What are Biological Hazards? Types, Examples and How To Avoid

A biological hazard is any organism, or material from an organism, that can harm human health at work — bacteria, viruses, fungi, parasites, prions, and the toxins and allergens they produce. Under the Control of Substances Hazardous to Health Regulations 2002 (COSHH) the legal term is biological agent, and it covers anything that may cause infection, allergy, toxicity or another hazard to health.

Two things get conflated, and the difference decides everything downstream. The material — blood, sewage, bird droppings, mouldy grain — tells you what is present. The route of entry tells you what control will work. In sixteen years of hygiene work across fourteen countries, almost every failed control I have written up came from getting the second one wrong.

This article covers the UK position first, with the US and EU requirements alongside.

Key takeaways

The six points that decide how this hazard family is assessed and controlled:

• COSHH defines a biological agent as a micro-organism, cell culture, prion or human endoparasite that may cause infection, allergy or toxicity — so mould spores and organic dust count, not only pathogens.
• UK and EU law classifies agents into hazard groups 1 to 4 by their ability to infect a healthy adult; the ACDP Approved List is not exhaustive, and an unlisted agent is not automatically Group 1.
• The US has no general biological agents standard. 29 CFR 1910.1030 covers bloodborne pathogens; everything else falls to the General Duty Clause.
• There is no workplace exposure limit for a bacterium, virus or mould spore, so control is verified by the performance of the control, not by a number on a certificate.
• Route of entry — inhalation, inoculation, ingestion, mucous membrane — determines which control does the work. Sorting hazards by material alone produces PPE-led risk assessments that fail.
• Under RIDDOR regulation 9, any disease attributed to occupational exposure to a biological agent is reportable in Great Britain.

House style for all graphics below: Technical line illustration, muted industrial palette with a single accent colour, clean sans-serif labels, red reserved for hazards and failure states. No photorealism, no depicted injuries, no identifiable people.

What counts as a biological hazard under the law

The COSHH definition is broader than most people expect, and the breadth is the useful part. A biological agent is a micro-organism, cell culture, prion or human endoparasite — genetically modified or not — that may cause infection, allergy, toxicity, or otherwise create a hazard to human health.

Read those four harm mechanisms again. Only the first involves catching something. The other three explain the rest of the caseload. A baker with occupational asthma, a compost worker with hypersensitivity pneumonitis and a grain handler with an endotoxin response all sit inside the same regulatory frame as a laboratory technician handling Salmonella.

That matters because risk assessments written around infection alone miss the sensitisers entirely. Allergy has no infectious dose to reason about, and sensitisation is usually irreversible: once a worker reacts to flour dust or fungal spores, the exposure that used to be tolerable no longer is.

The four mechanisms and where each one shows up:

Three consequences follow from the wording of the definition, and they are worth writing into the assessment:

• Dead organisms still count — endotoxin and mycotoxins survive the agent that produced them, so disinfection does not close the hazard
• Sensitisation has no threshold to work back from — once a worker reacts, the previously tolerable exposure is no longer tolerable for them
• Genetically modified organisms are inside COSHH — and also carry separate duties under the contained use regulations

How biological agents are classified: hazard groups 1 to 4

In Great Britain and across the EU, biological agents are classified into four hazard groups. The classification turns on four questions: how likely the agent is to infect a healthy adult, how severe the resulting disease is, whether it can spread to the community, and whether effective prophylaxis or treatment exists. The classification is set out in the Approved List of Biological Agents, prepared by the Advisory Committee on Dangerous Pathogens.

The EU works the same way. Directive 2000/54/EC uses four risk groups, with the list at Annex III; that list was updated by Directive (EU) 2019/1833 and again by Directive (EU) 2020/739, which added SARS-CoV-2 as a group 3 agent.

Two traps here, and I have watched both catch competent teams. The Approved List is not exhaustive — an agent that is absent from it must be classified by assessment, not defaulted to Group 1. And where there is genuine doubt between two groups, the agent goes into the higher one.

The practical checks that keep a classification defensible:

• Classify by assessment where the agent is unlisted, and record the reasoning
• Assign the higher group where two are arguable, rather than the convenient one
• Treat Group 1 as "low hazard", never as "no hazard" — concentration and route still apply
• Revisit the classification when the process changes, particularly where a step concentrates the agent
• Check the current edition of the Approved List rather than a copy saved in a shared drive

Types of biological hazards, with the examples that go with them

Most articles on this topic list ten categories of biohazardous material. That list is useful for spotting hazards on a walk round, so it is worth having — but it describes what is in the bin, not what reaches the worker.

Living agents

These are the organisms themselves. Bacteria — Legionella, Leptospira, Salmonella, Mycobacterium tuberculosis. Viruses — hepatitis B and C, HIV, influenza, SARS-CoV-2, hantavirus. Fungi — Aspergillus fumigatus in compost and damp buildings, dermatophytes. Parasites — Cryptosporidium, Giardia, hookworm in contaminated soil. Prions, which sit apart because normal decontamination assumptions do not hold.

Biological materials and by-products

The category that catches people out, because nothing here is alive. Endotoxin from Gram-negative bacterial cell walls survives the death of the organism. Mycotoxins persist in mouldy grain. Animal and plant proteins sensitise. Insect venoms cause anaphylaxis in workers with no prior reaction history.

Contaminated materials

The visible ones: blood and other potentially infectious materials, sharps, human and animal waste, sewage and wastewater, clinical and laboratory waste, organic dust, compost, and stagnant water in engineered systems.

The material categories a walkthrough should look for:

• Sharps and clinical waste — needles, lancets, broken glass, laboratory disposables
• Blood and body fluids, including dried residues on equipment and surfaces
• Sewage, wastewater and drain systems, including flood-damaged areas
• Animal waste, bedding, carcasses and bird or rodent droppings in voids and roof spaces
• Organic dusts — flour, grain, wood, compost, animal feed, textile fibres
• Mould growth and damp materials, particularly after a water ingress event
• Aerosol-generating water systems — cooling towers, showers, spa pools, humidifiers, washers
• Biting and stinging animals for outdoor and field work

Route of entry decides the control

Here is the reframe that changes risk assessments. Sort your biological hazards by how the agent gets into the body, and the control selects itself. Sort them by material, and you end up issuing gloves for an inhalation hazard.

There are four routes that matter at work, plus vectors. Inhalation of aerosols, droplets and dusts. Inoculation through the skin — sharps, bites, cuts, animal scratches. Ingestion, almost always hand-to-mouth. Mucous membrane contact from splashes to eyes, nose and mouth. Vector-borne transmission through ticks and mosquitoes matters for outdoor and overseas work.

Aerosol generation is the step people skip. A task does not have to look dusty to be an inhalation hazard. High-pressure washing a drain, opening a filter press, dropping a bag of feed, running a shower that stood unused for a fortnight — all of them put respirable material into the air.

COSHH regulation 7 makes some of this explicit. Where there is a risk of contamination by biological agents, employers must provide appropriate washing and toilet facilities. They must also, where appropriate, prohibit eating, drinking, smoking and applying cosmetics in the working area. Those are not housekeeping niceties. They are the named controls for the ingestion route.

Work through these questions in order when you assess a task:

1. Which agents could reasonably be present, and at what hazard group?
2. Which step of the task moves the agent — aerosolises it, splashes it, or puts a sharp in a hand?
3. Can that step be enclosed, wetted, automated or removed?
4. If not, what engineering control captures it at source, and how will capture be proved?
5. What remains for the worker, and does the PPE selected match the route rather than the material?
6. What happens when the control fails mid-task — who stops the job, and how?

Where biological hazards actually turn up, sector by sector

Healthcare and laboratories are the obvious settings, and they are well regulated. The exposures that get missed sit in sectors where nobody thinks of themselves as working with biology — maintenance, refurbishment, waste, water, grounds.

Sharps injuries give the scale of the healthcare problem. The CDC estimates around 385,000 needlestick and other sharps injuries among hospital-based healthcare personnel each year in the United States, and those injuries have been implicated in transmission of more than 20 pathogens.

Refurbishment deserves its own line. A building that has sat empty has a water system growing biofilm at room temperature, and the first person to run a shower head takes the aerosol. HSE puts the growth range for legionella at 20–45 °C, which describes the standing pipework in most partly occupied buildings in summer.

The activities I would flag on any site that does not consider itself a biological hazard employer:

• Recommissioning water systems, showers or humidifiers after a shutdown or a partial occupancy period
• Drain jetting, gully cleaning and any work in or near flooded ground
• Soft strip, loft and void work in buildings with bird or rodent occupation
• Handling or shredding waste, and cleaning the cabs and filters of the plant that does it
• Moving dry organic materials — grain, feed, flour, compost, wood chip

What the law requires in the UK, the US and the EU

The three systems agree on the principle and diverge sharply on the mechanism. Get this wrong on a multinational site and you end up applying a US standard that does not exist in UK law, or assuming a UK duty covers a US contractor.

United Kingdom

COSHH is the primary instrument. Regulation 6 requires a suitable and sufficient assessment before the work starts. Regulation 7 requires prevention or adequate control. Regulation 7(10) then brings in Schedule 3, which adds four specific duties for work with biological agents. Special control measures for laboratories, animal rooms and industrial processes. A list of employees exposed to Group 3 and 4 agents, kept for at least 40 years after last known exposure. Notification to HSE of the first use of Group 2, 3 and 4 agents at a premises. And the biohazard sign.

Deliberate work with Group 3 agents, and with the Group 2 agents named in Part V of Schedule 3, requires notification to HSE and consent before work begins. Legionella is handled through ACOP L8 and the three parts of HSG274, with Part 1 revised in 2024. Reporting sits under RIDDOR. Regulation 9 covers any disease attributed to occupational exposure to a biological agent. Schedule 2 covers the dangerous occurrence — an incident that released, or could have released, an agent likely to cause severe human illness.

United States

There is no general biological agents standard. The Bloodborne Pathogens standard, 29 CFR 1910.1030, applies where workers have reasonably anticipated contact with blood or other potentially infectious materials. It requires a written exposure control plan, reviewed annually. It also requires hepatitis B vaccination offered at no cost within 10 working days of initial assignment, engineered sharps protections, universal precautions, post-exposure evaluation, training at initial assignment and at least annually, and a sharps injury log.

Everything outside that — mould, legionella, zoonoses, compost bioaerosols — falls to Section 5(a)(1), the General Duty Clause, supported by the respiratory protection standard 29 CFR 1910.134 and the PPE hazard assessment at 29 CFR 1910.132. Note also that the Bloodborne Pathogens standard does not extend to construction, though the General Duty Clause does.

European Union

Directive 2000/54/EC is the seventh individual directive under the framework directive, and it sets the minimum. Classification into four risk groups, risk assessment, prevention and reduction of exposure, containment by group, worker information and training, record-keeping, and arrangements for health surveillance. Member States implement it nationally — Ireland, for instance, through the Safety, Health and Welfare at Work (Biological Agents) Regulations 2013 and 2020.

The differences that most often catch a multinational programme out:

• The US has no classification system for biological agents in law, so hazard-group language on a US site carries no regulatory weight
• The UK has no annual review duty equivalent to the US exposure control plan review, which makes UK documents drift
• Only the UK and EU require regulator notification before certain work begins
• Disease reporting thresholds differ, so the same case may be reportable in Great Britain and merely recordable in the US

⚖️ Jurisdiction note: A US site working to a compliant bloodborne pathogens programme may still have no assessment at all for legionella or bioaerosols. A UK site working to COSHH may have no equivalent of the annual exposure control plan review. Bridging documents on multinational sites should name both gaps explicitly.

Assessing exposure when there is no exposure limit

This is where biological hazards part company with the rest of occupational hygiene, and where most programmes I audit are quietly weakest. For chemicals I can sample a shift, compare the result against EH40 or a PEL, and argue about compliance with a number in front of me. There is no workplace exposure limit for a bacterium, a virus or a mould spore. EH40 sets limits for organic dusts such as flour, grain and wood dust, but those are dust limits, not microbial ones.

Sampling still has a role. Endotoxin, culturable fungi and total bioaerosol counts can all be measured, and a comparative survey — inside the cab versus outside, before a control versus after — tells you a great deal. What it cannot tell you is whether the result is legally acceptable, because no such benchmark exists.

So the assessment shifts from measuring the agent to verifying the control. As LEV Capture Advisor at HSL Buxton Partners, most of my work was demonstrating that a hood actually captured at source, rather than trusting the design drawing. Biological hazards are where that discipline earns its keep. The control performance is the evidence.

The verification checks I ask for on a biological hazard audit:

• A dated LEV thorough examination and test, plus an in-service capture check at the actual work position
• Fit test records naming make, model, type and size, matched against the RPE the worker is holding
• Water system temperature records taken at sentinel outlets, with the dates the outlets were last used
• Cleaning method statements that specify wet methods or vacuum with filtration, never dry sweeping
• Evidence that a control was checked during the task, not only before it

How to control biological hazards: the hierarchy applied

The hierarchy of control works here as it does everywhere, but the examples are less familiar and the last two levels get over-used. Elimination and substitution are available more often than people assume. An attenuated strain instead of a wild type. A closed sampling system instead of an open one. A safer-sharps device instead of a conventional needle, and a mechanical grab instead of a hand in the waste stream.

Engineering controls do the heavy work. Containment appropriate to the hazard group. Local exhaust ventilation at the point of aerosol generation. Water system design that keeps hot water hot, keeps cold water cold, and removes dead legs. Sharps containers within arm's reach of the task.

Administrative controls carry the routes that engineering cannot reach. Safe systems of work, restricted access, cleaning and decontamination regimes, welfare facilities at the boundary between dirty and clean, immunisation programmes where an effective vaccine exists, and health surveillance where sensitisation or infection is foreseeable.

PPE is last, and RPE is the piece most often mishandled. In respirator programme work I have seen tight-fitting facepieces selected on catalogue protection factors and never fit tested to a single wearer. HSE guidance INDG479, revised in October 2025, is clear that a fit test belongs at the selection stage and must be repeated whenever the type, size, model or material changes, or the wearer does.

Before signing off a control set, check it against these five tests:

1. Does the top control act on the source, or only on the worker?
2. Has anyone proved the engineering control works at the work position, not at commissioning?
3. Does the PPE match the route, or the material?
4. If the control fails mid-task, does the work stop — and does the person doing it know that?
5. Is the control still there on nights, at weekends, and when a contractor does the job?

⚠️ Safety critical: Vaccination is a backstop, not a control. Offering hepatitis B vaccination does not discharge the duty to remove the sharps hazard, and an immunised worker is still a worker being exposed.

What fails on site: the findings I write up most often

Programmes rarely fail on paper. They fail at the point where the written control meets a night shift, a contractor, or a task nobody assessed. These are the recurring gaps across 180-plus workplace visits.

RPE issued but never fit tested. The most common single finding in my respiratory work. A box of FFP3 masks arrives, gets handed out, and nobody records a make, model or size. Half the wearers cannot achieve a seal, and nobody knows which half.

Water systems with a written scheme and no use pattern. Temperature records exist for sentinel outlets. Nothing records which outlets sat unused for six weeks, which is where the risk actually accumulated.

Sharps containers sited for the cleaner, not the clinician. If the container is across the room, the needle travels. Containers also get filled past the line because replacing them is somebody else's job. Both are regulated points in the US: 29 CFR 1910.1030(d)(4)(iii)(A)(2) requires sharps containers to be located as close as feasible to the area of use, kept upright, and not allowed to overfill.

Dry sweeping in dusty biological environments. Brooms in a compost hall or an animal house resuspend everything that had settled. The task looks like housekeeping and behaves like an exposure event.

Welfare that defeats the ingestion control. Handwash basins in the wrong place, no hot water, or a route from dirty to clean that passes the tea point. The control was written; the layout cancelled it.

Contractors outside the assessment. The drainage crew, the roofer in the pigeon-fouled void, the fabric maintenance team recommissioning a shower — all doing the highest-exposure tasks on site, none named in the client's biological risk assessment.

The five questions I ask first on a biological hazard audit:

1. Show me the fit test record for the mask this worker is wearing right now
2. Which outlets on this water system were last used, and when?
3. Where is the nearest sharps container to the task I just watched?
4. How is this area cleaned, and with what equipment?
5. Which contractor tasks are inside this assessment, and who told them?

Competence, training and health surveillance

Training for biological hazards has to be specific to the agent and the route, and generic biohazard awareness rarely changes behaviour. A waste operative needs to know why the cab filter matters; a maintenance fitter needs to know why a shower head is different from a tap; a nurse needs the device, not a slide about pathogens.

Health surveillance is the piece most often absent outside healthcare. Where sensitisation is foreseeable — bakeries, animal units, composting — a respiratory questionnaire and lung function baseline give you the early signal that a control is failing while the worker is still employable in that role. Where Group 3 or 4 agents are handled deliberately, COSHH Schedule 3 requires the exposure list to be kept for at least 40 years after last known exposure. That retention period tells you how long the latency can be.

What competence looks like in practice for this hazard family:

• Fit testers — accredited or demonstrably competent, testing the actual make, model, type and size in use
• Legionella responsible person — named, with a deputy, and able to explain the written scheme without reading it
• Biological risk assessors — able to classify an unlisted agent by assessment and justify the group chosen
• Supervisors — able to stop a task when a control fails mid-job, and clear that they are expected to
• Occupational health provider — briefed on the actual agents and sensitisers present, not a generic package

✅ Auditor's tip: Ask a supervisor what would make them stop a task on biological grounds. If the answer is a visible spill and nothing else, the aerosol and sensitisation routes have not landed in training.

Frequently asked questions

These are the questions that come up most often when a site starts writing its first biological risk assessment.

What are the four main types of biological hazards?

Most classifications group them as bacteria, viruses, fungi and parasites, with prions and biological toxins usually added. A more useful split for control is living agents, biological by-products such as endotoxin and allergenic proteins, and contaminated materials such as sharps, sewage and organic dust.

Biological hazard vs biological agent: what is the difference?

"Biological hazard" is the everyday term for anything biological that can harm health. "Biological agent" is the legal term under COSHH, covering a micro-organism, cell culture, prion or human endoparasite that may cause infection, allergy, toxicity or another hazard to health. Regulatory duties attach to the legal term.

Is mould a biological hazard at work?

Yes. Mould causes harm through allergy and toxicity as well as infection, which places it inside the COSHH definition. Damp buildings, compost, mouldy grain and water-damaged materials are the usual sources, and inhalation of spores and fragments is the route that matters.

Which industries have the highest biological hazard risk?

Healthcare, laboratories, agriculture and veterinary work, waste and recycling, water and wastewater, and food manufacturing. Construction and building maintenance belong on the list too, because refurbishment disturbs bird droppings, mould and stagnant water systems that nobody has assessed.

What PPE protects against biological hazards?

It depends entirely on the route. Inhalation needs adequate RPE with a valid face fit test. Inoculation needs cut-resistant or puncture-resistant protection and safer-sharps devices. Splash risk needs eye or face protection. Gloves alone protect against contact only, which is why material-led assessments under-protect.

Do I have to report a biological exposure at work?

In Great Britain, RIDDOR regulation 9 requires reporting of any disease attributed to occupational exposure to a biological agent. Schedule 2 separately covers dangerous occurrences involving the release, or potential release, of an agent likely to cause severe illness. In the US, recording follows 29 CFR 1904.

How do hazard groups relate to biosafety levels?

Closely, but they are not the same thing. Hazard group describes the agent; containment or biosafety level describes the facility and practices used to work with it. In UK law the hazard group drives the containment level required by COSHH Schedule 3, though a risk assessment can require more.

Conclusion: where to start on Monday

If you take one structural change from this article, sort your biological hazards by route of entry rather than by material. That single move exposes the inhalation risks hiding inside tasks nobody thought were dusty, and it stops gloves being issued as the answer to an aerosol.

Then check three things you can check this week. Pull the fit test record for one worker wearing a tight-fitting mask. Find out which outlets on your water system have not been used for a month. And ask which contractor tasks sit inside your biological risk assessment.

Where the work involves deliberate use of Group 2, 3 or 4 agents, or a complex water system, get a competent occupational hygienist or water safety specialist involved. The assessment is not the sort of thing to complete from a template.

About the author — Sophia Bennett

Sophia Bennett is a British Occupational Hygiene & Exposure Control Consultant with 16 years of continuous field experience across 14 countries, covering chemical exposure assessment, dust and bioaerosol control, local exhaust ventilation, and respirator programmes. Her focus is practical assurance — checking that controls still work where work actually happens, including on night shifts and under contractor pressure. She leads Bennett Occupational Hygiene Partners in Manchester, following senior roles with IOM Consulting, HSL Buxton Partners, Casella Measurement, TSI Incorporated Hygiene, SKC Ltd and Dräger Safety Hygiene.

Credentials: NEBOSH International General Certificate · ISO 45001 Lead Auditor · ISO 14001 Internal Auditor · IOSH Managing Safely · Incident Investigation (ICAM pathway)

Sources and further reading

• HSE — The law on biological agents (COSHH and biosafety)
• HSE — Safe deliberate work with biological agents
• ACDP / HSE — The Approved List of Biological Agents
• legislation.gov.uk — COSHH Regulations 2002, regulation 7 and Schedule 3 contents
• HSE — RIDDOR: exposure to carcinogens, mutagens and biological agents
• HSE — Legionnaires' disease: what you must do and ACOP L8
• HSE — Guidance on RPE fit testing, INDG479
• OSHA — Bloodborne pathogens standard, 29 CFR 1910.1030 and standards overview
• CDC — Sharps safety programme resources
• EU-OSHA — Directive 2000/54/EC on biological agents at work
• EUR-Lex — Summary: protection of workers from exposure to biological agents