How Long to Keep OSHA Bloodborne Pathogen Training Records

Employers covered by OSHA’s Bloodborne Pathogens Standard must keep employee training records for at least three years from the date the training took place. That rule applies to training required under 29 CFR 1910.1030. Knowing what the records must contain, who may access them, and how they differ from medical or exposure records can help employers maintain compliant files and respond to employee or agency requests.

Meta description: Learn how long OSHA requires employers to keep bloodborne pathogen training records, what information to document, who can access them, and how training files differ from exposure and medical records.

OSHA Bloodborne Pathogen Training Records Must Be Kept for Three Years

OSHA’s Bloodborne Pathogens Standard requires employers to retain records of required employee training for three years from the date the training occurred. The requirement appears in 29 CFR 1910.1030(h)(2)(i). The three-year period applies to each training event, so the retention clock starts on the date of that specific session—not when an employee was hired or when the employer created the file.

For example, if an employee completes bloodborne pathogen training on March 15, 2026, the employer must retain that training record for at least three years from that date. Employers may choose to keep records longer, and other laws, contracts, or company policies may call for a longer period. The OSHA rule establishes a minimum, not a maximum.

The requirement applies to employers covered by the standard when employees have occupational exposure to blood or other potentially infectious materials. Covered workplaces can include health care settings, laboratories, emergency response services, and other workplaces where employees may reasonably anticipate such exposure as part of their duties.

What Information Must the Training Record Include?

OSHA specifies four elements that bloodborne pathogen training records must contain. A useful record should make it possible to verify who was trained, when the training occurred, what it covered, and who provided it.

• Training dates: The date or dates when the training session took place.
• Training content or a summary: A description of the material covered, such as an agenda, course outline, or summary of the required topics.
• Trainer information: The name and qualifications of the person conducting the training.
• Attendee information: The names and job titles of employees who attended.

Attendance sheets, electronic learning records, course certificates, and training-platform reports can help document these details. However, an attendance sheet alone may not be enough if it does not identify the course content and trainer qualifications. Employers should check that the full record, whether held in one file or several connected files, contains all required information.

Training Records Are Not the Same as Medical or Exposure Records

A common source of confusion is the difference between training records and employee medical or exposure records. OSHA assigns different retention periods to these categories. The three-year rule is specifically for training records under the Bloodborne Pathogens Standard; it should not be applied automatically to every document related to bloodborne pathogens.

The medical and exposure retention periods are established under OSHA’s employee access to medical and exposure records rule, 29 CFR 1910.1020. They are not substitutes for the specific three-year training-record requirement in 1910.1030. Employers should classify and store records appropriately rather than treating every document as a single “bloodborne pathogen file.”

Medical records require particular care because they contain sensitive personal information. Access should be limited and handled in accordance with OSHA requirements and applicable privacy laws. Training records, by contrast, document instruction and attendance; they should not include unnecessary medical details.

How Long to Keep Records After an Employee Leaves

For training records, the rule is tied to the date of training, not to how long the employee remains with the company. If an employee leaves before the three-year period has passed, the employer should still retain the record until that period ends. If the employee takes later training, each session has its own three-year retention period.

That timing differs from the general OSHA retention rule for employee medical records, which is commonly based on the duration of employment plus 30 years, subject to exceptions. Employers should not dispose of medical records simply because an employee has left, and they should not assume that a training record has to be kept for the same period as a medical record.

Who May Access OSHA Training Records?

Under the Bloodborne Pathogens Standard, training records must be made available upon request to the Assistant Secretary of Labor for Occupational Safety and Health and the Director of the National Institute for Occupational Safety and Health. The standard also provides access to employees and their designated representatives, consistent with its requirements.

OSHA’s employee access-to-records rule, 29 CFR 1910.1020, also addresses access to records. Employers should respond to valid requests within the timeframes and under the procedures that apply to the particular record and requester. Keeping records organized—with clear dates, employee names, and course details—makes it easier to locate and provide the appropriate documents.

Access to training information should not be confused with unrestricted access to medical records. Employers should verify the type of record requested and follow the applicable access and confidentiality rules. When a request raises questions about authorization or scope, consulting the relevant OSHA regulation or qualified counsel can help avoid disclosing protected information improperly.

What Training Must the Records Document?

The training record should correspond to training that meets the Bloodborne Pathogens Standard. Under 29 CFR 1910.1030(g)(2), employers must provide training at no cost to employees with occupational exposure. It must take place during working hours and at a reasonable time and location. Training is required at initial assignment to tasks where occupational exposure may occur and at least annually thereafter.

Training must be appropriate to the employee’s education, literacy level, and language. OSHA requires an opportunity for interactive questions and answers with the person conducting the session. A generic certificate may show that an employee completed a course, but it does not by itself establish that every applicable training requirement was met. Employers should retain records that reflect the actual course and its relevance to workplace tasks.

The standard’s training topics include, among other things:

• An explanation of the standard and the employer’s exposure control plan, including how employees can obtain a copy.
• Information about bloodborne diseases and the signs and symptoms of diseases relevant to occupational exposure.
• Explanation of how exposure occurs, how to recognize tasks that may involve exposure, and the use and limitations of exposure controls.
• Information on personal protective equipment, including its selection, use, removal, handling, and disposal.
• Information about hepatitis B vaccination, including its benefits, safety, method of administration, and availability.
• Appropriate actions and people to contact in an emergency involving blood or other potentially infectious materials.
• Procedures to follow after an exposure incident, including reporting, evaluation, and follow-up.

Employers should review the standard itself when building or updating a training program. A record showing that an employee attended a session does not replace the employer’s responsibility to provide training that covers required topics and fits the hazards and procedures at that workplace.

Annual Training and Recordkeeping Practices

Annual training is generally required for employees with occupational exposure, and training is also required when an employee is initially assigned to exposure-related tasks. Employers should record each session separately or maintain a system that clearly documents each date and attendee. If an employee misses a session or completes a make-up course, the record should show the actual date of completion.

It is also important to distinguish annual training from the annual review of the exposure control plan. OSHA requires the plan to be reviewed and updated at least annually and when relevant changes occur. The plan and its review history are not the same as an employee’s training record, even though training may explain the plan to staff. Employers should maintain each required document according to its own purpose and applicable rule.

A practical recordkeeping system can include:

• A consistent file naming method that includes the course date and training topic.
• An attendance record with employees’ names and job titles.
• A course outline or summary that identifies the topics covered.
• The trainer’s name and a record of relevant qualifications.
• A retention date or automated reminder based on three years after each session.
• Access controls and backups for electronic files, with a process for retrieving records when requested.

Electronic records can be useful if they remain legible, complete, secure, and readily retrievable. Employers should confirm that a learning management system preserves the required details and that records can still be accessed if the system, vendor, or employee account changes. A certificate that is difficult to retrieve or lacks required information may not provide adequate documentation.

What Happens If Records Are Missing?

Missing or incomplete documentation can make it difficult for an employer to demonstrate that required training occurred and that the training covered the necessary material. OSHA may review records during an inspection or in response to a complaint, incident, or other enforcement activity. Recordkeeping failures can also complicate internal reviews after a workplace exposure.

Employers should not recreate or backdate a record as though training occurred when it did not. If a record is missing, they should assess whether the employee received the required training, document the facts accurately, and arrange training when needed. Improving the recordkeeping process can help prevent repeat gaps, but it does not change the original retention requirement.

Federal OSHA and State-Plan Considerations

The federal three-year retention rule is set out in 29 CFR 1910.1030. States and territories with OSHA-approved State Plans must have occupational safety and health standards that are at least as effective as federal OSHA standards, but they may have additional requirements or different administrative procedures. Employers should check the applicable State Plan rules, particularly if they operate in more than one state.

Other requirements may also affect how long a company retains records. For example, a contract, licensing rule, collective bargaining agreement, litigation hold, or company policy may require longer retention. When requirements overlap, employers should follow the applicable longer or more protective obligation after confirming how it applies to the specific record.

Key Takeaway for Employers

OSHA requires bloodborne pathogen training records to be kept for at least three years from the date of each training session. The record should identify the training date, content or summary, trainer’s name and qualifications, and each attendee’s name and job title. Medical and exposure records have different retention rules, so employers should keep those categories distinct, protect sensitive information, and verify any additional state or industry requirements.

Official OSHA Sources

• OSHA 29 CFR 1910.1030: Bloodborne Pathogens, including training requirements and training-record retention.
• OSHA 29 CFR 1910.1020: Access to Employee Exposure and Medical Records, including applicable access and retention provisions.
• OSHA State Plans, for information about state-administered occupational safety and health programs.