Law, responsibilities and guidance

Infection hazards are covered by the same occupational health and safety laws that cover falls, chemicals and machinery, plus a layer of public health law and professional guidance that is specific to infectious disease. This lesson explains who must do what, which rules apply in different settings and how guidance documents fit in.

The US framework

In the United States, the Occupational Safety and Health Act of 1970 covers most private employers. Federal OSHA enforces it directly in about half the states, and approved state plans, such as Cal/OSHA in California, Washington's Department of Labor and Industries and others, enforce their own standards in the rest; state plans must be at least as effective as federal OSHA and often go further. State plans also cover state and local government workers, such as public school staff and municipal workers, who are not covered by federal OSHA in states without a plan. Federal agencies follow their own programs under an executive order.

Section 5(a)(1) of the OSH Act, the General Duty Clause, requires employers to keep the workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm. OSHA has used it for infectious disease hazards, such as tuberculosis and COVID-19, where no specific standard applies. Specific OSHA standards that apply to infection hazards include the Bloodborne Pathogens standard (29 CFR 1910.1030), personal protective equipment (1910.132), respiratory protection (1910.134), sanitation (1910.141), hazard communication for chemical disinfectants (1910.1200) and recordkeeping (Part 1904).

The Bloodborne Pathogens standard

The Bloodborne Pathogens standard, adopted in 1991 and updated by the Needlestick Safety and Prevention Act of 2000, is OSHA's main infection control rule. It applies to every employer whose workers have reasonably anticipated occupational exposure to blood or other potentially infectious materials, not just health care. Employers must have a written exposure control plan that identifies exposed jobs and tasks and is reviewed and updated at least once a year, including a review of safer devices with input from front-line workers. They must use engineering and work practice controls, including safety-engineered sharps; provide protective equipment at no cost; follow housekeeping and regulated waste rules; offer the hepatitis B vaccine at no cost within 10 working days of initial assignment; provide confidential post-exposure evaluation and follow-up; train workers at hire and every year; and keep training, medical and sharps injury records. Lesson 8 covers the standard's details.

Public health law

State and local public health law gives health officers the power to investigate outbreaks, require reporting of notifiable diseases and issue orders, including isolation, quarantine and closure orders. Hospitals, nursing homes, child care centers and schools must report outbreaks and follow health department direction. Personal service businesses, such as tattoo, piercing and body art studios, are licensed and inspected under state or local rules that vary widely. At the federal level, the Centers for Disease Control and Prevention (CDC) issues guidance, supports states and runs national surveillance, and the Centers for Medicare and Medicaid Services (CMS) sets infection control conditions of participation for hospitals and nursing homes that bill Medicare and Medicaid. The Environmental Protection Agency registers disinfectants and lists products shown to work against specific pathogens.

Guidance and standards

Much of the detail of infection prevention is in guidance rather than law. CDC guidelines on standard and transmission-based precautions, hand hygiene, disinfection and sterilization, and specific diseases are the main national reference. For decades they were developed with the Healthcare Infection Control Practices Advisory Committee (HICPAC); HHS terminated that committee in May 2025, which professional groups criticized, and existing CDC guidelines remain in use. The Joint Commission's accreditation standards require hospitals to run infection prevention programs. Professional bodies such as the Association for Professionals in Infection Control and Epidemiology (APIC), the Organization for Safety, Asepsis and Prevention (OSAP) for dentistry and ASHRAE (whose Standard 170 covers ventilation in health care facilities) publish widely used standards. OSHA can cite recognized guidance as evidence that a hazard and a feasible control were recognized under the General Duty Clause.

OSHA rulemaking after COVID-19

In June 2021 OSHA issued an emergency temporary standard on COVID-19 in health care. It expired except for its recordkeeping provisions, and in January 2025 OSHA formally ended the rulemaking for a permanent COVID-19 health care standard, saying it would instead focus on a broader infectious diseases standard. A proposed infectious diseases rule for health care and related settings, which has been under development since 2010, reached White House review in late 2024, but as of our latest check in 2026 it had not been published as a proposal. Employers should watch for changes but should not wait for a new rule; the General Duty Clause and existing standards already apply.

Who must do what

Recording and reporting work-related infections

OSHA's recordkeeping rule (Part 1904) requires covered employers to record work-related illnesses that meet the recording criteria. Every needlestick and sharps injury involving contamination with another person's blood or potentially infectious material must be recorded as an injury, with the employee's name kept off the log for privacy. Tuberculosis infection from work exposure is recordable, as are other work-related infectious illnesses that lead to days away, restricted work, medical treatment beyond first aid or a physician diagnosis. Workers' compensation is a separate state system, and each state decides whether an infection is compensable.

# A simple annual review checklist for an infection prevention program (illustrative).
items = {
    "written program or exposure control plan reviewed this year": True,
    "hazard assessment covers all job categories": True,
    "safer sharps evaluated with front-line input": False,
    "training records current for all exposed staff": True,
    "vaccination offered and declinations documented": False,
    "exposure reports investigated within 24 hours": True,
    "outbreak plan tested in the past 12 months": False,
}
done = sum(items.values())
print(f"{done} of {len(items)} items complete ({done / len(items):.0%})")
for item, ok in items.items():
    if not ok:
        print("follow up:", item)

4 of 7 items complete (57%)
follow up: safer sharps evaluated with front-line input
follow up: vaccination offered and declinations documented
follow up: outbreak plan tested in the past 12 months

A checklist like this is not a legal requirement in itself, but it helps a small employer or a committee check that the main elements are in place and identify what to fix before an inspector, an outbreak or an exposure finds the gaps.

Rights of workers

Workers have rights under the OSH Act and OSHA's rules. They have the right to information and training about hazards, including the Bloodborne Pathogens standard's annual training; to see the exposure control plan and their own exposure and medical records; to file a confidential complaint with OSHA; and to be protected from retaliation for raising safety concerns under section 11(c). In limited circumstances, workers may refuse to work when they believe in good faith that they face an imminent danger of death or serious injury, there is no time to get OSHA to inspect, and the employer has refused to fix the hazard. A hazard that is a normal part of the job, such as caring for patients with infections in a hospital, does not usually meet this test when reasonable controls are in place. State plans may provide additional protections.

Whatever the jurisdiction, the practical lesson is the same: a workplace that listens to concerns, fixes gaps quickly and explains its controls rarely faces refusals or complaints about infection hazards, and it catches problems before they cause harm.