Bloodborne Pathogen Standard: Hepatitis B Records

If you can’t show the record, OSHA may treat it as if it never happened. For Hepatitis B under the Bloodborne Pathogens Standard, I’d boil the whole article down to five points: who had exposure risk, when the vaccine was offered, whether it was offered at no cost, what the employee decided, and what follow-up was kept on file.

Here’s the short version in plain English: if someone in your clinic works with blood, sharps, first aid, contaminated waste, or room cleanup tied to blood exposure, I’d expect them to be on your record list based on their job duties, not just their title. The vaccine must be offered within 10 working days of the first exposure-risk assignment, after training, and the file should include acceptance, OSHA’s required declination wording if they refuse, any proof of past vaccination or immunity, post-exposure records, and the right retention periods. This matters in aesthetics and wellness settings too, where blood exposure can happen during injectables, PRP, microneedling, IV therapy, and minor procedures. Routine HepB vaccination helped drive a 98% drop in HBV infections among healthcare personnel from 1983 to 2010.

If I were checking a clinic’s files, I’d want to see:

• Exposure list: who is covered under the Exposure Control Plan
• Training link: bloodborne pathogens training completed before the vaccine offer
• Vaccine record: offer date, no-cost note, dose dates, and who gave each dose
• Declination record: signed OSHA Appendix A language, if the employee said no
• Exception record: prior vaccine records, lab proof of immunity, or clinician note
• Post-vaccine testing: anti-HBs result 1–2 months after series completion when tracked
• Incident file link: exposure route, what happened, testing, follow-up, and clinician opinion
• Retention: medical files for employment length + 30 years, training for 3 years, sharps log for 5 years

A small but important point: these records should stay in a confidential medical file, separate from routine HR files, and be easy to retrieve if an employee asks for them in writing.

Which Employees Need Hepatitis B Vaccination and Medical Records

OSHA defines occupational exposure as reasonably anticipated contact with blood or other potentially infectious materials through the skin, eyes, mucous membranes, or by needlestick or other puncture during job duties. The key point is simple: decide coverage based on what people do, not the job title on their badge. Your exposure control plan should take that exposure list and turn it into the clinic’s medical record roster.

Roles and Tasks That Count as Occupational Exposure

Coverage follows the work, not the title. In aesthetics and wellness clinics, covered roles often include physicians, nurse practitioners, nurse injectors, registered nurses, medical assistants who draw blood or help with procedures, laser and aesthetic staff, instrument reprocessing staff, and IV therapy technicians.

Personal protective equipment doesn’t change that. If a task still carries exposure risk, wearing gloves or eye protection does not remove that employee from the program.

This also applies to some non-clinical staff. They may need coverage if they:

• Clean treatment rooms
• Handle blood-contaminated waste
• Manage sharps containers
• Provide first aid

Those duties can create occupational exposure too.

Once you identify the covered roles, record them in the Exposure Control Plan.

How the Exposure Control Plan Supports the Record List

The Exposure Control Plan should list job classifications where all employees have exposure, along with roles where only some employees have exposure. It should also spell out the tasks that create that risk.

That list determines who must receive:

• The Hepatitis B vaccine offer
• Bloodborne pathogen training
• A confidential medical file

When duties shift or the clinic adds new services, update the ECP. That roster then becomes the working list for vaccine offers, consent records, and declination forms.

sbb-itb-02f5876

What to Record When Offering the Hepatitis B Vaccine

Once your Exposure Control Plan identifies employees with occupational exposure, the next step is simple: document the Hepatitis B vaccine offer clearly and completely.

Timing, No-Cost Offer, and Documented Exceptions

OSHA requires the Hepatitis B vaccine to be offered within 10 working days of the employee's first exposure-risk assignment, after bloodborne pathogen training. That initial assignment is the first day the employee starts duties with exposure risk, not the hire date.

The offer must be made at no cost to the employee. That includes the vaccine itself, administration, any required evaluation, and transportation. If you use an occupational health vendor, note the referral and show that the employer paid the cost.

You also shouldn't start a new vaccine series if the employee already has documented series completion, lab-confirmed immunity, or a documented medical contraindication. In those cases, record the reason in the medical file and keep the supporting paperwork, such as:

• Prior immunization records
• Lab evidence of immunity
• A clinician note showing a contraindication

Consent, Declination, and the Records to Keep

If an employee accepts the vaccine, the file should show the offer date, each dose date, the product used, who administered it, and any follow-up needed to finish the series. That record shows the clinic made the offer and tracked the employee's decision. Keep consent and declination records separate.

If an employee declines, OSHA requires a signed declination statement using the Appendix A language from 29 CFR 1910.1030. Use it verbatim. Keep that signed declination in the medical record even if the employee later decides to get vaccinated. If that happens, keep the original declination and then add the later offer and dose dates.

The file should also show that the employee was told:

• The vaccine was available at no cost
• They could ask for it later
• Declining it carried risk

Record Type	What to Include
Vaccine offer	Date of offer, employee name, job role, no-cost confirmation
Accepted vaccination	Each dose date, product, administrator, series completion status
Consent form (if used)	Date, series authorized, employee signature
Declination	OSHA Appendix A wording, signed and dated
Exception documentation	Prior records, lab evidence of immunity, or contraindication note

Keep these vaccine records aligned with training logs and any exposure file.

Post-Vaccination Testing to Add to the File

This part goes beyond showing that the vaccine was offered. It shows immunity status.

Record immunity status in the file, not just vaccination dates. Beyond OSHA's minimum rules, CDC guidance recommends documenting the full vaccine series dates and post-vaccination antibody testing results for employees with ongoing exposure risk. Document anti-HBs testing 1–2 months after the series. A result of ≥10 mIU/mL confirms immunity.

If an employee tests below that level, meaning anti-HBs <10 mIU/mL, CDC guidance calls for a second vaccine series followed by repeat testing. Document that follow-up testing 1–2 months after the series as well. If the file shows a nonresponder result, keep that result and the revaccination record together.

How Hepatitis B Records Connect to Training and Exposure Incidents

Link vaccine, training, and exposure-incident records by employee ID or HR number so each file shows exposure risk, training, vaccination status, and follow-up. Use that same identifier in any exposure-incident file too. It keeps the paper trail clear and makes it much easier to see what happened, when it happened, and what came next.

Training Records That Support Hepatitis B Compliance

OSHA says bloodborne pathogens training records must include four items: the date of training, a summary of the content, the trainer's name and qualifications, and the names and job titles of all attendees. Including attendee names and job titles helps show that covered staff completed the training.

The summary should note vaccine availability, no-cost access, and the right to decline. That ties the training record to the vaccine offer and shows employees were told about their options before they accepted or declined. Training records must be kept for at least three years.

Exposure Incident Records and Post-Exposure Medical Follow-Up

If an exposure happens, the record set moves from general training proof to incident-specific documentation.

After a needlestick, sharps injury, or splash exposure during injections, microneedling, or blood draws, OSHA requires documentation of the route of exposure and the circumstances surrounding it. In plain terms, that means recording the procedure being performed via digital intake, the device involved, the engineering controls and PPE in use at the time, and the location.

It also helps to connect the event back to the employee's most recent bloodborne pathogens training date and whether clinic procedures were followed. Document source-individual testing for HBV, HCV, and HIV when permitted.

The exposure record should sit with the employee's vaccination and immunity history because those details guide post-exposure decisions. The results of the exposed employee's baseline and follow-up testing, any prophylaxis provided, and the written opinion from the evaluating clinician all belong in the same confidential medical record that holds the employee's Hepatitis B vaccination history and anti-HBs serology.

OSHA's hospital eTool specifically recommends that when an exposure incident occurs, the employer "should add reports to the medical record to document the incident, including testing results following the incident, follow‑up procedures, and the written opinion of the health care professional."

Keep the sharps injury log separate from the confidential medical record.

These records should remain together in a confidential file with controlled access.

Retention, Confidential Storage, and Digital Record Management

OSHA Hepatitis B Record-Keeping Requirements for Clinics

How Long to Keep Medical, Training, and Incident Records

Once vaccine, training, and incident files are complete, the next step is simple: keep each record for the right length of time. OSHA sets different retention periods by record type.

Record Type	Retention Period	Key Rule
Medical records (vaccination, post-exposure, written opinions)	Duration of employment plus 30 years	OSHA medical records rule
Training records	3 years	OSHA training-record rule
Sharps log	5 years from the date of each incident	OSHA sharps injury log guidance

Use MM/DD/YYYY on every record. That small detail helps cut confusion when someone reviews files years later, and it also supports audit readiness.

A retention policy on paper isn't enough. Files also need to live in a system where they're kept separate and can be pulled up without a scavenger hunt.

Confidential File Setup and Access Controls

Hepatitis B vaccination status, post-exposure test results, and the healthcare professional's written opinion are confidential medical records under OSHA. They should be stored apart from routine personnel files.

A clean setup helps here:

• Keep occupational health, training, and HR files separate
• Assign one owner for retention, retrieval, and access requests
• Provide exposure and medical records within 15 working days of a written employee request

If an outside occupational health provider stores records off-site, the employer still needs to know exactly where those records are kept and how to retrieve them for OSHA review.

For digital records, OSHA points to encrypted transfer methods and storage on secured, password-protected systems instead of email attachments. Role-based access and audit logs can help limit who can view or change a file.

Using Prospyr to Organize Vaccine, Training, and Incident Records

For clinics using Prospyr, this setup can be handled in one place. Prospyr can organize vaccine forms, training logs, follow-up tasks, and incident records in one HIPAA-compliant system.

Conclusion: The Minimum Record System Every Clinic Should Maintain

Once retention and access rules are in place, the next job is simple: do it the same way every time.

A compliant Hepatitis B record system doesn't need to be complicated. It needs to be consistent. For every covered employee, the clinic should keep a file showing that the person was identified as having exposure risk, offered the vaccine at no cost, and either accepted it or signed a declination. That file should also link to training completion and any exposure incidents. And it must stay confidential for the duration of employment plus 30 years.

Most breakdowns don't happen because a clinic lacks a policy. They happen because ownership is split. One system tracks vaccine offers, another tracks declinations, and something else holds follow-up notes. That's where cracks start to show. A single onboarding checklist can fix a lot of that by recording the offer, the outcome, and the training date in one place.

Keep the setup lean:

• Store medical records separately.
• Keep training records for 3 years.
• Keep sharps logs for 5 years.
• Assign one owner for onboarding and one owner for post-exposure follow-up.

At the end of the day, the records should answer five basic points: exposure, vaccine offer, employee decision, training, and follow-up. If the clinic can prove those five items, it has the minimum OSHA record system.

FAQs

Who must be offered the Hepatitis B vaccine?

Under the OSHA Bloodborne Pathogens Standard, employers must offer the Hepatitis B vaccine at no cost to any employee with possible job-related exposure to blood or other potentially infectious materials.

That covers team members whose work includes exposure-risk tasks like injections, microneedling, IV therapy, or PRP treatments. Employers must make that offer within 10 working days of the employee’s first assignment to that role.

What records do I need if an employee declines the vaccine?

If an employee declines the Hepatitis B vaccine, they need to sign the OSHA-required declination form. Keep that form on file for the length of their employment plus 30 years.

Because it’s a confidential medical record, store it separately from general personnel files. Access should be limited to authorized safety or human resources staff.

How should Hepatitis B, training, and exposure records be kept?

Store bloodborne pathogen training, medical, and exposure records in a secure and confidential way, while still making them easy to pull for an audit. That means keeping medical and exposure records separate from general personnel files, whether you use electronic storage or locked paper files.

Here’s the key split:

• Medical and exposure records: Keep these apart from standard HR or personnel records.
• Storage format: Electronic files should be protected. Paper files should be kept in locked physical storage.
• Audit access: Records should be organized so you can produce them when needed.

OSHA record retention rules are strict here. Keep medical and exposure records, including Hepatitis B vaccination records and declination records, for the length of employment plus 30 years. Keep training records for three years.

Related Blog Posts

• 5 Steps to Document Employee Safety Training
• FAQs on OSHA Compliance for Med Spas
• OSHA Compliance Checklist for Med Spas
• Pathogen Safety Protocols for Med Spa Staff

{"@context":"https://schema.org","@type":"FAQPage","mainEntity":\[{"@type":"Question","name":"Who must be offered the Hepatitis B vaccine?","acceptedAnswer":{"@type":"Answer","text":"Under the OSHA Bloodborne Pathogens Standard, employers must offer the Hepatitis B vaccine at no cost to any employee with possible job-related exposure to blood or other potentially infectious materials. That covers team members whose work includes exposure-risk tasks like injections, microneedling, IV therapy, or PRP treatments. Employers must make that offer within 10 working days of the employee’s first assignment to that role."}},{"@type":"Question","name":"What records do I need if an employee declines the vaccine?","acceptedAnswer":{"@type":"Answer","text":"If an employee declines the Hepatitis B vaccine, they need to sign the OSHA-required declination form. Keep that form on file for the length of their employment plus 30 years. Because it’s a confidential medical record, store it separately from general personnel files. Access should be limited to authorized safety or human resources staff."}},{"@type":"Question","name":"How should Hepatitis B, training, and exposure records be kept?","acceptedAnswer":{"@type":"Answer","text":"Store bloodborne pathogen training, medical, and exposure records in a secure and confidential way, while still making them easy to pull for an audit. That means keeping medical and exposure records separate from general personnel files, whether you use electronic storage or locked paper files. Here’s the key split: Medical and exposure records: Keep these apart from standard HR or personnel records. Storage format: Electronic files should be protected. Paper files should be kept in locked physical storage. Audit access: Records should be organized so you can produce them when needed. OSHA record retention rules are strict here. Keep medical and exposure records, including Hepatitis B vaccination records and declination records, for the length of employment plus 30 years. Keep training records for three years."}}]}