Bloodborne pathogen (BBP) program

1.0 Purpose and Scope

Microsoft established the Bloodborne Pathogens (BBP) Program for compliance with applicable regulations such as OSHA, 29 CFR 1910.1030, Bloodborne Pathogens. Additional state and local regulations may apply. Application of the controls and practices described in this program will reduce the potential for adverse health effects caused by exposures to BBP. BBP include diseases such as Hepatitis A Virus (HAV), Hepatitis B Virus (HBV), Hepatitis C Virus (HCV), human immunodeficiency virus (HIV), and acquired immune deficiency syndrome (AIDS).

This program applies to Microsoft employees and external staff, and all are required to follow the procedures outlined in this Program. Employees who are included in the training and vaccination requirements of the Bloodborne Pathogens Program are those with reasonably anticipated occupational exposures to bloodborne pathogens or other potentially infection materials arising from the course of their normal work duties.

2.0 Bloodborne Pathogens Control

2.1 Bloodborne Pathogens (BBP) Control Plan

Each Microsoft location with employees or external staff with regular job duties that would reasonably anticipate contact with BBP or OPIM must maintain a site-specific Bloodborne Pathogens Control Plan. This must be available to all employees, external staff, and to federal, state, or local inspectors.

The Site BBP Control Plan should include the following:

Program purpose and scope.
Personnel roles and responsibilities.
A Site Administrator must be identified for each work area for implementation and oversight of the Site Plan.
Definitions of terms critical to an understanding of the BBP Control Plan, or those terms not commonly understood, including but not limited to the definitions located of the BBP Program.
Site-specific regulatory requirements.
Exposure determination to assess jobs and tasks at risk for exposure.
Control methods, including use of universal precautions, engineering and work practice controls, personal protective equipment, proper housekeeping, and labeling.
HBV vaccination availability, benefits, efficacy, and declination procedures.
Post-exposure follow-up procedures.
Employee Information and Training.
Recordkeeping.

A sample outline of a BBP Exposure Control Plan is included as Appendix A. This sample Plan complies with OSHA regulatory requirements in 29 CFR 1910.1030, Bloodborne Pathogens.

2.2 Exposure Determination

The Plan Administrator must conduct an exposure determination for job or work tasks that are reasonably anticipated to have an occupational exposure to blood or OPIM arising in the course of their normal work duties. For the majority of Microsoft operations this includes:

Security personnel

Individuals who are required to provide first-aid as part of their normal assigned job duties, where exposure to blood or other potentially infectious materials is possible.
Emergency response actions must be conducted in accordance with all procedures in this program.

Janitorial Personnel

Trained to clean up after spills, handle biological wastes, and dispose of wastes properly.
Janitorial personnel are designated as first responders to all cleanup activities that contain blood or OPIM.

Other Job Classifications

Other employees or external staff within Microsoft may have occupational exposure as yet unidentified. If applicable, a specific exposure determination by job classification and task must be completed for those individuals and included in a site-specific BBP Control Plan.
Future changes or expansion of duties for Microsoft personnel should be evaluated for occupational exposure to BBP by Microsoft OHS.

2.3 Exposure Control Plan

All Microsoft employees and external staff must use Universal Precautions whenever dealing with possible BBP exposures. Engineering and Work Practice Controls must also be implemented in response to occupational exposures, such as at a medical clinic or in a laboratory setting where biohazards exist.

2.3.1 Universal Precautions

Universal precautions are a standardized and effective approach to dealing with material that may be contaminated with BBP or OPIM.

All employees and external staff must employ universal precautions when contact with human blood and OPIM is likely.
Universal precautions require that:
- Employees and external staff assume that any human blood or OPIM contains BBP.
- Employees and external staff must use protective barriers if contact with human blood or other OPIM is required.
- Protective barriers include PPE such as gloves, gowns, aprons, masks, or protective eyewear.
- Health care workers take precautions to prevent injuries caused by needles, scalpels, and other sharp instruments or devices.
Microsoft employees and external staff are required to notify MS Security immediately to coordinate first response and cleanup activities.

2.3.2 Hepatitis B Vaccination

The Hepatitis B Vaccine must be offered to all employees or external staff who may contact BBP or OPIM at part of their normal assigned work duties.

Any employee who is offered the HBV vaccination series but declines participation must acknowledge the declination on the Employee HBV Vaccine Declination Form (Appendix C).
Any Microsoft employee with an occupational exposure to blood or OPIM must be offered an HBV vaccination.
- The HBV vaccine and vaccination series will be made available to any first aid and CPR qualified employees providing voluntary response actions on a post-exposure basis only.
- External staff must work with their employer to attain a HBV vaccination.
- An employee who has previously declined the vaccine, but later requests the vaccine, must be provided the vaccine at that time.
Following an exposure, the HBV vaccine must be made available as soon as possible, but not later than 24 hours after the event.
- If an exposure incident has occurred, all required post exposure follow-up procedures must be implemented.
All vaccinations must be administered by a PLHCP using qualified personnel and procedures recommended by the U.S. Public Health Service.
The HBV vaccination is given routinely at hospitals and clinics and includes a series of three injections over a six-month period. A complete series will provide lifetime immunity to HBV.

2.3.3 Post-Exposure Evaluation and Treatment

All Microsoft employees with an occupational exposure to BBP or OPIM are required to complete a confidential post-exposure evaluation and follow-up with a medical professional. It is critical that employees and external staff with a possible exposure to a BBP seek treatment as soon as possible. Please refer to Appendix D for additional post-exposure procedures.

External Staff must notify their MS Vendor Account Manager of any exposure and work with their respective employer for required post-exposure evaluation and treatment, including any recommended preventative treatment.

For more information on reporting an accident or incident that occurs on Microsoft property, please refer to the Microsoft Employee Safety Incident Reporting and Investigation Procedure.

2.3.4 Engineering Controls

For an occupational exposure to blood or OPIM, engineering controls are the preferred first defense to eliminate or minimize employee exposure to BBP.

Activities with the potential for an occupational exposure to BBP will be identified by the Plan Administrator, in cooperation with Microsoft OHS.

2.3.5 Determination of the potential for occupational exposure may require a risk assessment.

Contact the Plan Administrator for assistance (for more information, please refer to the Microsoft Exposure Assessment Program).

Engineering controls used must be inspected routinely and maintained or replaced as necessary.

2.3.6 Administrative Controls

The following administrative controls will be implemented as necessary at work sites with occupational exposures:

Wash hands immediately after removal of gloves or contact with blood or other potentially infectious materials (OPIM). If hand washing facilities are not readily available, then antiseptic hand cleansers or towelettes must be used, followed by soap and running water as soon as possible.
Dispose of sharps in approved containers immediately after use.
Eating, drinking, smoking, applying cosmetics, and handling contact lenses are prohibited in areas of potential exposure.

For equipment that is or may be contaminated with blood or OPIM,

Examine and decontaminate the equipment if feasible.
Place equipment that cannot be decontaminated in a container and label the bag as a biohazard. Microsoft OHS must be contacted for proper storage and disposal. Details for the identification and labeling of biohazards are included as Appendix B.
Information regarding the biohazard must be communicated to all handling, shipping, and service personnel.

2.3.7 Personal Protective Equipment (PPE)

Employees and external staff who may have occupational exposure to BBP, or those who respond to an emergency situation involving BBP-contaminated material must be trained on the proper use and selection of PPE.

Appropriate PPE are protective barriers worn by the responder that do not permit blood or OPIM to reach the responder’s clothing or body under normal conditions and duration of use.
PPE must be provided, maintained, and properly disposed where the exposure exists or occurs.

2.3.8 Housekeeping

Any equipment and environmental surfaces after contact with blood or OPIM must be cleaned and decontaminated.
- Decontamination for BBP must be completed using a standard method and an approved cleaning product.
Employees and external staff are discouraged from cleaning up any blood or OPIM.
- If an employee comes across an area that requires clean up and decontamination for BBP, they should prevent entry into the affected area using signs or barriers.
- Microsoft Security must be contacted immediately to coordinate cleanup efforts.

3.0 Contaminated Waste Materials

All contaminated laundry must be disposed of as regulated waste or sent to a facility capable of handling infectious waste. Complete information regarding the nature of the waste and potential hazards must be disclosed to the laundry facility in writing. Contact Global OHS for additional information.
Biological waste material generated by personal use should not be disposed of at work. Employees should contact their Microsoft Human Resources Business Benefits Partner or Microsoft OHS with questions or concerns about potentially infectious waste from personal medical conditions.

4.0 Training

Employees who have predictable occupational exposures to BBP must receive training.

Training must be provided initially and annually thereafter to employees covered by the scope of this program.
Microsoft OHS has defined training to meet regulatory requirements for BBP. To obtain training, contact Global OHS

Training for BBP will include the following:

Review and explanation of applicable regulations.
A general explanation of the origin, symptoms, and transmission of BBP diseases.
Potential consequences of exposure to BBP, and the need to protect against exposure.
A description of the Exposure Control Plan and how to obtain it.
How to recognize tasks may involve exposure to blood and OPIM.
An explanation of the use and limitations of methods that will prevent or reduce exposure, including appropriate engineering controls, work practices, and PPE.
Information on the HBV vaccine.
Information on the appropriate actions to take and people to contact in an emergency involving blood or OPIM.
A description of post-response actions for a BBP exposure incident, including reporting and follow-up.
An explanation of the required signs and labels and/or color coding used at the site.
Proper disposal of contaminated materials and PPE.

5.0 Incident Investigation

Incident investigations are initiatied upon receiving reports. To foster a culture of health and safety at Microsoft, employees, interns, and external staff are required to report all work-related accidents, injuries, and illnesses via SafetyHub Report. Learn more on the Global OHS reporting page. 

5.1 Sharp Injury Log

Worker safety regulations require Microsoft to maintain a log of all occupational sharps injuries.

The injury log must contain:

The type and brand of device involved in the incident.
The department or work area where the exposure incident occurred.
An explanation of how the incident occurred.

If data from the log are shared with other parties, any Personally Identifiable Information (PII – e.g., name, address, social security number, payroll number) must be withheld.

External staff are expected to maintain a sharps injury log with their respective employer.

6.0 Records

At Microsoft, data and documents are retained in compliance with the retention times set out in our Corporate Retention Schedule

Record Type		Retention Duration	Retention Category
Current BPP Program	Superseded + 5 years		CMPL9200-20 (OSHA Program Documents)
Medical surveillance records and employee personnel exposure monitoring	Duration of employment plus 40 years		CMPL9300-15 (Employee Exposure Records)
Work area risk assessment determinations, work procedures, and evidence of periodic reviews of these documents	5 years		CMPL9200-20 (OSHA Program Documents)
Training records	5 years		CMPL9200-20 (OSHA Program Documents)
Waste designation records: Proof of waste types, such as test reports, or other documents that support generator knowledge	Indefinitely		CMPL8000-20 (Environmental Compliance)
On-site facility inspection reports, logs, and schedule	7 years		CMPL9500-20 (External non-Financial Audits)
Sharps Injury log	5 years		CMPL9200-20 (OSHA Program Documents)

7.0 Roles and Responsibilities

Global OHS Team and Environmental Compliance Group	Define minimum OHS program and training requirements. Provide consultation to local program administrators as needed. Define investigation and documentation requirements for serious incidents. Provide training tools to local Plan Administrators. Facilitate periodic review of OHS program documents.
Stakeholders for each Microsoft Facility or Business Group are responsible for implementing the requirements established by the Global OHS Program that are necessary for Microsoft to meet its regulatory requirements.
Business Group and/or Local Executives	Provide sincere, visible, proactive leadership. Ensure adequate funding, support, and staffing for OHS program implementation. Understand and implement applicable regulatory requirements. Ensure managers are held accountable to implement the Microsoft OHS programs.
People Manager or Supervisor	Implement and enforce all provisions of this Accident Prevention Plan and other applicable Occupational Safety and Health Procedures for work areas under their control. Ensure that all contractors or vendors working on Microsoft-owned equipment or facilities are informed of and adhere to the Microsoft Accident Prevention Plan. Ensure that employees complete the required training provided by Microsoft OHS. Advise all employees and external staff about hazardous conditions of which they may not be aware. Report all workplace injuries, unsafe conditions, and near-misses to Microsoft OHS. Provide Personal Protective Equipment (PPE) specified for the hazard as defined in the risk assessment for the task. Comply with necessary documentation requirements, as described in this document.
Plan Administrator or Business Unit Support	Facilitate consistent implementation of the Accident Prevention Plan. Provide required safety and health training resources for supervisors and workers. Investigate and document all reported incidents and/or near misses.
Microsoft Employees	Understand and follow the requirements in this document. Take reasonable care not to put themselves or others at risk during their work. Inform their supervisor or the Plan Administrator of any circumstance that might affect their ability to work safely. Escalate to Global OHS, if appropriate Report all workplace injuries, illnesses, unsafe conditions, and near-misses as soon as possible. Complete all safety training requirements and comply with documentation procedures
External Staff	External staff who do not receive day-to-day supervision from a Microsoft FTE and who perform work activities covered by this Program are required to include necessary procedures in their safety plans. These procedures must conform to the requirements of this document and the specifics of the Site/Business Group Plan. External staff who receive day-to-day supervision from a Microsoft FTE must follow the requirements of Employees (see above).

8.0 Definitions

The following terms are used in this document. The definitions below are used in the scope of this document but local regulatory definitions override if there is a conflict.

Acquired Immune Deficiency Syndrome (AIDS): A disease of the immune system characterized by increased susceptibility to opportunistic infections. It is caused by a retrovirus that is transmitted chiefly through blood or blood products that enter the body's bloodstream, especially by sexual contact or contaminated hypodermic needles.

Bloodborne Pathogens (BBP): Pathogenic microorganisms present in human blood, tissue, and fluids. Exposure to BBP may result in disease in humans. These pathogens include, but are not limited to, HBV and HIV.

Contaminated: The presence or the reasonably anticipated presence of blood or other potentially infectious materials on an item or surface.

Decontamination: The use of physical or chemical means to remove, inactivate, or destroy BBP on a surface or item to the point where they are no longer capable of transmitting infectious particles and the surface or item is rendered safe for handling, use, or disposal.

Engineering Controls: The elimination or reduction of a hazard by means of engineered machinery or equipment. For BBP, those controls include sharps disposal containers, self-sheathing needles, sharps with engineered sharps injury protections, and needleless systems. These controls isolate or remove the bloodborne pathogens hazard from the workplace.

Employee Exposure: Contact by an individual to a concentration of a hazardous substance or contaminant through inhalation, ingestion, dermal absorption, or injection.

Environmental Protection Agency (EPA): An agency of the federal government of the United States charged with protecting human health and the environment by writing and enforcing laws.

Exposure Incident: An act where blood or other potentially infectious materials makes contact with an employee's eye, mucous membrane, non-intact skin, or through a puncture wound.

Hepatitis A Virus (HAV): A microorganism which primarily causes inflammation of the liver in humans. This virus is the most common hepatitis virus and is found in infected fecal matter.

Hepatitis B Virus (HBV): A microorganism which primarily causes inflammation of the liver in humans. HBV spreads through contact with infected body fluids such as blood, semen, and vaginal fluids.

Hepatitis C Virus (HCV): A microorganism which primarily causes inflammation of the liver in humans and may cause permanent damage such as scarring of the liver or liver cancer. HCV is most commonly spread through sharing needles and exposure to infected blood. Unprotected sexual contact can sometimes spread the virus.

Human Immunodeficiency Virus (HIV): Any of the various strains of retrovirus in the genus Lentivirus that causes AIDS by infecting the body’s immune system.

Needleless Systems: A device that does not use needles for: (1) The collection of bodily fluids or withdrawal of body fluids after initial venous or arterial access is established; (2) The administration of medication or fluids; or (3) Any other procedure involving the potential for occupational exposure to BBP due to percutaneous injuries from contaminated sharps.

Occupational Exposure: Reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials that may result from the performance of an employee's duties.

Other Potentially Infectious Materials (OPIM): A material that can be described as one of the following:

The following human body fluids: semen, vaginal secretions, cerebrospinal fluid, synovial fluid, pleural fluid, pericardial fluid, peritoneal fluid, amniotic fluid, saliva in dental procedures, any body fluid that is visibly contaminated with blood, and all body fluids in situations where it is difficult or impossible to differentiate between body fluids.
Any unfixed tissue or organ (other than intact skin) from a human (living or dead).
HIV-containing cell or tissue cultures, organ cultures, and HIV- or HBV-containing culture medium or other solutions.
Blood, organs, or other tissues from experimental animals infected with HIV or HBV.

Physician or Other Licensed Health Care Professional (PLHCP): An individual whose legally permitted scope of practice (i.e., license, registration, or certification) allows him or her to independently provide, or be delegated the responsibility to provide, some or all of the health care services required.

Regulated Waste: A material that meets one of the following descriptions and that must be handled and disposed of as defined in 29 CFR 1910.1030:

Liquid or semi-liquid blood or other potentially infectious materials.
Contaminated items that would release blood or other potentially infectious materials in a liquid or semi-liquid state if compressed.
Items that are caked with dried blood or other potentially infectious materials and are capable of releasing these materials during handling.
Contaminated sharps.
Pathological and microbiological wastes containing blood or OPIM.

Universal Precautions: An approach to infection control. According to the concept of Universal Precautions, all human blood and OPIM are treated as infectious for HIV, HBV, and other BBP.

Work Practice Controls: Operating practices that reduce the likelihood of exposure by altering the manner in which a task is performed (e.g., prohibiting recapping of needles by a two-handed technique).

9.0 References

9.1 Microsoft Internal

Microsoft Safety and Accident Prevention Program
Microsoft Vendor Code of Conduct
Employee Safety Incident Reporting and Investigation Procedure
Microsoft Electrical Safety Program
Microsoft Exposure Assessment Program
MS Policy 37019-2, Regulatory Compliance
MS Policy 37019-5, Regulatory Investigations, Inspections, and Inquiries
Microsoft Employee Safety Incident Reporting and Investigation Procedure
Microsoft Exposure Assessment Program
Microsoft Personal Protective Equipment Program

9.2 Microsoft External

OSHA, 29 CFR 1910.1030, Bloodborne Pathogens.
OSHA Publication 3186-06N, Model Plans and Programs for the OSHA Bloodborne Pathogens and Hazard Communications Standards.
Public Law 106-430, Needlestick Safety and Prevention Act
CDC, Morbidity and Mortality Weekly Report Vol 54, No. RR-9, Updated U.S. Public Health Services Guidelines for the Management of Occupational Exposures to HIV and Recommendations for Postexposure Prophylaxis.
CDC, Morbidity and Mortality Weekly Report Vol 50, No. RR-11, Updated U.S. Public Health Services Guidelines for the Management of Occupational Exposures to HBV, HCV, and HIV and Recommendations for Postexposure Prophylaxis.
NIOSH Publication Number 2009-111. Information for Employers Complying with OSHA’s Bloodborne Pathogens Standard.
Washington, WAC 296-823, WAC Bloodborne Pathogens.
California, CCR Title 8, Subchapter 7,GISO 5193. Bloodborne Pathogens.

Appendix A: OSHA Sample Bloodborne Pathogens Exposure Control Plan

This model exposure control plan is adapted from OSHA Publication 3186-06N to meet the requirements of 29 CFR 1910.1030, Bloodborne Pathogens, and can be tailored to be site specific.

Purpose

Provide an explanation for the Exposure Control Plan, as it relates to BBP.

Role and Responsibilities

Personnel with responsibility for oversight or implementation of BBP must be identified here. This list should include the names of specific individuals, job titles, applicable licenses or training certifications, and a summary of their role and area of responsibility.

Definitions

A list of any applicable federal, state, and local regulations must be included here. For example, in the written Exposure Control Plan must include definitions. Included here is a list of definitions commonly referred to in a BBP Program. Additional definitions may be required based on applicable regulations or activities that take place at the site.

Exposure Determination

Summarize the exposure determination at the workplace. This summary can be presented as a table for easy reference. Be sure that the summary allows the reader to easily identify the jobs and tasks that are at risk.

Methods of Control

This section must include the required actions to prevent and control exposure to BBP. Make preparations at your locations to manage all foreseeable circumstances related to BBP. Examples of items that need to be outlined in this section may include:

Universal Precautions - for all employees to follow.

Exposure Control Plan

Engineering Controls

Work Practices

Personal Protective Equipment (PPE)

Housekeeping Laundry.

Labels

Hepatitis B Vaccination

Describe training that will be provided to employees on hepatitis B vaccinations, addressing safety, benefits, efficacy, methods of administration, and availability.

Post Exposure Evaluation

Describe the actions to be taken following any potential exposure incident.

Training

Describe training that will be provided to individuals with occupational exposure to BBP.

Recordkeeping

Describe recordkeeping activities for information related to BBP.

Incident Investigation

Documentation of incident investigations for all accidents, incidents, and near misses that were directly or indirectly related to BBP or OPIM. Incidents inspection must be conducted by trained investigators following defined investigation methodology. Findings from the investigation should summarize the key points and corrective actions those incidents that were directly or indirectly related to BBP exposure.

Appendix B: Warning Labels

All Microsoft employees and external staff must use warning labels with one of the following images affixed to containers, refrigerators, and freezers containing blood or other potentially infectious material or regulated waste:

Bags or containers and rooms storing biological waste must be labeled to indicate where infectious materials may be present. Labels must be fluorescent orange or red universal biohazard symbol, (with lettering or symbols in a contrasting color). If possible, each label should contain the following information:

The name of the infectious agent.
Any special requirements for entering the area (e.g., when access is restricted).
The name and telephone number of the facility's director or other representative.

Post warning signs at the entrance to areas where infectious materials are likely to be present

No labels are required for regulated waste that has been decontaminated.

Appendix C: Declination Statement: Hepatitis B Vaccination Series

I understand that due to my occupational exposure to blood or other potentially infectious materials I may be at risk of acquiring Hepatitis B virus (HBV) infection.

I have been given the opportunity to be immunized with Hepatitis B vaccine, at no charge to myself. However, I decline Hepatitis B vaccination at this time. I understand that by declining this vaccine I continue to be at risk of acquiring Hepatitis B, a serious disease.

If, in the future, I continue to have potential occupational exposure to blood or other potentially infectious materials and I want to be immunized with Hepatitis B vaccine, I can receive the vaccination series at no charge to me.

Printed Name

Signed Date

Witness Date

Appendix D: Post-Exposure Evaluation and Treatment for Microsoft Employees

All medical evaluations and procedures will be performed by or under the supervision of the PLHCP in accordance with the recommendations of the U.S. Public Health Service. All laboratory tests must be conducted by an accredited laboratory.

The post-exposure evaluation and follow-up must consist of the following:

Documentation of route of exposure and circumstances under which it occurred.

Identification, testing, and documentation of source individual if feasible and not prohibited by law. Testing of the source individual is not necessary if the individual is known to be infected with HBV/HIV. Results of source individual testing must be made available to the exposed employee. The exposed employee will be informed of applicable disclosure laws.

Collection and testing of blood. The exposed employee's blood will be collected as soon as possible after consent. If the employee consents to testing of blood, but does not give consent for HIV testing, the blood must be held for 90 days. The employee may elect HIV testing during this time frame.

Post exposure prophylaxis when necessary.

Counseling.

Evaluation of reported illness.

The PLHCP must be provided with the following by the Microsoft OHS:

A copy of this program and the OSHA regulation, 29 CFR 1910.1030, Bloodborne Pathogens.

Description of employee's duties related to the incidents.

Documentation of route of exposure and circumstances under which the exposure occurred.

Results of source individual testing, if available.

All appropriate medical records, including vaccination status (Microsoft OHS maintains this information for company).

The written opinion of the PLHCP must be provided to the employee within 15 working days of the evaluation. The opinion must be limited to the following:

Whether the employee should or has received the HBV vaccination.

That the employee has been informed of the results.

That the employee has been told of any medical conditions resulting from exposure that require further treatment.

Information about HIV and possible vaccines and treatments is changing rapidly, as are regulations regarding responding to an HIV exposure. For the latest information, contact your local public health agency or the infection control unit of a local hospital.

Program name	Bloodborne Pathogens Program
Owners	Microsoft Global Occupational Health and Safety
Revision date	Revision D, September 11, 2025
Effective date	November 29, 2022

Report an injury, illness, or safety observation