How Many Bloodborne Pathogens Are There? HIPAA Guide

A Single Needlestick Changed Everything for This Clinic

A medical assistant at a small urgent care clinic in Ohio stuck herself with a contaminated needle in 2019. Within hours, the clinic realized it had no exposure control plan, no post-exposure protocol documented, and no idea how to handle the PHI generated by the incident. The resulting OSHA citation was just the start — the mishandling of the employee's lab results triggered a separate HIPAA complaint to the Office for Civil Rights (OCR).

That story is why the question "how many bloodborne pathogens are there" matters far beyond biology class. If your organization handles blood or other potentially infectious materials (OPIM), the answer shapes your training requirements, your exposure control plan, and your HIPAA obligations around the protected health information those incidents generate.

Let's get into the real numbers — and the compliance stakes attached to them.

How Many Bloodborne Pathogens Are There, Really?

Here's the short answer: there are more than 20 identified bloodborne pathogens that can infect humans. The CDC has cataloged pathogens ranging from well-known threats like HIV and hepatitis B (HBV) to lesser-known organisms like human T-lymphotropic virus (HTLV) and Babesia.

But the number that drives workplace regulation is smaller. OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030) focuses primarily on three pathogens that pose the greatest occupational risk:

Hepatitis B virus (HBV)
Hepatitis C virus (HCV)
Human immunodeficiency virus (HIV)

These three drive the bulk of workplace exposure protocols, post-exposure testing, and — critically for your compliance team — the creation and handling of sensitive PHI.

The Full List Goes Deeper Than Most People Think

Beyond the big three, the CDC recognizes additional bloodborne pathogens including but not limited to:

Hepatitis D virus (HDV)
Human T-lymphotropic virus types I and II (HTLV-I/II)
Syphilis (Treponema pallidum)
Malaria (Plasmodium species)
Babesiosis (Babesia species)
Brucellosis (Brucella species)
Leptospirosis (Leptospira species)
Viral hemorrhagic fevers (Ebola, Marburg)
Creutzfeldt-Jakob disease (prion-related)

So when someone asks how many bloodborne pathogens are there, the honest answer is: it depends on whether you're counting what OSHA regulates or what science has identified. The regulatory focus is narrow. The biological reality is broad.

Why a Biology Question Becomes a HIPAA Problem

Every time a worker has an exposure incident — a needlestick, a splash to the eyes, a cut from contaminated glass — a chain of events fires off that generates PHI. Source-patient blood test results. Employee lab panels. Post-exposure prophylaxis records. Follow-up serology at 6 weeks, 3 months, 6 months.

Every one of those data points is protected health information under the HIPAA Privacy Rule.

I've seen covered entities stumble in predictable ways. The source patient's HIV status gets verbally shared with the exposed worker's supervisor. Lab results get faxed to the wrong number. An employee health file containing HCV test results sits in an unlocked desk drawer.

These aren't hypothetical scenarios. They're patterns I encounter repeatedly when auditing healthcare organizations and dental practices.

The Exposure-to-PHI Pipeline

Here's what a single bloodborne pathogen exposure can generate in terms of PHI:

Source patient records: Blood draw results, infectious disease history, consent forms
Exposed worker records: Baseline labs, vaccination status, post-exposure prophylaxis documentation
Incident reports: Often contain identifiable information about both parties
Workers' compensation filings: May include diagnostic codes and treatment details
Follow-up testing: Serial labs over 6+ months, each creating new ePHI entries

If your workforce doesn't understand what bloodborne pathogens are — all of them, not just the big three — they won't understand the scope of PHI an exposure event creates. And that's where HIPAA violations happen.

The $1.5 Million Lesson in Mishandled Employee Health Records

In 2019, the University of Rochester Medical Center paid $3 million to settle HIPAA violations related to the loss of unencrypted flash drives and a laptop containing ePHI. While that case didn't involve bloodborne pathogen records specifically, it hammered home a principle that applies directly: failing to encrypt ePHI and failing to conduct proper risk analyses are violations OCR will pursue aggressively.

Now imagine your employee health database contains HIV test results from a needlestick exposure, and that database lives on an unencrypted device. The regulatory risk compounds — you're not just facing an OSHA citation for a sloppy exposure control plan, you're facing OCR enforcement for a HIPAA breach involving some of the most sensitive health data that exists.

What OSHA Requires vs. What HIPAA Requires

This is where organizations get confused. OSHA and HIPAA are separate regulatory frameworks, but they collide directly in the bloodborne pathogen space.

OSHA's Requirements

Written exposure control plan, updated annually
Universal precautions and engineering controls
Hepatitis B vaccination offered to all at-risk workers
Post-exposure evaluation and follow-up
Annual bloodborne pathogen training for exposed workers
Sharps injury log maintained for five years

HIPAA's Requirements (Triggered by the Same Incidents)

PHI from source patient testing must be safeguarded under the Privacy Rule
Employee lab results stored electronically must meet Security Rule standards — encryption, access controls, audit logs
Minimum necessary standard applies: only workforce members with a legitimate need should access exposure-related records
Breach notification rules apply if exposure-related PHI is compromised
Business associate agreements must cover any third-party labs or occupational health vendors processing exposure-related specimens

Your organization needs training that covers both sides of this coin. The HIPAA training catalog at HIPAACertify addresses the compliance obligations that kick in when clinical and occupational health data intersect.

What Does Proper Training Actually Look Like?

I've reviewed bloodborne pathogen training programs at over 100 organizations. Most of them teach the biology fine. They cover universal precautions, the three main pathogens, how to use a sharps container. That's the easy part.

Where they fail is the handoff. What happens after the exposure? Who handles the paperwork? How do you document the incident without improperly disclosing the source patient's diagnosis? Who in your workforce is authorized to view those records?

Effective training bridges OSHA's bloodborne pathogen standard and HIPAA's privacy and security requirements. Your staff needs to understand both.

If you're building or updating your compliance program, explore the workforce training options at HIPAACertify to see how these overlapping requirements are handled in a single curriculum.

The Five Questions Your Training Must Answer

How many bloodborne pathogens are there, and which ones does OSHA specifically regulate?
What PHI is generated by an exposure incident, and who is authorized to access it?
How must ePHI from post-exposure testing be stored and transmitted?
What triggers HIPAA breach notification in an exposure scenario?
What business associate agreements must be in place with third-party labs?

Real-World Mistakes I Keep Seeing

A dental office in the Southeast faxed an employee's post-exposure HIV test result to the practice's general fax line — the one that sits in the front reception area. Three staff members saw the result before the employee did. That's a potential HIPAA violation, and it's also a breakdown in basic human decency.

A home health agency in the Midwest kept sharps injury logs in a shared spreadsheet on Google Drive. No access controls. No encryption. No business associate agreement with Google. The spreadsheet included employee names, dates, source patient identifiers, and test results. That's an ePHI exposure waiting to become an OCR investigation.

A hospital system ran annual bloodborne pathogen training but never mentioned HIPAA obligations related to exposure incidents. Their workforce knew how to dispose of a needle but had no idea that sharing a coworker's HBV status in conversation violated federal law.

Your Action Plan for 2026

Here's what I'd do if I walked into your organization tomorrow:

Audit your exposure control plan. Does it address how PHI is handled at every stage — from incident report to final follow-up lab?
Review access controls. Who in your workforce can see exposure-related health records? Apply the minimum necessary standard ruthlessly.
Check your BAAs. Every outside lab, every occupational health vendor, every third-party platform that touches exposure-related ePHI must have a current business associate agreement.
Update your training. Your bloodborne pathogen training and your HIPAA training should reference each other. Siloed compliance education creates siloed compliance failures.
Encrypt everything. If post-exposure lab results exist in electronic form anywhere in your organization — and they do — those systems must meet the HIPAA Security Rule's encryption and access standards.

The HIPAACertify training catalog is a practical starting point for organizations that need to close these gaps.

The Number Matters Less Than What You Do With It

So, how many bloodborne pathogens are there? Over 20 that can infect humans. Three that dominate occupational health regulation. And every single exposure incident involving any of them generates PHI that your organization is legally obligated to protect.

The biology is settled. The compliance landscape is where most organizations stumble. Get your training right, get your policies right, and treat every exposure event as both a worker safety issue and a HIPAA event. Because that's exactly what it is.

For a deeper dive into OSHA's bloodborne pathogen regulatory framework, visit OSHA's Bloodborne Pathogens page.

How Many Bloodborne Pathogens Are There? A HIPAA Guide