• Blood testing must be done with written consent and with regard to the employee’s confidentiality.
• Employers must provide appropriate documentation to the evaluating healthcare provider.
• Employees can decline HIV testing at the time of the blood draw and have at least 90 days to request it after that.

Testing cannot be done in most states without written consent. If consent is not obtained, the employer must show that legally required consent could not be obtained. Where consent is not required by law, the source individual’s blood, if available, should be tested and the results documented.

The employer must have established a system that maintains the confidentiality of the employee's identity and test results. If the employer has contracted with a clinic or other healthcare facility to provide the follow-up programs, the confidentiality requirements must be part of the contract.

In a medical setting, the boundary between employer and healthcare professional may be blurred (e.g., the physician is both the employer and the evaluating healthcare professional, or the employer's certified medical laboratory analyzes the blood). In such cases, consent and confidentiality are especially important. Medical information must be confined to the medical department and not discussed with or revealed to others.

Information is dispersed as follows:

• The employer must provide the following to the healthcare professional(s) responsible for post-exposure incident evaluation and follow-up:
  • A copy of 1910.1030,
  • A description of the exposed employee’s duties as they relate to the incident,
  • Documentation of the incident,
  • The source individual’s test results (if available), and
  • Any relevant employee medical records.
• The employer must provide a copy of 1910.1030 to the healthcare professional who gives the employee’s hepatitis B vaccine.
• The employer does not have the right to know the results of source individual or exposed employee testing.
• The exposed employee should have access to the results of the source individual's testing (in accordance with all applicable medical privacy and confidentiality laws and regulations).
• If the evaluating healthcare professional is also the employer, the information that must go to the healthcare professional must be in the exposed employee's record and made available at the time of a post-exposure incident. All applicable laws and standards of confidentiality apply in this situation.

Human immunodeficiency virus (HIV) testing

Employees have the opportunity for future testing without the need for an immediate decision. Employees involved in an exposure incident have at least 90 days following baseline blood collection to decide if they wish to have their blood tested for HIV. This approach should encourage employees to consent to blood collection at the time of exposure because there’s no pressure for an immediate decision.

To the employee, HIV testing may present risks regarding confidentiality, employment, prejudice, or lack of medical information. Therefore, the 90-day time frame gives the employee the opportunity to learn about the testing and to participate in further discussion, education, or counseling.

If an employee’s blood is not tested for HIV initially, the employer is required to preserve the blood for at least the 90-day period. If post-exposure follow-up is contracted out, the contractor must be informed of the 90-day requirement. If, within 90 days of the exposure incident, the employee agrees to have the baseline sample tested, the testing must be conducted as soon as feasible.