Home › Guides

Bloodborne pathogens rules for healthcare staffing agencies

Short answer: OSHA treats a staffing agency and the facility where its nurses and aides work as joint employers, and both are responsible under the Bloodborne Pathogens standard (29 CFR 1910.1030). OSHA's guidance says the agency usually handles generic training, the hepatitis B vaccine, follow-up after an exposure and the medical and training records. The facility usually handles the exposure control plan, site-specific training, protective equipment, sharps safety and the injury logs. Put the split in your contract. Neither side can hand off its own legal duty.

Updated October 23, 2026 · Checked against the official sources listed at the end

Joint employers, shared duty

OSHA's Temporary Worker Initiative bulletin on bloodborne pathogens (OSHA 3888, 2016) says that when a staffing agency supplies temporary workers, the agency and its client, the host employer, are typically joint employers. Both are responsible for the conditions of employment and for following the law.

The bulletin lets the two employers divide the work. They should review the task assignments and job hazards together so temporary workers are included in an exposure control plan, and the details can be written into the contract. But OSHA is clear that neither employer may avoid its ultimate responsibilities by shifting them to the other.

The standard covers anyone with reasonably anticipated contact with blood or other potentially infectious materials on the job. For an agency that places nurses, CNAs, phlebotomists or other clinical staff, that is most of the roster.

Tracking agency worker files by hand? Pact checks every worker's credentials against each facility's list, reviews every upload for you, keeps hepatitis B and bloodborne pathogens records, and shares files with facilities without a login. $10 per active worker a month, $250 minimum, first month free. Credentialing for staffing agencies · Try the sample portal for 30 days · Get my price

What the staffing agency usually owns

OSHA's enforcement directive for the standard (CPL 02-02-069) says a personnel services firm whose staff work under a healthcare facility's day-to-day supervision should be cited only in six areas. OSHA's 2016 bulletin lists the same duties for the agency:

Hepatitis B vaccination.
Post-exposure evaluation and follow-up after an exposure incident.
Recordkeeping under paragraph (h) of the standard: each worker's medical records and training records.
Generic bloodborne pathogens training.
Violations at the facility that the agency actually knew about and didn't take reasonable steps to have the facility correct.
Pervasive serious violations at the facility that the agency could have found with reasonable diligence.

What the facility usually owns

The written exposure control plan for the worksite, because the facility controls the work and knows which tasks carry exposure.
Site-specific training, equal to what its own employees in the same job get.
Protective equipment, and engineering and work practice controls such as safer sharps.
The OSHA injury and illness log and the sharps injury log, including injuries to agency workers, since the facility supervises their day-to-day work.
Coordinating with the agency, especially after an exposure. The directive says the facility must follow the whole standard for agency workers it supervises day to day, and for vaccination, follow-up, records and generic training it must take reasonable measures to make sure the agency has done its part.

The hepatitis B vaccine: timing and declinations

The employer must make the hepatitis B vaccine available, at no cost to the worker, after the worker has had the required training and within 10 working days of initial assignment to work with occupational exposure (1910.1030(f)(2)(i)). It isn't required if the worker has already had the complete series, an antibody test shows immunity, or the vaccine is medically contraindicated. A prescreening test can't be made a condition of getting the vaccine.

A worker who declines must sign the declination statement in Appendix A of the standard. If that worker later changes their mind while still covered, the vaccine must be made available then.

For an agency, the 10-day clock matters because assignments start fast. Many agencies offer the vaccine, or collect proof of the series or a titer, when a worker joins, before the first shift. Keep the dates of each dose, any titer result, and the signed declination for anyone who said no.

Training: when, and what to record

Training must be given at no cost and during working hours, at the time of initial assignment to tasks with exposure, and at least once a year after that, within one year of the previous training (1910.1030(g)(2)). When the agency gives the generic part and the facility the site-specific part, each should keep its own record.

Training records must show the dates, the content or a summary of the session, the names and qualifications of the trainers, and the names and job titles of everyone who attended. Keep them for 3 years from the date of training (1910.1030(h)(2)).

Medical records: private, and kept for decades

For each worker with occupational exposure, the employer keeps a medical record with the worker's name, hepatitis B vaccination status with the dates of every dose and any records about the worker's ability to be vaccinated, the results of any post-exposure exams and follow-up, the healthcare professional's written opinion, and the information given to that professional (1910.1030(h)(1)).

These records must be kept confidential and not shared with anyone inside or outside the workplace without the worker's express written consent, except as the standard or other law requires. Keep them for at least the length of employment plus 30 years (1910.1020).

That has a practical side for agencies: a facility may ask to see a worker's hepatitis B record. Get the worker's written consent before you share it, and keep that consent with the file.

Put the split in the contract

OSHA recommends that the agency and the host spell out their respective duties in the contract before work begins. OSHA's example scenario has the agency supplying workers who have had the hepatitis B vaccine and basic training, and the facility supplying site-specific training, controls and protective equipment.

Who gives generic training and who gives site-specific training, and who keeps each record.
Who offers the hepatitis B vaccine, and what proof the facility wants before the first shift.
Who arranges the post-exposure evaluation after a needlestick, and how fast the facility tells the agency.
How the facility gets a copy of the worker's vaccination status, with the worker's written consent.
Who records the injury on which log.
States with their own OSHA-approved State Plan may have different or added rules, so check yours.

How Pact helps

Pact's default list for staffing agencies includes the hepatitis B record (proof of the series, a positive titer or the signed OSHA declination) and yearly bloodborne pathogens training. Workers upload from their phone with no app, Pact Compliance Review checks every upload, usually within minutes, 24/7, and reminders go out 30, 14 and 7 days before the training runs out. A facility sees a worker's status through a share link with no login, and medical records open only after the worker signs a release on their own phone. Your records export at any time.

Pact doesn't give vaccines, run exposure follow-up or write your exposure control plan. It's $10 per active worker a month, $250 minimum, and you can try a sample agency portal for 30 days.

Common questions

Who offers the hepatitis B vaccine to an agency nurse, the agency or the facility?

OSHA's guidance puts it on the staffing agency in most cases, but both employers are responsible, and they can agree on a different split in their contract. Whoever does it, the vaccine must be made available at no cost within 10 working days of initial assignment to work with exposure.

Does a nurse who already had the series need it again?

No. The vaccine isn't required for a worker who has had the complete hepatitis B series, whose antibody test shows immunity, or for whom it is medically contraindicated. Keep the proof in the worker's file.

How long do we keep hepatitis B records and declinations?

The worker's hepatitis B vaccination status is part of the OSHA medical record, which is kept for at least the length of employment plus 30 years (1910.1030(h)(1) and 1910.1020). Training records are kept 3 years from the date of training.

Does the facility's annual training count for our workers?

It can count for the site-specific part. OSHA's guidance expects the agency to give generic bloodborne pathogens training and the facility to give site-specific training. Agree in writing on who does which, and keep both records.

Can we send a worker's hepatitis B record to a facility?

Only with the worker's express written consent, unless the standard or another law requires it. OSHA medical records must be kept confidential.

Who handles a needlestick at the facility?

Both. OSHA's guidance has the facility record it on its sharps injury log and tell the agency, and the agency send the worker for post-exposure evaluation and follow-up. Your contract should say how fast the facility reports it.

Sources

Related guides

Run a healthcare staffing agency? Workers upload from their phone, Pact Compliance Review checks every upload, usually within minutes, 24/7, and the readiness board shows who is cleared for which facility. $10 per active worker a month, $250 minimum, first month free, month to month. Healthcare staffing credential tracking · What to look for in credentialing software · Try the sample portal for 30 days · Get my price · 901-666-6970