Occupational bloodborne pathogen protocol — wound care, risk stratification, source testing, PEP decision-making, and follow-up documentation
The first sixty seconds after a percutaneous exposure matter less for infection prevention than most people assume — but the *actions taken* still matter, because some traditional first-aid habits are actively unhelpful. Current occupational health guidance (CDC, WHO, NIOSH) is unambiguous: wash the wound with plain soap and water, or flush mucous membranes with water or saline, and stop there. Squeezing, "milking," or aggressively bleeding the wound has no demonstrated benefit and may cause local tissue trauma; caustic agents such as bleach, iodine soaks, or injecting antiseptics into the wound are not recommended and can worsen the injury.
Step-by-step first aid for a percutaneous sharps injury:
1. Stop what you are doing — do not continue the clinical task with a contaminated device in hand. 2. Remove gloves or PPE if contaminated, and expose the wound. 3. Wash the puncture site or non-intact skin thoroughly with plain soap and running water. No special antiseptic soap is required; ordinary soap is sufficient. 4. For mucous membrane exposures (eyes, mouth, nose): flush continuously with clean water, saline, or sterile irrigants for several minutes. 5. Do not scrub aggressively — gentle, thorough washing is the goal, not abrasion of the skin. 6. Dry the area and cover with a clean dressing if there is ongoing minor bleeding. 7. Report the exposure immediately to your supervisor and occupational health / employee health service — do not wait until end of shift.
The entire purpose of this step is source-agnostic wound hygiene: it applies identically regardless of what is later learned about the source patient's bloodborne pathogen status, and it should never be delayed while waiting for source information.
For decades, "encourage bleeding" was informally taught as a way to flush pathogens out of a puncture wound. Subsequent review of the evidence found no controlled data demonstrating that squeezing or forcibly expressing blood from a needlestick wound reduces bloodborne pathogen transmission risk. What squeezing reliably does is increase local tissue trauma, which can create more entry points for pathogens and cause unnecessary pain and bruising — with no offsetting benefit.
Similarly, applying bleach, alcohol, or other caustic antiseptics directly into a puncture wound is not supported by evidence and is explicitly discouraged by CDC and WHO post-exposure guidance. These agents can chemically injure already-compromised tissue, and there is no evidence that they inactivate bloodborne viruses once the exposure has occurred at the tissue level. The wound is not meaningfully "disinfected" by this practice — it is simply harmed.
Injecting antiseptics into the wound tract, or applying corrosive substances, are both listed as actions to avoid in essentially every major occupational post-exposure protocol worldwide.
The evidence-based first-aid message is deliberately simple: wash with soap and water (or flush mucosa with water/saline), report the exposure immediately, and let the risk-assessment and testing pathway — not folk first aid — determine what happens next.
Not all needlestick injuries carry equal risk. A structured risk assessment — performed by occupational health or the treating clinician within minutes to hours of the exposure — classifies the event along two independent axes: severity of the exposure itself, and the bloodborne pathogen status of the source patient. Together these determine whether prophylaxis is unnecessary, worth considering, or urgently recommended.
The US Public Health Service (PHS) and CDC risk stratification model considers several device- and injury-level factors that independently increase transmission probability:
• Hollow-bore needle vs. solid suture needle — hollow-bore devices carry more residual blood volume and are associated with substantially higher transmission risk. • Visible blood on the device — a device visibly contaminated with blood implies a larger infectious inoculum than one that appears clean. • Depth of injury — deep punctures that draw blood carry higher risk than superficial scratches that do not penetrate to the dermis. • Device previously placed in the source patient's artery or vein — an indwelling vascular device (e.g., an IV catheter or arterial line needle) implies direct exposure to a larger, more concentrated volume of blood, and is treated as the highest-severity category. • Terminal illness/high viral load in the source (e.g., advanced untreated HIV) is an additional, independent risk multiplier considered once source status is known.
These factors are combined into a simple three-tier severity model — less severe, more severe, and most severe — that maps directly onto later prophylaxis decisions.
A structurally identical needlestick injury carries dramatically different clinical implications depending on what is known about the source patient:
• Source known HIV/HBV/HCV-negative: the exposure is still logged and the worker is still offered baseline testing, but prophylaxis for that specific pathogen is generally not indicated, barring a recent high-risk exposure window in the source ("window period" seroconversion). • Source status unknown: this is the most operationally complex scenario. The exposed worker cannot simply be told there is no risk, but starting prophylaxis for every unknown-status exposure would over-treat the large majority of cases. Guidelines call for rapid source testing (Stage 3) whenever feasible, with an interim risk-based decision if testing cannot be completed quickly. • Source known positive: for HIV, both severity of exposure and the source's viral load/treatment status refine the recommendation from "consider" to "recommend" PEP. For HBV, the source's HBsAg/HBeAg status combined with the worker's own immunity determines HBIG and vaccine decisions. For HCV, no PEP exists regardless of source status, but confirmed source positivity intensifies the follow-up testing schedule.
This is precisely why risk assessment is a distinct, deliberate step rather than a reflexive "give everyone PEP" or "treat every needlestick the same" approach — it exists to route each case onto the correct, proportionate pathway.
Risk assessment is a decision funnel, not a diagnosis: its output is not "infected" or "not infected" but rather which of several well-defined next-step pathways — no prophylaxis, consider prophylaxis, or recommend prophylaxis — the exposure should follow.
When the source patient is identifiable, available, and able to give informed consent, rapid testing for HIV antigen/antibody, hepatitis B surface antigen (HBsAg), and hepatitis C antibody (anti-HCV) is the single most decision-relevant step in the entire protocol. A negative rapid HIV result in the source, for instance, can allow first-dose PEP to be safely discontinued, sparing the exposed worker weeks of antiretroviral side effects.
Source patient testing runs in parallel with — not instead of — first-dose decision-making for the exposed worker:
1. Identify the source patient and confirm they are the correct individual associated with the device. 2. Obtain informed consent for testing wherever legally and ethically required; some jurisdictions permit testing of already-available clinical specimens or emergency testing protocols when consent cannot be obtained promptly. 3. Draw or use existing specimens for a 4th-generation HIV antigen/antibody combination assay, HBsAg, and anti-HCV. 4. If the source is already known to be HIV-positive, additional information is gathered where available: current viral load, ART regimen and adherence, and any known drug-resistance history, since these refine (but do not eliminate) the PEP recommendation. 5. Results are communicated urgently to the treating clinician managing the exposed worker's prophylaxis decision — ideally within the same clinical encounter.
Importantly, if the source cannot be tested quickly, this must never be used as a reason to delay a first dose of PEP in a high-severity exposure — the recommendation is to start PEP based on risk assessment alone and adjust or discontinue once source results return.
A negative source test result is reassuring but not absolute, because of the biological window period between infection and detectable antigen/antibody:
• HIV: modern 4th-generation combination assays detect both p24 antigen and antibody, narrowing the window period to roughly 2–4 weeks post-infection, but a source with a very recent high-risk exposure could still test falsely negative. • HBV: HBsAg typically becomes detectable within weeks of infection; a source in the earliest phase of acute infection could theoretically be HBsAg-negative yet infectious, though this is uncommon. • HCV: anti-HCV antibody can take 8–12 weeks to become detectable after infection; a source with recent HCV acquisition may be antibody-negative despite being viremic.
Because of these limitations, clinical judgment about the source's epidemiologic risk (e.g., known injection drug use, recent high-risk behavior) is combined with the test result rather than relying on a negative result in isolation, particularly for HIV PEP discontinuation decisions.
If a source patient cannot be identified or tested (e.g., a needle found in a sharps container of unknown origin, or the patient declines consent), the exposure must be managed using worst-case risk assessment from Stage 2 until more information becomes available.
Once severity and source status are known (or reasonably estimated), the protocol branches into three parallel, pathogen-specific decision pathways. Each pathogen has a fundamentally different prophylactic tool available — or, in the case of hepatitis C, none at all — which is why the three branches must be evaluated independently rather than treated as a single combined "prophylaxis" decision.
HIV PEP consists of a 28-day course of combination antiretroviral therapy, typically a three-drug regimen (commonly an integrase inhibitor plus two nucleoside reverse transcriptase inhibitors), started as soon as possible after exposure — ideally within hours, and generally considered to have diminishing benefit beyond 72 hours.
The decision follows directly from the combination of severity (Stage 2) and source HIV status (Stage 3):
• Source known HIV-negative: PEP is not indicated, regardless of exposure severity, unless the source has a credible recent high-risk exposure suggesting a window-period infection. • Source status unknown, low-severity exposure: PEP is generally not indicated, but the situation should be reassessed rapidly as source information becomes available. • Source status unknown or positive, higher-severity exposure (deep injury, visible blood, or a device from an artery/vein): PEP should be considered or recommended, and started promptly while further information is gathered — it can always be discontinued if the source is subsequently confirmed negative. • Source known HIV-positive with a higher-severity exposure: PEP is recommended without delay.
PEP is far more effective when initiated early; efficacy drops substantially the longer initiation is delayed, which is why the decision to start (even provisionally) should not wait for full risk-assessment paperwork to be completed.
PEP should never be withheld solely because source testing has not yet returned in a high-severity exposure — start promptly, then stop early if the source is confirmed negative. The 72-hour initiation window is a hard outer limit, not a target.
Unlike HIV, hepatitis B decision-making centers on the exposed worker's own immune status rather than solely on the severity of injury, because an effective vaccine and hyperimmune globulin exist:
• Worker previously vaccinated with documented immunity (anti-HBs ≥10 mIU/mL): no additional treatment is needed regardless of source status — existing immunity is protective. • Worker unvaccinated or with unknown/inadequate response, source HBsAg-positive or unknown: hepatitis B immune globulin (HBIG) plus initiation (or completion) of the vaccine series is recommended, ideally within 24 hours and no later than 7 days post-exposure. • Worker vaccinated but non-responder (documented anti-HBs <10 mIU/mL after a full series): HBIG plus revaccination, or two doses of HBIG, depending on local protocol.
Because hepatitis B vaccination is standard practice for healthcare workers, most occupational exposures in vaccinated staff require no further action beyond confirming documented immunity — which is why checking the worker's vaccination and titer records is one of the first practical steps in this stage.
Hepatitis C is the outlier among the three bloodborne pathogens: there is no vaccine and no approved post-exposure prophylaxis regimen. The entire management strategy is surveillance-based:
• Baseline anti-HCV (and consider HCV RNA) testing of the exposed worker at the time of exposure. • Follow-up testing at defined intervals (Stage 5) to detect seroconversion or viremia early. • If acute HCV infection is detected during follow-up, the worker is referred promptly for evaluation — modern direct-acting antiviral (DAA) regimens cure the large majority of both acute and chronic HCV infections, making early detection clinically valuable even without a preventive prophylaxis option.
Because no drug can be given "just in case," the entire value of the HCV pathway lies in disciplined, complete follow-up testing rather than any action taken in the first hours after exposure.
A needlestick exposure is not resolved at the moment of first aid or the first PEP dose — it is resolved only after a defined follow-up testing schedule confirms whether transmission occurred, and after the event has been properly logged for both clinical and regulatory purposes. This final stage is where good intentions in the first hours are either validated or undermined by incomplete paperwork and missed follow-up visits.
Follow-up testing intervals are timed to the biological window periods of each pathogen and to whichever prophylaxis, if any, was given:
• HIV: baseline testing, then follow-up at approximately 6 weeks, 3 months, and 6 months post-exposure using a 4th-generation antigen/antibody assay; if PEP was taken, testing is often extended given theoretical delays in seroconversion, and any illness consistent with acute retroviral syndrome during follow-up warrants earlier testing. • Hepatitis B: for workers who are non-immune and received HBIG/vaccine, follow-up anti-HBs testing confirms an adequate immune response 1–2 months after completing the vaccine series; HBsAg follow-up may be added if the source was positive. • Hepatitis C: baseline anti-HCV, with HCV RNA testing at approximately 4–6 weeks (which can detect infection earlier than antibody conversion), and anti-HCV confirmation at 4–6 months; any early symptoms or abnormal liver enzymes trigger accelerated testing.
Missed follow-up visits are one of the most common real-world failure points in occupational exposure management — many programs use automated reminders or occupational health case-management systems specifically to counter this.
Beyond individual patient care, every needlestick or sharps injury triggers institutional and, in many jurisdictions, regulatory reporting obligations:
• Internal incident report filed with occupational/employee health services, typically within the same shift. • In the United States, employers covered by OSHA's Bloodborne Pathogens Standard must record the injury on a sharps injury log, capturing device type, brand, and circumstances — this data feeds into institutional sharps-safety device evaluation and purchasing decisions. • Workers' compensation documentation, where applicable, to preserve the worker's right to coverage for any resulting illness or treatment. • Root-cause or circumstance review, particularly for recurring device types or clinical scenarios, to inform future prevention efforts (e.g., adopting safety-engineered devices, retraining on disposal technique).
This reporting layer exists independently of whether prophylaxis was given or whether any test result was positive — even a "low-risk, no action needed" exposure must be logged.
Complete documentation captures: date/time/location of exposure, device type and brand, depth and body site of injury, presence of visible blood, source patient identification and consent status, all test results (source and worker), prophylaxis offered/given/declined, and every follow-up test result through case closure.
A case is formally closed only once the full follow-up testing schedule is complete for every pathogen relevant to that exposure and all results are negative, or once a diagnosis is made and the worker has been transitioned to appropriate ongoing clinical care.
Waiting months for final results is a recognized source of significant anxiety for exposed healthcare workers. Good occupational health programs pair the testing schedule with structured counseling: realistic risk communication at each stage, guidance on precautions during the follow-up window (e.g., safer sex practices, avoiding blood donation) until HIV/HCV status is confirmed negative, and a clear point of contact for questions between visits.
The overall protocol — immediate wound care, risk assessment, source testing, pathogen-specific prophylaxis, and disciplined follow-up — is designed to convert a frightening, high-uncertainty event into a structured process with defined off-ramps at every stage, minimizing both missed infections and unnecessary treatment.