Infection Control: Principles & Best Practices Guide

TL;DR — The Numbers That Define Infection Control

• About 1 in 31 US hospital patients carries at least one healthcare-associated infection on any given day (CDC NHSN, 2026) — the standing reason infection control exists.
• Hand hygiene can prevent up to 50% of avoidable HAIs and returns roughly 16× its implementation cost (WHO, 2009) — the highest-yield single control available.
• Only 4 of 106 countries (3.8%) had all minimum national IPC requirements in place in 2021 (WHO, 2024) — evidence the gap is systemic, not individual.
• C. difficile fell 11% and MRSA bacteraemia 7% in US hospitals between 2023 and 2024 (CDC NHSN, 2026) — real progress, but uneven across infection types.

Infection control is the set of evidence-based practices that prevent pathogens from reaching susceptible people in care settings. It works by breaking the chain of infection — through hand hygiene, PPE, safe handling of equipment and waste, and environmental decontamination — applied as standard precautions for every patient and additional transmission-based precautions when infection is known or suspected.

Medical disclaimer: This article is HSE practitioner reference covering infection prevention principles, exposure control, and regulatory framing. It is not medical or clinical advice. Workers with specific symptoms, exposures, or post-exposure concerns should consult an occupational physician or qualified medical professional, and all clinical decisions should follow current facility protocol.

On any given day, about 1 in 31 US hospital patients has at least one healthcare-associated infection, and among nursing-home residents the figure sits near 1 in 43 (CDC NHSN, 2026). A large share of those infections were preventable, which is the uncomfortable part of the data.

That preventability is what makes infection control a discipline rather than a checklist. This guide organises everything around the chain of infection as its spine, walks the two precaution tiers and the core practice areas, reconciles the four major jurisdictions, and imports the hierarchy of controls — a framing most medical “principles” lists leave out.

What Is Infection Control, and Why Does It Matter?

Infection control is the evidence-based practice of stopping pathogens from reaching susceptible people in any care setting. The terms “infection control” and “infection prevention and control (IPC)” are used interchangeably, and both describe the same goal: interrupting transmission before it produces a healthcare-associated infection.

It is not a hospital-only concern. The same principles apply across the full care spectrum:

• Acute hospitals — the highest-acuity, highest-density exposure environment.
• Long-term and residential care — vulnerable residents, shared living spaces, prolonged contact.
• Dental and ambulatory clinics — invasive procedures with rapid patient turnover.
• Pharmacy and home care — overlooked settings where lapses still seed infections.

The stakes are concrete. CDC’s national survey attributed roughly 687,000 HAIs in US acute-care hospitals in a single year, with about 72,000 of those patients dying during their hospitalisation (CDC, 2015 survey). Most of that burden traces not to exotic events but to routine practice carried out inconsistently.

That points to the most persistent cultural failure I see in IPC: treating infection control as the infection-control nurse’s job rather than a continuous discipline owned by everyone who enters the care environment. Outbreak investigations rarely pin the cause on specialist error; far more often they trace back to ordinary lapses by general staff — a missed hand-hygiene moment, a glove worn too long, a surface wiped without dwell time. The specialist team designs and audits the system, but the system only holds if every person executes it.

The Chain of Infection: The Framework Behind Every Control

Every control in this guide earns its place by breaking one specific link in a six-part chain — that is the logic underneath the entire discipline. Trace any transmission event back far enough and it resolves into the same sequence, and the central principle is simple: remove or neutralise any single link, and infection cannot occur.

1. Infectious agent — the pathogen itself (bacterium, virus, fungus, prion). Example: Clostridioides difficile in a patient on broad-spectrum antibiotics.
2. Reservoir — where it lives and multiplies. Example: a contaminated commode or an infected wound.
3. Portal of exit — how it leaves the reservoir. Example: respiratory droplets on a cough, or faeces.
4. Mode of transmission — how it travels. Example: unwashed hands moving organisms between patients.
5. Portal of entry — how it reaches the next host. Example: a vascular catheter site or mucous membrane.
6. Susceptible host — the person who can be infected. Example: an immunocompromised or post-surgical patient.

Most real-world control combines several link-breaks rather than betting everything on one. No single barrier is perfect — gloves leak, masks slip, surfaces get re-contaminated — so practitioners design layered defences. Hand hygiene and PPE attack the mode of transmission; decontamination removes reservoirs; respiratory and cough hygiene block the portal of exit. The sections that follow are organised exactly this way.

Modes of Transmission You’re Actually Controlling For

The precaution tier you choose depends entirely on how the organism travels — get the route wrong, and the PPE and patient placement are wrong with it. Three routes dominate clinical practice, with vector and common-vehicle spread relevant in specific contexts.

Route	Example organisms	Typical control
Contact (direct/indirect — most common)	MRSA, C. difficile, norovirus	Hand hygiene, gloves and gown, dedicated equipment
Droplet (large respiratory particles, short range)	Influenza, pertussis, Neisseria meningitidis	Surgical mask, eye protection, patient spacing
Airborne (small aerosols, long range, lingering)	Tuberculosis, measles, varicella	Fit-tested respirator, negative-pressure room
Common-vehicle / vector	Contaminated water, food, instruments	Source control, sterilisation, environmental management

There is a live scientific debate here that competitor content tends to ignore. The traditional droplet-versus-airborne split is under active review as aerosol-transmission science has matured since COVID-19, and the CDC’s framework is being re-examined as part of an ongoing guideline revision (CDC/HICPAC, 2024–2025). I treat current guidance as authoritative while flagging that the classification itself is not fully settled.

The recurring failure point is staff treating “droplet” and “airborne” as interchangeable, then mis-selecting protection. That distinction is not academic — it determines whether a surgical mask is adequate or whether a fit-tested N95 (US) or FFP3 (UK) respirator is required. Defaulting to a surgical mask for an airborne pathogen is a genuine exposure, not a paperwork slip.

Standard Precautions: The Baseline for Every Patient, Every Time

Standard precautions apply to every patient, every time, regardless of known or suspected diagnosis — the universal baseline defined in CDC’s two-tier framework (US) and mirrored by NHS England’s Standard Infection Control Precautions. The governing principle is that precautions are set by the task and the anticipated exposure, not by the patient’s label, and that all blood and body fluids are treated as potentially infectious.

The core components are:

• Hand hygiene — the single most effective measure, detailed below.
• PPE selected to the anticipated exposure — gloves, apron/gown, mask or respirator, eye protection.
• Respiratory and cough hygiene — source control at the portal of exit.
• Safe injection practices — one needle, one syringe, one time; no reuse.
• Safe handling of contaminated equipment and linen — prevents reservoirs from migrating.
• Environmental cleaning — high-touch surfaces, with correct disinfectant contact time.
• Sharps safety — engineered devices and proper disposal at the point of use.

Here the terminology genuinely diverges, and conflating the three terms is a common error. OSHA’s “universal precautions” under 29 CFR 1910.1030 (US) address blood and other potentially infectious materials only; CDC’s “standard precautions” are broader and stricter, covering all body fluids, secretions, non-intact skin and mucous membranes; and NHS England’s SICPs (UK) are the equivalent of standard precautions. OSHA explicitly accepts the more stringent standard precautions as compliant, so the practical reading is straightforward — use CDC standard precautions or NHS SICPs as the recommended baseline, and treat OSHA universal precautions as the US legal floor, not the ceiling. CDC’s two tiers of precautions provide the authoritative reference for that framework.

The most common standard-precaution failure I see across audits is using gloves as a substitute for hand hygiene rather than an addition to it. Gloves leak, and removal contaminates the hands almost every time — which is why hand hygiene after glove removal is mandatory, not optional.

Hand Hygiene and the WHO 5 Moments

Hand hygiene is the highest-impact control in the entire discipline, and WHO operationalises it through five indications tied to the patient zone rather than the clock. The WHO 5 Moments for Hand Hygiene are:

1. Before touching a patient — protects the patient from organisms on your hands.
2. Before a clean or aseptic procedure — protects the patient from their own and external flora.
3. After body-fluid exposure risk — protects you and the environment.
4. After touching a patient — protects you and the surroundings.
5. After touching patient surroundings — the moment most often skipped, because no patient contact “felt” like it happened.

Technique and product choice matter as much as timing. Alcohol-based hand rub is faster and more effective for most situations, but it does not kill C. difficile spores — those require soap and water with mechanical washing. The UK adds the “bare below the elbows” principle so wrists and forearms can be cleaned properly, and WHO’s 5 Moments resource remains the primary reference for the framework and its effectiveness data.

One pattern worth naming: self-reported hand-hygiene compliance routinely overstates real performance. Observed compliance is almost always lower than audited self-reports suggest, so facilities should never mistake a high self-audit figure for actual bedside practice.

PPE: Selection, Sequence, and the Doffing Risk

PPE is selected to the anticipated exposure, and its single highest-risk moment is removal, not use. Gloves, aprons or gowns, masks versus respirators, and eye or face protection are each matched to the task — a blood-splash procedure demands eye protection that a routine observation does not.

The sequence is where contamination is won or lost:

• Donning order — hand hygiene, then gown, then mask/respirator, then eye protection, then gloves.
• Doffing order — gloves first, hand hygiene, then eye protection, gown, and finally mask/respirator, with hand hygiene to close.
• The principle — PPE is the last line of defence, not the first, which links directly to the hierarchy of controls later in this guide.

The set-piece error is training teams heavily on donning while under-training doffing — the exact reverse of where the exposure risk actually sits. Self-contamination happens as the gown and gloves come off, when surfaces that touched the patient brush against skin and clothing. If your competency assessments only watch people put PPE on, they are watching the wrong half.

Transmission-Based Precautions: When Standard Isn’t Enough

The most common failure with transmission-based precautions is not choosing the wrong one — it is applying them too late. These are the second tier, layered on top of standard precautions for known or suspected infections, and they never replace the baseline.

Competent-person caveat: Isolation decisions, patient placement, and respiratory-protection requirements are life-critical and facility-policy-dependent. The guidance below is orientation only. Specific precautions must follow your local facility policy, current CDC/national guidance, and a competent person with relevant training and site-specific risk assessment.

Precaution type	Example pathogens	PPE	Patient placement
Contact	MRSA and other MDROs, C. difficile, norovirus	Gloves and gown on room entry	Single room; dedicated equipment
Droplet	Influenza, pertussis, meningococcus	Surgical mask within ~1–2 m; eye protection per task	Single room or cohorting
Airborne	Tuberculosis, measles, varicella	Fit-tested respirator (N95/FFP3)	Airborne infection isolation room (negative pressure)

Two refinements matter in practice. Airborne infection isolation rooms and fit-tested respirators are non-negotiable for true airborne pathogens, and long-term care has added enhanced barrier precautions for residents colonised with MDROs during higher-contact care. The window when transmission is most likely is early — so the operationally correct call is to apply precautions on clinical suspicion, not to wait for laboratory confirmation that arrives a day or two after the exposure has already happened.

Decontamination: Cleaning, Disinfection, and Sterilization

Surfaces and instruments that look clean routinely are not — which is why decontamination is defined by what it removes, not by appearance. The three levels are distinct and not interchangeable.

The three levels

• Cleaning — physical removal of visible soil and organic matter. A prerequisite for everything else, but it kills little on its own.
• Disinfection — destruction of most pathogens on surfaces or semi-critical items, at low or high level depending on the target.
• Sterilisation — destruction of all microbial life, including spores, required for items entering sterile tissue.

The decision tool that ties these to medical devices is the Spaulding classification, set out in CDC’s disinfection and sterilisation guidance (US). The practical reading is that the device’s intended contact with the body dictates the reprocessing level:

Spaulding class	Contact	Required reprocessing
Critical	Enters sterile tissue or the bloodstream (e.g., surgical instruments)	Sterilisation
Semi-critical	Contacts mucous membranes or non-intact skin (e.g., endoscopes)	High-level disinfection
Non-critical	Contacts intact skin only (e.g., blood-pressure cuffs)	Low-level disinfection / cleaning

Environmental cleaning of high-touch surfaces follows the same discipline, using approved disinfectants — EPA-registered products in the US — applied for their full specified contact time. Newer technologies such as UV-C have a role as an adjunct, not a replacement for manual cleaning.

Two fallacies undermine this work repeatedly. The first is “looks clean equals is clean” — visibly clean surfaces still harbour pathogens. The second is the set-and-forget trap, where staff apply a disinfectant and wipe it away before the required dwell time has elapsed, silently nullifying the process. The product was used; the disinfection never actually occurred.

The Hierarchy of Controls Applied to Infection Prevention

OSHA’s bloodborne pathogens standard, 29 CFR 1910.1030 (US), makes engineering controls primary — not optional, and not interchangeable with PPE. Importing the occupational-safety hierarchy of controls into clinical IPC is the framing most medical “principles” lists omit, and it corrects a structural error: it places PPE where it belongs, at the weakest, last-resort tier.

Ranked from strongest to weakest:

• Elimination / substitution — remove the hazard or swap it for a safer alternative, e.g., needleless connectors that remove a sharp entirely.
• Engineering controls — design the exposure out: ventilation, airborne infection isolation rooms, safety-engineered sharps that retract or shield automatically.
• Administrative controls — policies, training, staffing levels, surveillance, and vaccination programmes that change how people work.
• PPE — gloves, gowns, masks, respirators: the final barrier when higher controls cannot fully remove exposure.

The judgment call this framing exposes is uncomfortable for many facilities. They default to the bottom of the hierarchy — buy more PPE — because it is visible, cheap, and quick to deploy, while under-investing in the ventilation, isolation capacity, and administrative systems that prevent exposure upstream. Over-reliance on PPE is a structural weakness dressed up as preparedness, and it is exactly the pattern OSHA’s “engineering controls first” principle exists to counter.

Building an Infection Control Programme: WHO Core Components

In 2021, only 4 of 106 countries (3.8%) had all minimum national IPC requirements in place (WHO, 2024) — proof that infection control fails at the programme level long before it fails at the bedside. WHO’s guidance defines eight core components that every IPC programme should implement, shifting the lens from individual practice to system design.

1. IPC programmes — a structured, resourced programme with clear leadership.
2. Evidence-based guidelines — current, adapted to the setting.
3. Education and training — for all staff, reinforced over time.
4. Surveillance — measuring HAIs to detect outbreaks and trends.
5. Multimodal strategies — bundling interventions rather than relying on one.
6. Monitoring, audit, and feedback — the most powerful behaviour driver in the set.
7. Staffing and bed-occupancy management — overcrowding and understaffing degrade everything else.
8. Built environment and supplies — water, sanitation, ventilation, and equipment availability.

Surveillance and audit-and-feedback are where programmes either improve or stall. Measuring HAIs and feeding results back to the teams who generated them changes behaviour in a way that policy documents alone never do, and the recent US trend data shows what that looks like at scale — C. difficile down 11% and MRSA bacteraemia down 7% between 2023 and 2024, even as SSIs following abdominal hysterectomy rose 8% (CDC NHSN, 2026). Progress is real but uneven, which is exactly why surveillance has to be continuous.

There is also a strategic dimension: IPC is a frontline defence against antimicrobial resistance. Every infection prevented is an antibiotic course never prescribed, which slows the selection pressure driving drug-resistant organisms. WHO’s own assessment, set out in its Global Report on Infection Prevention and Control 2024, is blunt that training remains the weakest core component worldwide — programmes are frequently documented on paper but inconsistently delivered and rarely reinforced.

Legal disclaimer: Regulatory content here reflects general HSE professional understanding of US (OSHA, CDC), UK (NHS/UKHSA), and global (WHO) requirements as of 2026. It is not legal advice. Specific compliance questions, enforcement situations, or prosecution risk should be directed to qualified legal counsel in the applicable jurisdiction. Regulatory content was reviewed as of the last-reviewed date in the byline.

Frequently Asked Questions

Where Infection Control Actually Fails

The pattern across the published record is consistent, and it is not a knowledge problem. Facilities know the precautions; what fails is execution under pressure — the skipped hand-hygiene moment, the glove worn as a substitute for clean hands, the disinfectant wiped away before its dwell time, the isolation applied a day too late. None of those require new science to fix.

If there is one highest-impact change, it is treating infection control as a shared, audited discipline rather than the specialist team’s paperwork. The WHO data makes the case plainly: hand hygiene alone can prevent up to half of avoidable HAIs (WHO, 2009), yet training remains the weakest core component worldwide (WHO, 2024). The controls already exist and are well-evidenced — the work is making them happen every time, by every person, and measuring honestly whether they did.

That is also why the hierarchy of controls belongs in this conversation. As long as facilities reach first for more PPE instead of better ventilation, isolation capacity, and reinforced training, infection control will keep failing in the same predictable ways. The organisations that pull their HAI rates down are the ones that build the system upstream and audit what actually happens at the bedside — not the ones with the fullest glove cupboard.