The only vaccination employers are federally required to offer to employees with occupational exposure to bloodborne pathogens is the hepatitis B vaccine — and it's not automatically mandatory for the worker. Under OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030), the employer must make hepatitis B vaccination available at no cost within 10 working days of initial assignment, during working hours, and at a reasonable location. Employees may decline it by signing a declination form, and they can change their mind later. There is no federal requirement to provide vaccines for HIV, hepatitis C, or other bloodborne diseases, because no licensed vaccine exists for those.

What OSHA's Bloodborne Pathogens Standard Actually Requires

The hepatitis B requirement lives in paragraph (f) of 29 CFR 1910.1030, and the agency that enforces it is the Occupational Safety and Health Administration. Covered employers must offer the vaccine to every employee with occupational exposure — a defined term meaning reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials arising from job duties. That definition pulls in far more workers than most people assume.

The phrase "required to provide" trips people up because it has two layers. The employer has a mandatory duty to make the vaccine available. The employee has a right to refuse it. OSHA's own compliance guidance frames vaccination as a condition of employment only if the employer has adopted a written policy requiring it — and even then, the standard's refusal pathway survives. Federal OSHA does not mandate that any worker actually receive the shot.

Timing is where employers most often fail inspections. The offer must come within 10 working days of initial assignment unless the employee has already completed the series, has documented antibody immunity, or has a medical condition that contraindicates vaccination. "Initial assignment" means the first time the worker is placed in a role with exposure risk — not the first day of employment overall.

One detail the standard's opening paragraphs bury: the vaccine must be provided at no charge to the employee, and any post-exposure evaluation or follow-up, including antibody testing after vaccination, is also employer-paid. If a worker pays a clinic copay out of pocket, the employer has not complied, even if reimbursement happens later.

Which Workers Count as "Occupationally Exposed"

OSHA's exposure determination is supposed to be written and made without regard to personal protective equipment — the reasoning being that PPE can fail, so it can't erase the risk category. The employer lists job classifications where all employees have exposure and, separately, classifications where only some do, with the tasks that create the risk named.

Healthcare is the obvious category: nurses, phlebotomists, physicians, surgical techs, dialysis staff, and emergency responders all typically qualify. So do dental hygienists, laboratory workers handling specimens, and mortuary or funeral employees who handle human remains. Housekeeping staff who clean blood or bodily fluids in patient areas often land on the list too.

Less obvious industries get flagged regularly in OSHA enforcement. Tattoo and piercing artists, barbers and cosmetologists who may encounter blood, correctional officers, school nurses, athletic trainers, and employees at blood banks or plasma centers all fall within scope when their duties create anticipated contact. Even a designated first-aid responder in a warehouse can qualify in narrowly defined circumstances — a fact that surprises many small employers.

The classification drives everything that follows. If a worker isn't in an exposure category, the vaccine offer isn't required for that person, though employers may offer it voluntarily. Misclassifying a role as low-risk is the single most common documentation gap, and it's the one compliance officers check first when reviewing an exposure control plan.

The Ten-Working-Day Clock and How the Offer Must Be Made

The vaccine offer is a process, not a pamphlet. OSHA expects the employer to document that the vaccine was made available during working hours, at a reasonable location, and that the employee was told the benefit is free. The common failure mode is a new-hire packet that includes a "vaccine available" flyer buried on page nine with no signature line confirming the offer happened.

10 working days is counted from initial assignment, and it can be satisfied by starting the three-dose series rather than waiting for the whole thing to finish. The standard's schedule follows the CDC-recommended dosing intervals: dose one, then dose two one month later, then dose three six months after the first. The employer covers all three doses.

If shift work makes clinic access impossible, the employer still owns the logistics. A night-shift nurse can't be told to use a day clinic and then face a copay or unpaid travel time. Reasonable location and paid working-hour scheduling are part of the requirement, and some employers satisfy it with mobile vaccination units or on-site clinics during shift changes.

Failure handling matters here. If an employee starts the series and leaves the employer before completing it, the new employer must offer to finish it rather than restart it — provided the worker shares vaccination records. CDC publishes catch-up scheduling guidance for interrupted series, which is why keeping employee vaccine records in the exposure control file (with medical confidentiality protections under paragraph (h)) pays off.

Declinations: What the Signed Form Does and Doesn't Do

Declining the vaccine triggers a specific documentation requirement. The employee signs the OSHA declination form, which states they understand the risk and that the vaccine is recommended. The employer keeps the form in the confidential medical file. That's the whole mechanism — there is no legal penalty for the worker, though some employers adopt a policy stating they will assign unvaccinated workers to different duties, which OSHA permits if the policy is applied consistently.

The edge case most employer guides skip: the standard entitles employees who change their minds to vaccination at the time of the change, at no cost, with no maximum number of changes. Someone who declined at hire can walk into the clinic three years later and request the shot. OSHA expects the employer to honor that request in a timely way. A "decline once, decline forever" policy not only violates the standard but also explains a lot of avoidable enforcement citations.

Critical guidance from OSHA: if an employee's job changes to include exposure after previously being classed as lower-risk, the 10-working-day clock restarts at the reassignment date, and the declination must be re-solicited if the original one is stale. Smart employers re-offer on every reassignment and log it.

Screening Before the Shot: Antibody Testing and Contraindications

Before offering the shot, the employer must consider whether the employee has proof of prior vaccination series completion or documented immune status. Antibody testing can establish existing immunity and avoid an unnecessary series. The catch most HR teams miss: prescreening antibody testing is not a substitute for vaccination, and OSHA treats antibody testing alone as insufficient to meet the vaccine requirement unless the test is used to determine whether the vaccine is indicated or to document response after the full series.

The post-vaccination testing is covered, too. If the employer chooses to test post-vaccination to confirm seroconversion, that's permitted and paid for by the employer, but the standard doesn't require it. Where it becomes mandatory-like in practice is for workers at particularly high exposure risk or those with workplace body-fluid exposures — which is where the separate post-exposure evaluation and follow-up provisions of paragraph (f)(3) kick in.

Medical contraindications belong in the employee's confidential file, signed by a licensed healthcare professional. A treating physician's note that the vaccine is contraindicated for a specific individual suspends the vaccine offer for that person, and the employer simply documents the determination. No employer-side guessing should happen here.

There is an unusual wrinkle in the standard that most employer guides skip. Vaccination is not required for an employee who is not in an exposure category — but OSHA makes the offer permissible for non-exposed workers at employer cost. A common middle ground: offering vaccination to custodial staff who are on the borderline. Better to over-classify than to fail an inspection.

Cost, Compliance Clock, and How to Build a Compliant Program

The Total-cost math is small relative to the recordkeeping burden. What matters is the administrative sequence.

1: Conduct and document an exposure determination with job classifications and task breakout. 2: Within 10 working days of initial assignment, offer the vaccine at no cost during paid working hours. 3: Have the employee sign either a vaccination record or the OSHA declination form. 4: File both in the confidential medical file; schedule and pay for doses two and three. 5: Re-offer at any reassignment into an exposed role, and honor any recall of an earlier declination.

Costs vary widely by region, manufacturer, and provider — verify current pricing through the vaccine manufacturer, a local pharmacy network, or your occupational health provider rather than relying on older budget quotes.

Non-compliance comes with direct citations. OSHA's penalties under the OSH Act are adjusted annually by federal rulemaking — check the current penalty schedule published by OSHA rather than relying on older figures. Repeated or willful violations carry the highest tiers.

State OSHA programs can add requirements on top of federal ones, and some states expand mandatory coverage. For covered environments, employment counsel is the right check when writing or revising your exposure control policy.

Three of the most common program gaps turn up again and again. The first is failing to re-offer at reassignment. The second is letting vaccine declination become a permanent bar. The third is forgetting that the confidential medical file has its own handling rules under paragraph (h), narrow access to the employee and licensed healthcare professional, and a separate safe-handling protocol from the general personnel file.

Yearly exposure control plan reviews are the natural checkpoint. Employers should confirm that job classifications match current practice, that declinations have not expired undetected, and that the vaccine offer actually reaches every worker who joins or transfers into an exposed role during the review year.

Where Hepatitis B Compliance Sits in the Larger Health-and-Safety Picture

Hepatitis B compliance doesn't live alone in a safety program. The same written exposure control plan that documents vaccination also covers engineered sharps safeguards, safer needle devices, PPE, hand hygiene, and post-exposure reporting — all in paragraph (h) and related provisions of the same standard. Vaccination, PPE, and sharps precautions are not interchangeable.

What federal OSHA does not require is telling. There's no federal mandate for employees to receive the vaccine, no requirement to provide HIV pre-exposure prophylaxis through the employer, and no OSHA vaccine requirement for other bloodborne pathogens with licensed vaccines. The agency's standard sticks to hepatitis B because hepatitis B is the one where a vaccine prevents occupational infection with a licensed series.

Worth noting for vision and hearing screenings that occasionally sit in adjacent safety programs — they're precaution programs under other standards, not bloodborne pathogen vaccines. Compliance officers routinely see those folded into the wrong policy, then filed under the wrong paragraph.

Some employers go further. Voluntary programs offering other vaccinations, flu shots, or vaccination catch-up assistance for employees who need it are allowed and often praised in audits, as long as they aren't conflated with the mandatory hepatitis B offer. The mandatory offer is the floor, not the ceiling.

FAQ

Does an employer have to require the hepatitis B vaccine, or just offer it?

Offer it. OSHA's standard requires the employer to make the vaccine available at no cost to employees with occupational exposure, but the employee can decline by signing the declination form. Employers may adopt a written policy requiring vaccination as a condition of employment, but even then, the standard's refusal pathway still protects the worker from employer retaliation.

Is there an OSHA-required vaccine for HIV or hepatitis C?

No licensed vaccine exists for HIV or hepatitis C, so no employer vaccine mandate can exist for either. The Bloodborne Pathogens Standard's vaccine provisions cover hepatitis B specifically. Post-exposure protocols for HIV and other pathogens involve evaluation, testing, and — for high-risk HIV exposures — post-exposure prophylaxis, not vaccination.

What happens if an employee declines the vaccine and later changes their mind?

The employer must make the vaccine available at the time the employee changes their mind, at no cost, regardless of how much time has passed. There is no cap on how many times an employee can reverse course. Keeping the original declination form plus a dated re-offer log is the reliable way to show compliance.

Does the vaccine requirement apply to remote workers or office-only staff?

Generally no, because remote and office staff without anticipated blood contact fall outside the exposure definition. The standard covers workers whose job duties create a reasonable expectation of contact with blood or other potentially infectious materials. That includes some surprising roles — correctional officers, tattoo artists, athletic trainers, and designated first-aid responders in some workplaces.

How long does the employer have to arrange vaccination after a worker starts?

10 working days from initial assignment, unless the worker has prior documentation of completed vaccination, documented immunity, or a medical contraindication. The 10-day clock starts dosing, not full immunity. Doses two and three must still be scheduled and paid for, following the CDC-recommended intervals of one month and six months after the initial dose.

Does the employer have to pay for the vaccine and post-exposure follow-up?

Yes. The standard requires the vaccine at no charge to the employee, and post-vaccination antibody testing or post-exposure evaluation and follow-up under paragraph (f)(3) is also employer-paid. A clinic copay or insurance co-pay out of the employee's pocket doesn't comply, even if reimbursement happens afterward.

Is a prior vaccination series enough to skip the employer offer entirely?

Not automatically. The employer needs documentation — a vaccination record showing series completion, or serologic evidence of immunity — kept in the confidential medical record. Verbal memory of a childhood series doesn't meet the standard on its own. If documentation is missing, the employer offers the vaccine; CDC catch-up guidance can help when the series was interrupted.

How do state workplace safety programs change these requirements?

Some state OSHA plans adopt the federal standard verbatim, and others add requirements. The safe assumption is that the federal floor applies everywhere with a state plan, plus extras in some states. Verify with your state labor or health department and your employment counsel before revising a written exposure control policy.

This article is general educational information and is not a diagnosis, treatment plan, legal opinion, or regulatory ruling. Workplace vaccine policy depends on jurisdiction, industry, and current OSHA guidance — confirm requirements by checking the current Bloodborne Pathogens Standard (29 CFR 1910.1030) directly with OSHA or your state plan, and consult a qualified occupational-health or employment-law professional before changing your program. If anyone is experiencing a medical emergency or exposure crisis, contact local emergency services or a poison control / public-health line immediately.