OSHA and NEMT companies: bloodborne pathogens, injury logs, and lifting hazards

Which OSHA rules reach a NEMT company

OSHA applies once you have employees: drivers, attendants, dispatchers, or office staff. Its bloodborne pathogens enforcement directive notes that federal OSHA does not reach the self-employed, so an owner-operator with no staff sits outside it until the first hire. New York’s Medicaid transportation manual puts the duty in writing for providers: as employers, they must comply with the respiratory protection and bloodborne pathogens standards, plus the general duty clause.

Your state may run its own program. Twenty-two OSHA-approved state plans cover private employers, 21 states plus Puerto Rico, and each must be at least as effective as federal OSHA. The plans in Connecticut, Illinois, Maine, Massachusetts, New Jersey, New York, and the Virgin Islands cover public employees only, so private NEMT companies in those places answer to federal OSHA.

Bloodborne pathogens: when drivers are covered

The standard covers any employee with occupational exposure: skin, eye, mucous membrane, or puncture contact with blood or other potentially infectious materials that can reasonably be anticipated from the job. Two parts of NEMT work usually trigger it.

• First aid duty. OSHA’s directive says an employee trained in first aid and named by the employer as responsible for giving medical help is covered. Its list of jobs that may be covered includes employees designated to provide emergency first aid.
• Cleanup duty. The same list includes custodial workers required to clean up spills of blood or other potentially infectious materials. A driver who cleans the van after a rider bleeds or is sick is doing that work.

Payers already assume drivers do both. CareOregon requires drivers to be certified in first aid and CPR, plus blood spill procedures, before they drive any member, and a spill kit for bloodborne pathogens is on its required vehicle equipment list. Virginia spells out what its spill kit holds: absorbent for liquid spills, latex gloves, a scrub brush, bags for hazardous waste, disinfectant, and deodorizer. New York’s manual expects each vehicle to carry enough driver protective gear to meet the bloodborne pathogens and respiratory standards. If your drivers are expected to help a bleeding rider or clean up after one, they have occupational exposure and the standard applies.

What the exposure control plan must contain

Any employer with covered employees needs a written exposure control plan. The standard sets three required parts:

1. An exposure determination. List the job titles where everyone has exposure, usually drivers and attendants, and the titles where only some people do, along with the tasks that cause it.
2. A schedule and method for each requirement. How you handle work practices, protective equipment, cleaning, hepatitis B vaccination and post-exposure follow-up, training, and records.
3. An incident review procedure. How you look into the circumstances after an employee is exposed.

For a van fleet, make the plan concrete. Name the gear each vehicle carries, such as gloves in several sizes, a CPR barrier or pocket mask, and a spill kit, and say who restocks it. Describe how drivers disinfect a seat, floor, or securement strap after contact with blood. The standard requires decontaminating a contaminated surface with an appropriate disinfectant immediately or as soon as feasible after a spill. Broken glass that may be contaminated is never picked up by hand; drivers use a brush and dustpan or tongs.

The employer pays for protective equipment, never the employee. Gear only counts as appropriate if blood cannot pass through to clothes, skin, eyes, or mouth in normal use. Keep the plan where employees can get a copy. Review it every year, and again whenever tasks or positions change.

Hepatitis B vaccine and exposure incidents

Offer the hepatitis B vaccine series free to each covered employee, no later than 10 working days after their first assignment and once they have had bloodborne pathogens training. You can skip the offer only if the employee already finished the series, antibody testing shows immunity, or the vaccine is medically ruled out. You cannot require prescreening as a condition of getting the vaccine. An employee who says no signs the declination statement in Appendix A of the standard, and can still accept the series later.

OSHA’s directive allows one narrow exception. Designated first aid providers whose main job is not first aid, and who give it only as a collateral duty in response to workplace incidents, may be offered the vaccine after an incident instead of before. The plan then has to require that every first aid incident involving blood is reported before the end of that shift, and that the full series is made available within 24 hours to any unvaccinated provider who helped. Whether a driver fits the exception depends on how often first aid is part of the job. Offering the vaccine at hire removes the question.

An exposure incident is specific contact with blood through the eyes, mouth, other mucous membranes, broken skin, or a puncture such as a needlestick or bite. After one, you must immediately make a confidential medical evaluation and follow-up available to the employee. That includes documenting how the exposure happened and identifying the source person, unless that is infeasible or barred by state or local law.

Training and records

Bloodborne pathogens training has fixed rules:

• Train at initial assignment, then every year, no more than one year after the prior session.
• Provide it free and during working hours.
• Match the material to the employee’s education, literacy, and language.
• Include a chance to ask questions and get answers from the person running the session, who must know the subject as it applies to your workplace. A recorded video with no way to reach a trainer misses that element.

Medical records stay confidential. You cannot disclose them without the employee’s written consent, except where the standard or another law requires it.

Injury and illness logs

If your headcount went above 10 at any point last calendar year, you must keep OSHA’s injury and illness log unless your industry is partially exempt. NEMT is not. The Census Bureau classifies special needs transportation (passenger service for elderly or disabled people) as NAICS 485991, part of industry group 4859, Other Transit and Ground Passenger Transportation, and 4859 does not appear in the partially exempt list in Appendix A to Subpart B.

Once you cross the line:

1. Log each case within 7 calendar days. Enter every recordable injury or illness on the 300 log and complete a 301 incident report. An insurance form that carries the same information can replace the 301.
2. Post the annual summary. After year end, total the log on the 300A, have a company executive certify it, and post it from February 1 to April 30.
3. Keep five years. Logs, summaries, and 301s stay on file for five years after the year they cover.
4. Submit electronically if you are large enough. An establishment in industry group 4859 with 20 or more employees sends its 300A data to OSHA each year by March 2. At 100 or more employees, it also sends data from the 300 log and the 301 reports.

Every employee needs to know how to report an injury, that they have the right to report it, and that retaliation for reporting is prohibited. A reporting procedure that would discourage a reasonable employee from speaking up does not meet the rule.

Driver injuries from crashes belong on the log too. Public-road crashes are exempt from the OSHA phone report, but the injury is still recorded if you keep a 300 log. The van accident guide covers the police, state, and broker reports that do apply.

Reporting a death or hospitalization

Every employer, including small companies exempt from logs, must notify OSHA:

• Within 8 hours of a work-related employee death.
• Within 24 hours of an employee’s in-patient hospitalization, amputation, or eye loss.

Report by phone to your closest OSHA area office or to 1-800-321-6742, or file online at osha.gov. If the area office is closed, use the toll-free number or the online form; a voicemail, fax, or email does not count. Heart attacks at work are reportable. Three situations are recorded but not reported: a road crash away from any construction work zone, an event on a commercial or public transportation system, and a death that comes over 30 days after the incident (or a hospitalization more than 24 hours after it).

Lifting hazards and the general duty clause

OSHA sets no limit on how much an employee may lift. Its April 2014 interpretation letter says so directly. Lifting injuries still fall under the general duty clause, which obliges every employer to protect workers from known hazards that can kill or seriously injure them.

The same letter calls the NIOSH lifting equation a voluntary guideline and notes that 35 pounds has been recommended as an upper limit for manual patient transfers. That number came from a 2007 analysis by a NIOSH researcher. Two NIOSH authors later wrote that the agency never adopted 35 pounds, or any other weight, as a policy limit. They added that the safe weight drops further with extended arms, lifts near the floor, a twisted trunk, one-handed lifts, and cramped spaces. A van doorway or wheelchair bay is a cramped space.

Controls that keep drivers from lifting riders:

• Book the right level of service. A rider who cannot stand and pivot should travel as a wheelchair or stretcher trip, not in a sedan with a driver who lifts. See safe passenger transfers for the methods.
• Two crew members for stretcher trips. In Virginia, each stretcher van runs with both a driver and an assistant, and Missouri requires a minimum of two persons aboard whenever a stretcher van carries a passenger.
• Give drivers equipment. Gait belts, transfer boards, and stair chairs turn a lift into a guided move.
• Put a no-lift rule in writing. Drivers steady and guide riders; they do not carry them.

Back and shoulder strains also drive workers’ compensation costs, covered in workers’ comp for NEMT.

Assaults and threats against drivers

No OSHA standard covers workplace violence, but OSHA enforces it through the general duty clause. An employer that has had violent incidents, or learns of threats, is on notice of the risk and is expected to put a prevention program in place with engineering controls, administrative controls, and training. OSHA lists working alone or in isolated areas, providing services and care, and dealing with volatile or unstable people as factors that raise the risk. A NEMT driver alone in a van with a rider in crisis has all three.

A practical program for a small fleet:

1. A written procedure for pulling over, stepping out, and calling dispatch or 911 when a rider becomes threatening.
2. De-escalation training at hire, with a refresher when an incident shows a gap.
3. A way to flag riders with a history of aggression so dispatch can send a second person or a different vehicle.
4. A report for every threat or assault, reviewed the same week. Handling tense rides is covered in difficult passengers.

Cleaning chemicals and masks

Disinfectants fall under hazard communication when your use goes beyond a typical consumer’s. The standard exempts consumer products used as the manufacturer intended, as long as exposure is no longer or more frequent than a consumer would experience. Drivers wiping down seats and securement gear several times a shift may pass that point. If they do, you need labeled containers, safety data sheets, and training when an employee starts and whenever a new chemical hazard arrives.

Masks follow the respiratory protection standard. If you require respirators such as N95s, you need a written program run by a trained administrator, a medical evaluation, and fit testing before first use and annually after that. If you only allow voluntary use, give employees the information in Appendix D of the standard. Voluntary use of filtering facepieces alone needs no written program.

What a violation costs

OSHA’s maximum penalties are $16,550 per serious or other-than-serious violation, $16,550 per day for failing to correct a cited violation, and $165,514 per willful or repeated violation. The Department of Labor made no inflation adjustment for 2026, because the October 2025 consumer price data the law requires was never published, so these January 2025 amounts remain in force.

A starting checklist for a small fleet

1. Written exposure control plan, reviewed every year.
2. Gloves, a barrier mask, and a spill kit in every vehicle, checked at each inspection.
3. Hepatitis B vaccine offered at hire, with signed declinations on file.
4. Bloodborne pathogens training for new hires and yearly refreshers, with sign-in sheets kept for three years.
5. A written injury reporting procedure handed to every employee.
6. An OSHA 300 log once you pass 10 employees, and the 300A posted each February.
7. The 8-hour and 24-hour reporting steps written into your policies and procedures.
8. A no-lift rule and transfer equipment on every vehicle.
9. A procedure for threatening riders, and safety data sheets for the cleaning products drivers use.

Keeping safety dates in HealthRide

HealthRide stores every credential that carries an expiration date, so a driver’s yearly bloodborne pathogens training and CPR card sit in the same place as their license. Reminders go out ahead of each deadline, and dispatch sees a warning if an expired credential would land on a trip. Drivers also do their pre-shift van check in the app, a good moment to confirm the spill kit is stocked. Fleet and credentials explains the setup.