Sharps Injuries and Bloodborne Pathogens: The Two Separate Logs OSHA Requires

A small dental practice has a quiet morning. A hygienist gets stuck by a contaminated explorer while breaking down a tray. No medical treatment, no time off, the hygienist finishes the day. Does anything go on a log?

Yes — two entries on two different logs. The case is recordable on the OSHA 300 Log under 29 CFR 1904.8, and it also triggers a separate Sharps Injury Log entry under 29 CFR 1910.1030(h)(5). The two logs are governed by two different OSHA standards, contain different information, and serve different purposes. Many small employers — particularly small healthcare practices, dental offices, tattoo studios, and any workplace with designated first-aid responders — keep one and not the other, or neither.

The rules are not complicated, but they are unforgiving. A contaminated sharps injury is recordable regardless of whether treatment was provided. Employees' names cannot appear on the 300 Log. And in many state-plan states, the Sharps Injury Log obligation survives even when federal recordkeeping does not. This post walks through both logs, who they apply to, and the failures OSHA inspectors most commonly cite.

The OSHA 300 Log Entry Under 29 CFR 1904.8

The first log is the standard OSHA 300 Log every covered employer already maintains. The recording requirement for sharps injuries lives at 29 CFR 1904.8(a):

You must record all work-related needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material (as defined by 29 CFR 1910.1030). You must enter the case on the OSHA 300 Log as an injury. To protect the employee's privacy, you may not enter the employee's name on the OSHA 300 Log (see the requirements for privacy cases in paragraphs 1904.29(b)(6) through 1904.29(b)(9)).

Three things in that paragraph deserve attention before going further: the contamination requirement, the absence of any treatment threshold, and the privacy rule.

Contamination Is the Trigger — Not Treatment

Most sharps injury questions sound like first-aid-vs-medical-treatment questions, but they are not. For other injuries, recordability turns on whether the treatment provided exceeded OSHA's first aid list. For contaminated sharps under 1904.8, recordability turns on whether the sharp was contaminated with another person's blood or other potentially infectious material (OPIM). If it was, the case is recordable — full stop.

A hygienist stuck by a clean instrument that has never contacted a patient is not automatically recordable under 1904.8. That case is evaluated under the general criteria in 1904.7. But the moment the sharp was contaminated, treatment becomes irrelevant. A clean needlestick with no follow-up — no IV, no prescription, no time off — is still recordable if the needle had been used. The general guide on where the first-aid line falls covers the broader framework in first aid vs. medical treatment.

The Privacy Concern Case Rule

Sharps injuries with contamination are one of six explicit categories OSHA designates as privacy concern cases. Under 29 CFR 1904.29(b)(7), the complete list includes:

(i) An injury or illness to an intimate body part or the reproductive system; (ii) An injury or illness resulting from a sexual assault; (iii) Mental illnesses; (iv) HIV infection, hepatitis, or tuberculosis; (v) Needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material (see § 1904.8 for definitions); and (vi) Other illnesses, if the employee independently and voluntarily requests that his or her name not be entered on the log.

For privacy concern cases, 29 CFR 1904.29(b)(6) is unambiguous: "you must not enter the employee's name on the OSHA 300 Log. Instead, enter 'privacy case' in the space normally used for the employee's name." You then keep a separate, confidential list linking case numbers to employee names so the cases can still be reconciled internally.

OSHA also closes the door on creative interpretation. Per 29 CFR 1904.29(b)(8): "You must not enter the employee's name on the OSHA 300 Log for these cases. However, you must keep a separate, confidential list of the case numbers and employee names for your privacy concern cases so you can update the cases and provide the information to the government if asked to do so." The list of privacy concern categories is exclusive — employers cannot add their own.

Classification

A contaminated needlestick goes in column M-1 (Injury), not in the illness columns. The exposure event itself is the injury. If the employee later develops a confirmed bloodborne illness from the exposure — HIV, hepatitis B, hepatitis C — the case is updated and reclassified to illness under 1904.8(b)(3). This is a back-end correction; the initial entry is an injury.

For the column-by-column mechanics of the 300 Log, see how to fill out the OSHA 300 Log.

The Separate Sharps Injury Log Under 29 CFR 1910.1030(h)(5)

The second log is the part most employers miss. It is not part of the OSHA 300 forms family. It is required by the Bloodborne Pathogens Standard and exists separately from the 300 Log.

This log was created by the Needlestick Safety and Prevention Act of 2000 (Public Law 106-430), which amended the Bloodborne Pathogens Standard. The amendments took effect April 18, 2001 and added a new recordkeeping requirement at 29 CFR 1910.1030(h)(5):

The employer shall establish and maintain a sharps injury log for the recording of percutaneous injuries from contaminated sharps. The information in the sharps injury log shall be recorded and maintained in such manner as to protect the confidentiality of the injured employee. The sharps injury log shall contain, at a minimum: (A) The type and brand of device involved in the incident, (B) The department or work area where the exposure incident occurred, and (C) An explanation of how the incident occurred.

The scope clause at 1910.1030(h)(5)(ii) ties it to 1904: "The requirement to establish and maintain a sharps injury log shall apply to any employer who is required to maintain a log of occupational injuries and illnesses under 29 CFR part 1904." And retention at 1910.1030(h)(5)(iii) matches: "The sharps injury log shall be maintained for the period required by 29 CFR 1904.33" — five years following the end of the calendar year the records cover.

The Log's Purpose Is Different From the 300 Log's

The 300 Log is about counting injuries to people. The Sharps Injury Log is about tracking devices and procedures. OSHA addressed this directly in a December 3, 2002 Letter of Interpretation: "The sharps injury log is used to track devices that are causing injuries and may need to be replaced; it is not intended to track employees having injuries." The data on the log feeds the employer's evaluation of safer engineered devices required under 1910.1030(c)(1)(iv) and (d)(2). It is a tool for decisions about which sharps to buy, not a tool for tracking which employees got hurt.

That's why the log is de-identified. Many employers use case or report numbers rather than any employee identifier, and OSHA's sample sharps injury log follows the same approach.

Can the OSHA 300 and 301 Forms Serve Double Duty?

OSHA permits this with conditions. Per the Recordkeeping Policies and Procedures Manual (CPL 02-00-135) and the BBP compliance directive CPL 02-02-069, employers may use the OSHA 300 and 301 forms to satisfy the sharps log requirement if the employer enters the type and brand of the device causing the sharps injury on the Log, and maintains the records in a way that segregates sharps injuries from other types of work-related injuries and illnesses, or allows sharps injuries to be easily separated.

In practice, maintaining a dedicated Sharps Injury Log is cleaner. The 300 form was not designed to track device brand and model, and trying to wedge that data into the description column tends to produce records that fail both purposes. Most BBP-covered employers maintain the two logs separately.

How a Single Injury Hits Both Logs

Walking through the dental hygienist case from the lead:

On the OSHA 300 Log:

• Case number: 2026-007 (or whatever the practice's sequence is)
• Employee name: "Privacy case" (per 1904.29(b)(6))
• Job title: Dental Hygienist
• Date of injury: the date of the stick
• Where the event occurred: Operatory 2, instrument processing area
• Description: "Needlestick from contaminated dental explorer during sterilization preparation"
• Classification: "Other recordable case" (no days away, no restriction, no medical treatment beyond first aid)
• Column M-1 (Injury) marked

On the Sharps Injury Log:

• Date: the date of the stick
• Case/report number: 2026-007 (cross-referenced to the 300 Log)
• Type of device: Dental explorer
• Brand: [specific brand, e.g., Hu-Friedy #23]
• Department/work area: Operatory 2
• Explanation: "Hygienist stuck while sorting used instruments in pre-sterilization tray; instrument tip was not pointed away from handler"

The 300 Log entry triggers the privacy case rule and the case-number-to-name list. The Sharps Injury Log entry feeds the practice's annual review of safer engineered devices — was this brand of explorer the right choice, or should the practice evaluate alternatives with engineered safety features? Two different questions, two different logs.

Who Is Covered by the Bloodborne Pathogens Standard

The most-cited 1910.1030 enforcement issue is not the sharps log itself — it is employers who never realize the standard applies to them in the first place. The standard's scope is broader than "healthcare."

The trigger is occupational exposure, defined in 29 CFR 1910.1030(b) as "reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials that may result from the performance of an employee's duties."

Industries clearly within scope include:

• Hospitals, clinics, urgent care centers, and physician offices
• Dental and orthodontic practices
• Tattoo parlors and body-piercing establishments (per OSHA's July 29, 2002 Letter of Interpretation: "Since tattooing and piercing generate blood, workers in this industry would fall under the scope of the standard")
• First responders — EMS, fire, law enforcement
• Designated first-aid responders at any workplace, including manufacturing, warehousing, schools, and offices
• Funeral homes and mortuary services
• Research and clinical laboratories
• Custodial and housekeeping staff in healthcare settings
• Correctional officers
• Schools — particularly athletic trainers and special education staff

That fifth bullet is the one most general-industry employers underestimate. A 200-employee manufacturing plant with three trained first-aid responders is BBP-covered for those three employees. The practical effect is that the plant must have a written Exposure Control Plan covering them, offer hepatitis B vaccination, train them annually, and maintain a Sharps Injury Log if a recordable sharps event occurs.

What Counts as a "Sharp"

The definition of "contaminated sharps" in 29 CFR 1910.1030(b) is broader than people assume: "any contaminated object that can penetrate the skin including, but not limited to, needles, scalpels, broken glass, broken capillary tubes, and exposed ends of dental wires."

Three categories of devices show up most often in compliance work:

Conventional sharps — hypodermic needles, scalpels, lancets, suture needles, dental explorers and probes, capillary tubes. The traditional source of needlestick injuries.

Sharps with Engineered Sharps Injury Protections (SESIPs) — required by the 2000 amendments wherever feasible. Defined in 1910.1030(b) as "a nonneedle sharp or a needle device used for withdrawing body fluids, accessing a vein or artery, or administering medications or other fluids, with a built-in safety feature or mechanism that effectively reduces the risk of an exposure incident." Examples include retractable needles, shielded scalpels, and self-blunting blood collection sets. Most non-trivial sharps use cases in healthcare are required to use SESIPs unless documented infeasibility exists.

Needleless systems — also required where feasible under 1910.1030(d)(2). These eliminate the sharp entirely, as with needleless IV connectors and jet injectors.

The employer's annual Exposure Control Plan review must document consideration of SESIPs and needleless systems for each application where sharps are used. Failure to document that review is one of the most frequently cited BBP violations.

Post-Exposure Follow-Up Under 1910.1030(f)

Every recordable sharps event triggers post-exposure obligations that are separate from recordkeeping. They are intrinsically tied to the recordable event — and routinely show up in inspections that started over a single sharps injury.

The employer must offer, at no cost to the employee and within a reasonable timeframe:

• A confidential medical evaluation and follow-up
• Source individual identification and testing where feasible and permitted by law
• Baseline and follow-up bloodborne pathogen testing of the exposed employee
• Post-exposure prophylaxis when medically indicated and per current U.S. Public Health Service recommendations
• Counseling and evaluation of any reported illnesses related to the exposure

Hepatitis B vaccination is a separate obligation under 1910.1030(f)(2)(i). The vaccine must be offered to every employee with reasonably anticipated occupational exposure, within 10 working days of initial assignment to at-risk duties — not after a sharps event. If the employee has already declined vaccination at hire, the post-exposure event re-opens the offer.

These are not paperwork obligations. They are clinical actions that have to happen on a clock, and OSHA inspectors check for documentation that they did. Missing post-exposure follow-up records is one of the citation categories that turns a single needlestick into a multi-thousand-dollar inspection.

Exposure Control Plan and Training Records

Two other 1910.1030 obligations are worth covering briefly because they are the subject of the most-cited BBP violations.

The written Exposure Control Plan. Under 29 CFR 1910.1030(c)(1)(i), every BBP-covered employer must have a written Exposure Control Plan designed to eliminate or minimize employee exposure. Under 1910.1030(c)(1)(iv), the plan must be reviewed and updated at least annually and whenever new or modified tasks or procedures affect exposure. Under 1910.1030(c)(1)(v), the annual review must document consideration of safer medical devices and must solicit input from non-managerial employees responsible for direct patient care. The annual review is one of the top-cited BBP failures.

Training and training records. Annual BBP training is required for all covered employees under 1910.1030(g)(2). Training records must be retained for three years per 1910.1030(h)(2)(ii). Note the asymmetry: training records run three years, but the Sharps Injury Log runs five. Two different retention periods under the same standard.

Common Recordkeeping Failures Specific to Sharps

The patterns OSHA inspectors find most often:

Treating "no treatment" as "not recordable." A contaminated needlestick is recordable under 1904.8 even when the employee receives no medical treatment. This is the single most common sharps recordability error.

Maintaining only the 300 Log, not the Sharps Injury Log. Small dental practices, tattoo studios, and BBP-covered general-industry employers often have a clean 300 Log and no separate sharps log — because the sharps log is not part of the OSHA 300 forms package and tends to get forgotten.

Putting the employee's name on the 300 Log. Sharps injuries are an explicit privacy concern category. The name field must read "privacy case" with the actual name maintained on a separate confidential list.

Not realizing BBP applies. Tattoo and piercing operators, small dental practices, schools with designated first-aid responders, and small healthcare practices in exempt size brackets all tend to assume the BBP standard does not apply to them. Coverage is driven by exposure risk under 1910.1030(b), not by NAICS code or headcount.

Skipping the annual ECP review. The plan exists on paper but has not been reviewed, updated, or re-evaluated for safer device options in the past year. This is the most-cited BBP subsection year after year.

Skipping post-exposure follow-up when the employee declines. An employee's decision to decline post-exposure evaluation does not relieve the employer of the obligation to offer it and document the offer. The offer must be documented even when declined.

For the broader recordkeeping mistakes that lead to citations, see 5 OSHA recordkeeping mistakes that lead to citations.

State-Plan State Nuances

State-plan states routinely require sharps logs and Bloodborne Pathogens protections that go beyond federal requirements — and in some cases survive the size and industry exemptions that would otherwise apply under federal 1904.

California (Cal/OSHA, 8 CCR § 5193) maintains its own bloodborne pathogens standard that predates and exceeds federal 1910.1030 in several respects. California Labor Code § 144.7 separately mandates aggressive engineering-control review. Most notably, Cal/OSHA generally requires a sharps log for healthcare and other covered employers regardless of whether the employer would be federally exempt from 1904 recordkeeping.

Washington (DOSH) and Oregon OSHA maintain similar enhancements, including sharps log requirements that survive even when a small outpatient practice is federally exempt from 1904.

Under 29 CFR 1904.37(b)(2), state plans must be at least as effective as federal OSHA and may impose additional or more stringent requirements. A small dental practice or tattoo studio in a state-plan state should treat the federal rules as the floor — not the ceiling. The exemption analysis covered in recordkeeping exemptions for small employers explains the federal framework; the state-plan layer goes on top.

What Recent Enforcement Looks Like

OSHA publishes the most-cited subsections of the Bloodborne Pathogens Standard on its public enforcement page. The top citation categories — across recent enforcement data — are remarkably stable:

1. 1910.1030(c)(1)(i) — failure to establish a written Exposure Control Plan
2. 1910.1030(g)(2)(i) — failure to provide training at no cost during work hours
3. 1910.1030(f)(1)(i) — failure to make hepatitis B vaccination and post-exposure follow-up available
4. 1910.1030(c)(1)(iv) — failure to review and update the Exposure Control Plan annually
5. 1910.1030(f)(2)(i) — failure to make hepatitis B vaccination available within 10 working days of hire

Sharps-log-specific violations under 1910.1030(h)(5) are rarely standalone citations. They typically appear alongside one or more of the top five — once an inspection is open under another BBP subsection, the sharps log gets inspected too.

A 2024 enforcement case widely cited in dental-industry trade press involved a Connecticut dental practice that incurred more than $21,000 in penalties after an inspection triggered by a percutaneous injury. The cited violations followed the textbook stack: no annually updated Exposure Control Plan, no documented BBP training, no documented hepatitis B vaccination offer, and no post-exposure evaluation or source-patient testing for 27 days after the incident. Every cited subsection was a top-five most-cited BBP issue.

The 2026 penalty exposure carries the 2025 inflation-adjusted ceilings. Per the U.S. Department of Labor news release of January 14, 2025, "the maximum OSHA penalties for serious and other-than-serious violations will increase from $16,131 to $16,550 per violation. The maximum penalty for willful or repeated violations will increase from $161,323 to $165,514 per violation." Each cited BBP subsection in a stacked citation can hit the serious-violation ceiling.

For the broader picture of how OSHA chooses establishments for inspection, see how OSHA picks who to inspect.

Severe Injury Reporting and Sharps

A routine contaminated needlestick rarely triggers OSHA's severe injury reporting requirements under 29 CFR 1904.39, but the analysis is worth running for every event.

The 1904.39 reporting clock runs separately from the 300 Log. Any work-related fatality must be reported to OSHA within 8 hours. Any work-related in-patient hospitalization, amputation, or loss of an eye must be reported within 24 hours.

A standard needlestick that results in routine post-exposure evaluation, baseline blood draw, and outpatient follow-up does not meet the 24-hour reporting threshold. But if a sharps injury results in in-patient hospitalization — for severe reaction, complication, or treatment requiring admission — the 24-hour clock starts. This is rare but not impossible, particularly with deep punctures, large-bore needles, or cases involving severely immunocompromised employees.

For a fuller treatment of the recordability analysis, see is this injury OSHA recordable?.

A Final Pattern Worth Internalizing

Three scenarios capture most of the small-employer questions.

Small dental practice with 8 employees. Federally exempt from 1904 recordkeeping under the 10-or-fewer-employee size exemption. Still subject to the entire Bloodborne Pathogens Standard — ECP, HBV vaccination offer, training, post-exposure follow-up. Federal Sharps Injury Log requirement does not apply because the practice is exempt from 1904. But if the practice operates in California, Oregon, or Washington, the state plan typically requires the sharps log anyway.

Four-artist tattoo studio. Below the 10-employee threshold, federally exempt from 1904. BBP standard applies because tattooing involves reasonably anticipated exposure to blood. ECP required, HBV vaccination must be offered, annual training required. Sharps log obligation under 1910.1030(h)(5) is tied to 1904 coverage federally — so the federal sharps log requirement does not apply — but state-plan states often require it. Voluntary maintenance is recommended as best practice in any state.

80-employee plastics manufacturer with designated first-aid responders. Not exempt from 1904 (over 10 employees, not in an exempt industry). BBP standard applies to the three designated first-aid responders. The plant must have an ECP covering those three employees, offer them HBV vaccination, and train them annually. If one of them is stuck by a contaminated lancet while rendering aid to an injured employee, that event is recordable on the 300 Log as a privacy case AND on the plant's Sharps Injury Log under 1910.1030(h)(5).