Is a Needlestick an Injury or an Illness on the OSHA 300 Log?

A laborer clearing a vacant lot for a new foundation reaches into a pile of debris and a discarded syringe goes through his glove. He washes the wound, a coworker drives him to an occupational clinic, and the doctor orders baseline blood tests. Nobody knows yet whether he was exposed to anything. The recordkeeper has two questions: does this go on the 300 Log at all, and in which column?

The answers are fixed by one short section, 29 CFR 1904.8. If the needle was contaminated with another person's blood or other potentially infectious material, the case goes on the Log, as an injury, without the worker's name. It does not wait for a diagnosis. And it becomes an illness only if one comes.

A work-related needlestick or cut from a sharp object contaminated with another person's blood or other potentially infectious material must be recorded on the OSHA 300 Log as an injury, as a privacy case without the employee's name, under 29 CFR 1904.8(a); if the worker is later diagnosed with a bloodborne disease, the case is changed to an illness under 1904.8(b)(3).

At a glance: Contaminated needlestick or sharps cut → always recordable, even with first aid only (29 CFR 1904.8(a)). Column M(1), injury. Privacy case: no name on the Log, name on the confidential list (1904.8(a), 1904.29(b)(6)-(7)). Diagnosis of an infectious bloodborne disease later → update the description and move it to an illness; update the classification if it brings death, days away or restriction (1904.8(b)(3)). Clean sharp → only if it meets 1904.7 (1904.8(b)(2)). Splash, no cut → an illness only on diagnosis or if it meets 1904.7 (1904.8(b)(4)).

The rule, in its own words

29 CFR 1904.8(a) says you must record all work-related needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material, as defined by 29 CFR 1910.1030. You enter the case on the OSHA 300 Log as an injury. And to protect the employee's privacy, you may not enter the employee's name on the Log, under the privacy case requirements of 29 CFR 1904.29(b)(6) through (b)(9).

Three things in that paragraph are different from the usual recordability test.

• It skips the general criteria. Most cases go on the Log only if they meet 29 CFR 1904.7: medical treatment beyond first aid, days away, restriction and so on. A contaminated needlestick is recorded even when the only care is washing the wound and a bandage, which would be first aid on any other case.
• It fixes the column. Injury, column M(1), not one of the illness columns, at least until a diagnosis.
• It removes the name. Not as an option the worker asks for, but by rule.

What counts as "contaminated"

The contamination has to be another person's blood or other potentially infectious material, which 29 CFR 1904.8(b)(1) defines by reference to the Bloodborne Pathogens standard, 29 CFR 1910.1030(b). The materials include human bodily fluids, tissues and organs, and other materials infected with HIV or hepatitis B, such as laboratory cultures or tissues from experimental animals.

On a construction site, the classic cases are a discarded syringe in demolition debris or a vacant lot, a sharp in a restroom or trash being cleaned out, and a first aid response where a coworker's blood was on the blade that cut the responder. In each, the question is whether the sharp carried someone else's blood or bodily fluid. When nobody can tell, as with a syringe in a debris pile, treat it the way the clinic does: as potentially infectious.

A clean sharp is a different case

29 CFR 1904.8(b)(2) draws the line. You record cuts, lacerations, punctures and scratches under 1904.8 only if they are work-related and involve contamination with another person's blood or other potentially infectious material. If the object was clean, or the contaminant was something other than blood or other potentially infectious material, you record the case only if it meets one or more of the general recording criteria in 29 CFR 1904.7.

So a box cutter slip that needs only a bandage stays off the Log. The same slip that needs sutures goes on it, as an ordinary injury with the worker's name, because sutures are medical treatment under 1904.7. And a puncture from a nail is a 1904.7 question, not a 1904.8 one, unless the nail carried someone's blood.

When a diagnosis comes later

29 CFR 1904.8(b)(3) covers the follow-up. If the case later results in death, days away from work, restricted work or job transfer, you update the classification on the Log. If the worker is diagnosed with an infectious bloodborne disease, you also update the description to identify the disease and change the classification of the case from an injury to an illness.

Those updates do not create a new case. The original line is corrected, the way the Form 300 instructions describe for any case whose outcome changes, and 29 CFR 1904.33(b)(1) keeps that duty alive for the five years you keep the Log. The case stays a privacy case throughout; 29 CFR 1904.29(b)(7) also lists HIV infection, hepatitis and tuberculosis among the privacy concern cases.

A splash without a cut

A splash of blood in the eye, the mouth or on broken skin, with no needlestick or cut, is handled by 29 CFR 1904.8(b)(4). You record it on the Log as an illness if it results in the diagnosis of a bloodborne illness such as HIV, hepatitis B or hepatitis C, or if it meets one or more of the recording criteria in 1904.7. A splash with baseline testing and nothing else does not go on the Log by itself.

Writing the line on the Log

Keep the real name, with the case number, on the separate confidential list that 29 CFR 1904.29(b)(6) requires, and keep it apart from the Log. The 301 for the case carries the name, the clinic and the details; it is never posted. Who can see the OSHA 300 Log covers who may read which document, and the 301 item by item covers the incident report.

How HazComFast records a needlestick

On the 301 in HazComFast, the needlestick has its own box: "Needlestick or cut from a sharp object contaminated with another person's blood or OPIM", citing 29 CFR 1904.8. Check it and the screen states the rule: the case is entered on the Log as an injury, the employee's name may not be entered on the Log, and the privacy case stays locked while the box is checked, so it can't be unchecked by mistake. The injury type stays on Injury until an infectious disease is diagnosed, with a second box for that diagnosis under 1904.8(b)(3).

The privacy case shows the complete list of 29 CFR 1904.29(b)(7), and the Log's general description comes from neutral wordings in one click, such as "Contaminated needlestick" or "Bloodborne pathogen exposure". The confidential list of names is its own restricted screen that only administrators can open, and each view and each export of it is written to the audit log.

Related: Who can see the OSHA 300 Log · Which column to check on the OSHA 300 Log · When is an injury recordable? · OSHA Form 301, item by item

---

Sources & verification (read 2026-10-13 on osha.gov): 29 CFR 1904.8(a), (b)(1) to (b)(4); 1904.7; 1904.29(b)(6), (b)(7) and (b)(9); 1904.33(b)(1); 29 CFR 1910.1030(b) for the definition of other potentially infectious materials. General guidance, not legal advice.*