from 2025 and effective May 21, 2026. A missing sharps log or an inaccessible after-hours evaluation is a serious violation waiting to be found. The better reason is the nurse from the opening: a written, drilled protocol is what gets prophylaxis into her hands inside 72 hours instead of on Monday.

FAQ

How long do I have to start HIV PEP? As soon as possible, and no later than 72 hours after the exposure. Sooner is better — treat it as an urgent, not routine, evaluation.

Should the worker squeeze the wound to "bleed it out"? No. CDC found no evidence that squeezing or applying antiseptics reduces transmission risk. Wash with soap and water and get to the evaluator.

Do I put the injured employee's name on the OSHA 300 Log? No. Needlestick injuries are recorded as privacy cases without the employee's name, and are reclassified from injury to illness if a bloodborne disease is later diagnosed.

When does the employee get the clinician's written opinion? The employer must provide a copy within 15 days of the evaluation's completion.

---

This guide is informational and not a substitute for your facility's exposure control plan or a treating clinician's judgment. Review your protocol against the current 2025 PHS guidelines and your state requirements, and have it validated by your medical director.

If your current process for tracking exposures, follow-up testing windows, and the sharps log lives in a binder or a shared spreadsheet, it's worth a look at how an occupational-health record system keeps those pieces connected — so nothing due at 12 weeks quietly slips.