Source-Patient Testing After an Occupational Exposure: Consent, Timelines, and Documentation

A nurse gets stuck with a hollow-bore needle drawing blood at 2 a.m. The clock starts immediately, and the single most useful thing you can do in the next few hours is figure out whether the source patient carries a bloodborne pathogen. That answer shapes everything downstream — whether the exposed worker starts HIV prophylaxis, what follow-up schedule applies, and what you write in the record.

Source testing sounds simple until you hit the consent question at the bedside. Here's how the two rulebooks actually work together, and what a defensible workflow looks like.

Two rulebooks, kept separate

OSHA's Bloodborne Pathogens Standard, 29 CFR 1910.1030, is the enforceable workplace rule. It tells you that you must test the source and make results available. It does not tell you which assay to run.

CDC and US Public Health Service clinical guidance fill that gap — they specify which tests to run and how fast to act. For hepatitis C, the current reference is the 2020 CDC HCV guidance (MMWR RR-6906); for hepatitis B, CDC's occupational HBV exposure guidance; and for HIV, the CDC/USPHS occupational-exposure guidelines. Keep these mental buckets distinct: OSHA sets the compliance floor, and the clinical guidance sets the standard of care. When someone quotes you an hours figure, ask which bucket it came from — the two use different language.

Can you test the source patient without consent?

Under OSHA, consent is the default. The standard requires the source individual's blood be tested "as soon as feasible and after consent is obtained" [1910.1030(f)(3)(ii)(A)]. If the source refuses, you don't get to skip the step quietly — the employer must document that legally required consent could not be obtained.

The nuance that trips people up: where state or local law permits testing without consent, OSHA requires you to test available blood [1910.1030(f)(3)(ii)(A)]. Many states have statutes authorizing source testing after a documented health-care-worker exposure, but they vary widely in what they require and how they protect the source's identity. This is the single biggest reason not to write yourself a one-line policy. Pull your own state statute, get it reviewed by counsel, and bake the specific procedure into your exposure protocol. Do not assume a blanket national "yes."

One shortcut worth knowing: if the source is already documented HBV- or HIV-positive, retesting isn't required [1910.1030(f)(3)(ii)(B)]. Their known status is the answer.

What tests are run on the source

The three pathogens each call for a different assay:

• HIV — a 4th-generation combination p24 antigen/HIV-antibody (Ag/Ab) test. Use the rapid version where you have it: a fast source result is exactly what lets the evaluating clinician make the prophylaxis call while it still matters. OSHA can compel employers to use rapid methods for HBV and HIV source testing, per its March 2011 interpretation.
• HBV — HBsAg to determine the source's hepatitis B status, per CDC.
• HCV — the 2020 CDC guidance prefers a nucleic acid test (NAT) for HCV RNA, or anti-HCV with reflex to HCV RNA if positive. NAT is preferred when the source has recent HCV risk behaviors, such as injection drug use in the prior four months. Note that OSHA does not require a rapid HCV method — a lab that runs standard HCV testing isn't in violation, though OSHA recommends rapid screening when feasible.

How fast

OSHA's timing standard is "as soon as feasible" — deliberately less specific than the clinical guidance. That phrase is the regulatory requirement; the hour-count figures below come from clinical guidelines, not from OSHA, and the two should never be conflated in a policy document.

On the clinical side, CDC recommends drawing source HCV testing preferably within 48 hours. The tighter driver is HIV post-exposure prophylaxis (PEP): CDC/USPHS guidance calls for PEP to start as soon as possible, and within 72 hours of exposure, with efficacy dropping the longer you wait. This is where practitioners make the classic mistake — do not delay PEP waiting for source results. Start prophylaxis on the clinical picture, then stop it if the source's rapid HIV test comes back negative. The 72-hour figure is a clinical-guideline target, not an OSHA deadline; OSHA's own requirement is still "as soon as feasible."

For time-sensitive HIV cases, loop in occupational health or infectious disease, or call the national PEPline. HBV decisions run on a separate track: they hinge on the exposed worker's vaccination and anti-HBs status, not just the source's HBsAg result. That's outside source testing proper, but don't lose track of it while you're focused on the source draw.

Sharing results with the exposed worker

OSHA requires source results be made available to the exposed employee [1910.1030(f)(3)(ii)(C)] and provided to the healthcare professional evaluating them [1910.1030(f)(4)(ii)(D)]. You do not need a separate release form — OSHA's 2011 interpretation reads consent-to-test as implying consent to release those results.

What you do owe the exposed worker: information about applicable laws on disclosing the source's identity and infectious status. Identity confidentiality is governed by state law, not OSHA, and this is another place jurisdiction matters.

The documentation that proves you did it right

The clinical steps are only half the job. An OSHA inspector reads records, and this is where programs get dinged.

• No cost to the employee. All post-exposure evaluation and follow-up must be free to the worker [1910.1030(f)(1)(ii)].
• The exposed worker's baseline blood. Collect it as soon as feasible; test after consent. If the worker consents to the draw but declines HIV testing, preserve the sample at least 90 days [1910.1030(f)(3)(iii)].
• Records retention. Employee medical records under this standard are kept for the duration of employment plus 30 years [1910.1030(h)(1)(iv), via 1910.1020].
• The confidential written opinion from the evaluating healthcare professional back to the employer.
• The Sharps Injury Log [1910.1030(h)(5)], recording at minimum the device type/brand, the department or work area, and how the incident occurred — maintained per 29 CFR 1904.33 and kept confidential.

For the exposed worker's own HCV follow-up, CDC's 2020 guidance calls for a NAT for HCV RNA at 3–6 weeks post-exposure and, if negative, a final anti-HCV test at 4–6 months. The corresponding HIV follow-up schedule for the exposed worker comes from the current CDC/USPHS occupational-HIV guidelines — verify the version in force before you hard-code specific test intervals into your protocol, since those intervals have been revised over time.

Tracking all of this across a workforce — source consent status, serial follow-up dates, retention clocks, and the sharps log — is the sort of thing an occupational-health record system such as carefoundryESC is built to keep in one place instead of a spreadsheet and someone's memory.

FAQ

Can I test a source patient who refuses? Only where your state or local law permits testing without consent — and then OSHA requires you to test available blood. Otherwise, document that legally required consent could not be obtained. Check your state statute; there's no national rule.

Do I have to wait for source results before starting PEP? No. Per clinical guidance, start HIV PEP as soon as possible within 72 hours based on the clinical assessment, then discontinue if the source's rapid HIV test is negative.

Does the exposed worker need to sign a separate release to get the source's results? No. OSHA treats the source's consent to testing as implied consent to release those results to the evaluating professional and the exposed employee.

Source testing is where a good exposure program either holds up or falls apart. The consent question is the one that stalls people at the bedside, so settle your state's rule and your assay menu in advance and write both into the protocol. When an exposure lands after hours, a process that already lives in your exposure workflow — rather than a binder nobody has opened in a year — is what keeps the timelines and the sharps log audit-ready.