Respiratory Infections at Work: Prevention & Controls

TL;DR

• Design around transmission route, not the pathogen — controls that dilute and filter shared air work against influenza, COVID-19, and RSV alike.
• Put engineering controls before masks — ventilation, filtration, and clean-air targets cut exposure for everyone in the room, not one wearer.
• Make sick leave non-punitive — presenteeism is a transmission driver; a punitive policy quietly defeats every other control.
• Layer the controls — no single measure is enough; combined defenses cover each other’s gaps.
• Know your reporting threshold — most workplace infections aren’t individually reportable to OSHA or HSE; occupational attribution is the test.

Prevent respiratory infections at work by applying the hierarchy of controls in order: eliminate exposure where possible, then prioritize engineering controls like ventilation and filtration, followed by administrative measures such as non-punitive sick leave, and finally respiratory protection. No single control is enough — layering them gives the strongest, most reliable protection.

Seasonal influenza alone is estimated to cost US workplaces around 17 million lost workdays each year among working-age adults aged 18–64 (US CDC, Workplace Health Promotion; figures drawn from older modeling and directional rather than current-season). Behind that number sit shifts left uncovered, deadlines missed, and — in higher-risk settings — onward infection of colleagues who never chose the exposure.

Respiratory infections at work are not an HR inconvenience; they are an occupational hazard with controls, duties, and in some settings reporting obligations attached. This guide sets out a single prevention approach that holds whether you operate under OSHA in the US or the HSE in the UK: how the agents spread, how to rank controls, how to build a written plan, and where the genuinely hard question — is this case reportable? — actually lands.

What Counts as a Respiratory Infection at Work?

A workplace respiratory infection is any infection of the airways — viral or bacterial — that a worker can acquire or pass on through the shared conditions of the job. What matters for control is not the pathogen’s name but how it travels.

The common agents split into two groups. Viral spread dominates the everyday picture: influenza, COVID-19, and RSV. Bacterial agents matter in specific settings — tuberculosis, pertussis (whooping cough), and Legionnaires’ disease, which behaves unlike the rest.

There’s a second distinction that drives everything in the legal section later: infection acquired through the work versus infection that simply happened to a worker who caught it in the community. Most workplace cases are the latter.

Agent (example)	Primary transmission route	What that route demands
Influenza, COVID-19, RSV	Droplet plus short- and long-range aerosol	Air dilution, filtration, distancing
Tuberculosis	Long-range airborne aerosol	High clean-air rates, fit-tested respirators
Pertussis	Droplet, close contact	Distancing, source control, case exclusion
Legionnaires’ disease	Inhaled water aerosol (not person-to-person)	Water-system control, not room ventilation

Legionnaires’ is the outlier worth flagging early. It comes from water systems — cooling towers, hot/cold water, spa pools — not from person-to-person spread, so it is an engineering-and-maintenance problem, not a ventilation-and-distancing one. Lumping it in with viral spread is a category error.

The framing error I see most often in the published record is teams designing controls around a named virus — a “COVID plan,” a “flu plan” — rather than around transmission route. That leaves them unprepared when the next agent arrives, because the documentation describes a pathogen instead of a mechanism. Controls should be route-based and pathogen-agnostic.

Who Is Most at Risk? Occupational Exposure Profiles

Risk is not spread evenly across jobs, and treating it as if it were is the most common planning gap I see. Exposure rises with the closeness, duration, and frequency of contact with people who may be infectious — which sorts workplaces into tiers.

• High-risk tier — healthcare, social care, laboratories, mortuary and medical-waste handling. Sustained close contact with known or likely cases, often during procedures that generate aerosols.
• Elevated tier — education, retail, transport, hospitality, and other congregate or shared-indoor settings. Frequent incidental contact with the public in spaces that fill and empty all day.
• Lower-risk tier — remote, outdoor, or low-occupancy roles. Brief or infrequent shared-air exposure, where lighter controls are defensible.

The tool that assigns a worksite its tier is the hazard assessment, not a manager’s gut feeling. It looks at who is in the space, for how long, in what air, and near whom — then sets the control intensity to match.

A pattern worth naming: non-healthcare employers often assume infection control “doesn’t apply to us” and skip the hazard assessment entirely. That is the single most common reason a workplace ends up with no defensible control rationale — not because its controls were wrong, but because it never documented why it chose them.

How Respiratory Infections Spread Indoors at Work

Indoors, the dominant route for influenza, COVID-19, and RSV is airborne — fine aerosols that linger and travel on room air, not just large droplets that fall within a metre. That single fact reorders the whole control strategy.

Before 2020, much guidance leaned on the droplet-and-surface model: stay a fixed distance apart, wipe things down. The scientific consensus shifted toward recognizing long-range aerosol transmission, and the operational consequence was concrete — what you do to the air in a room started to matter more than what you do to its surfaces.

Three levers control airborne exposure indoors:

1. Distance — the concentration of infectious aerosol falls as you move away from the source, but in a closed room it never reaches zero.
2. Time — exposure accumulates with the minutes spent sharing unfiltered air; short and spaced-out beats long and packed.
3. Air volume and exchange — the more clean or filtered air moving through the space, the faster infectious aerosol is diluted away.

The failure mode to watch for is “hygiene theater” — heavy investment in surface disinfection while ventilation goes unaddressed. It is visible, reassuring, and largely misallocated for an airborne hazard. The evidence moved years ago; plenty of cleaning budgets did not.

Applying the Hierarchy of Controls to Respiratory Infections

Both OSHA and the HSE rank infection controls from most to least effective, and both stress the same design principle: layer them. No single measure — not even a respirator — is sufficient on its own, which is why PPE sits at the bottom of the stack, not the top.

Applied to infection, the hierarchy runs from elimination and substitution (remote work, telehealth, keeping infectious people out of the building), through engineering controls (the air), to administrative controls and safe work practices, and finally to respiratory protection. The layered, or “Swiss cheese,” logic is the point: each layer has holes, and you stack them so the holes don’t line up. Control intensity scales with the hazard assessment and the level of community transmission — you tighten as the picture worsens. OSHA’s control and prevention guidance for common respiratory illnesses frames employer expectations the same way.

The judgment call employers get wrong is treating the hierarchy as a menu — pick one item — rather than a stack to combine. Left to cost alone, the default is the cheapest, least effective options: signage and a box of masks, while engineering controls go untouched. That inverts the entire model.

Engineering Controls: Ventilation, Filtration, and UVGI

Engineering controls reduce the infectious dose in shared air before anyone has to remember a rule — which is why they carry the most weight for airborne agents. CDC/NIOSH’s workplace resources on respiratory infections sit behind much of the practical guidance here.

• Ventilation — bring in and distribute outdoor air; the baseline engineering lever for airborne agents.
• Filtration — MERV-A 11 or better is the minimum prerequisite under ASHRAE Standard 241-2023; portable HEPA cleaners retrofit spaces that can’t be re-ducted.
• Air cleaning — upper-room germicidal UV (UVGI) supplements ventilation in high-occupancy or high-risk rooms.
• Equivalent clean airflow — ASHRAE 241-2023 combines ventilation, filtration, and air cleaning into one target per person, turning vague “improve ventilation” into a number you can design to.

That last point is the real shift. ASHRAE Standard 241-2023, Control of Infectious Aerosols, was the first standard to define minimum equivalent clean airflow per person and an Infection Risk Management Mode for buildings (ASHRAE, 2023) — moving ventilation from advisory to specifiable. For a competent person, it converts “we improved airflow” into a defensible, measurable target.

Administrative Controls and Safe Work Practices

Administrative controls change what people do and when — and for an airborne hazard, the highest-impact one is the policy that lets a sick worker stay home without penalty. Ranked honestly:

1. Non-punitive sick leave and clear stay-at-home triggers — removes infectious people from shared air; the single most underrated control on most sites.
2. Occupancy limits, scheduling, and remote-work flexibility — cut the number of people sharing air at once.
3. Respiratory etiquette and source-control masking — used more intensively during higher community transmission.
4. Hand hygiene and routine cleaning — genuinely useful against contact spread, but secondary for predominantly airborne agents.

That ranking is deliberate. Presenteeism — people coming in sick because they can’t afford not to — is a transmission driver, not just an HR problem. A punitive or unpaid sick-leave policy silently undermines every engineering pound or dollar spent upstream. Hand hygiene matters, but weighting it as the headline defense against an airborne virus is a hangover from the droplet-and-surface era.

Respiratory Protection and PPE

PPE is the last line, and it splits into two jobs managers routinely confuse: source control (any mask, worn by the possibly-infectious to protect others) and respiratory protection (a fit-tested respirator that protects the wearer). They follow different rules.

Class	Standard / approval	Jurisdiction	Typical role
N95	NIOSH (42 CFR 84)	US	Respiratory protection (fit-tested)
KN95	GB 2626	China	Source control; not NIOSH-approved
KF94	KMFDS	South Korea	Source control; not NIOSH-approved
FFP2	EN 149	EU / UK	Respiratory protection (~N95-class)
FFP3	EN 149	EU / UK	Higher protection (~N99-class)

Equivalence across these is not automatic. They are tested to different national standards, so the safe rule is to default to the locally approved class — NIOSH-approved in the US, EN/UKCA-marked in the UK and EU — and treat FFP3 as the higher-protection reference (roughly N99-class) where elevated protection is needed.

Where respirators are required rather than worn voluntarily, 29 CFR 1910.134 (US) obliges the employer to run a written respiratory protection program — hazard evaluation, respirator selection, medical evaluation, and fit testing — before anyone relies on the device. The UK reaches the same place through COSHH duties and tight-fitting-respirator fit testing. OSHA’s own Respiratory Protection Standard, 29 CFR 1910.134 is the controlling text on the US side.

Worth tracking: OSHA opened a Notice of Proposed Rulemaking on 1 July 2025 to amend the medical-evaluation requirements in 1910.134 for certain respirator types, with the comment period extended to 1 November 2025 (Federal Register / OSHA, Docket OSHA-2025-0006, 2025). If your program leans on respirators, that is live movement on your obligations.

The misconception that does the most quiet damage: managers who “provide masks” believing they have supplied respiratory protection. An unfitted surgical mask is source control at best — it does not protect the wearer to any respirator standard, and a respirator that hasn’t been fit-tested leaks.

Building a Respiratory Infection Prevention Plan

A prevention plan is only as good as its sequence: assess first, select controls from what the assessment shows, write it down, bring workers in, and build in triggers to tighten or relax controls as conditions change. The order is what competitors describe abstractly but rarely lay out.

1. Hazard assessment — identify exposure tier, settings, and at-risk groups. This output drives every decision that follows.
2. Control selection — choose layered, engineering-first controls proportionate to the assessment, not to budget convenience.
3. Written plan — document the controls, who owns each, and the trigger conditions for escalation.
4. Worker engagement and training — involve workers and safety representatives early; engagement measurably improves compliance, a documented effect rather than a platitude.
5. Outbreak / escalation response — define an “infection risk management mode” that tightens controls when community or workplace transmission rises (the concept ASHRAE 241-2023 formalises for ventilation).
6. Review — revisit on a fixed schedule and after any outbreak, updating for new guidance and new data.

The failure mode here is set-and-forget: a plan written once during a single outbreak, then left to gather dust. Contrast that with a plan carrying explicit trigger conditions for both escalating and de-escalating controls — the difference between a document and a working system. Steps 5 and 6 are where most plans quietly die.

Legal Duties and Reporting: OSHA vs HSE

Here is the part most guidance skips: a respiratory infection caught at work is usually not individually reportable to either OSHA or the HSE. The test in both systems is occupational attribution — reasonable evidence the work caused it — not the mere presence of illness.

Regulatory content here reflects a general HSE professional’s understanding of US (OSHA) and UK (HSE) requirements as of 2025. It is not legal advice. Specific compliance questions, enforcement situations, or reporting decisions should be directed to your regulator and to qualified legal counsel in the applicable jurisdiction.

	United States (OSHA)	United Kingdom (HSE)
Core duty	General Duty Clause, OSH Act §5(a)(1) — furnish a workplace free of recognized hazards	COSHH (2002, as amended) — assess and control exposure to biological agents
Dedicated infectious-disease standard	None finalized; long-pending rulemaking	None specific; COSHH framework applies
Key supporting standards	1910.134 (respiratory protection), 1910.132 (PPE), 1910.1030 (bloodborne, where relevant)	COSHH biological-agents provisions
Reporting / recording	29 CFR 1904 — record only work-related cases meeting criteria	RIDDOR Regulation 9 — report only where occupational exposure is the likely cause
Routine community-acquired case	Generally not recordable	Generally not reportable

The mechanics differ but the logic converges. In the US, a case becomes recordable under 29 CFR 1904 only when it is work-related per the standard’s criteria. In the UK, RIDDOR Regulation 9 (2013) requires a report only where there is reasonable evidence that occupational exposure to a biological agent was the likely cause — general workplace transmission does not meet that bar. The HSE’s guidance on reporting disease from biological-agent exposure is the reference point for the UK threshold.

Where occupational attribution is most plausible is in the high-risk tier — health and social care, laboratories — where a worker is exposed to known cases as part of the job. That is precisely where reporting becomes a live question.

The reflex I’d warn against is over-reporting: filing a RIDDOR report or recording a case for every workplace flu “to be safe.” Over-reporting and under-reporting are both compliance failures. The threshold is occupational attribution, not the presence of illness — and a side-by-side reading of OSHA recordability against RIDDOR Regulation 9 makes that easier to apply than either page does alone. Never state a universal reportability rule; check the specific case against the specific standard.

Vaccination, Health Support, and At-Risk Workers

Vaccination is a valuable supporting control — it reduces severity and onward transmission — but it sits as one layer among many, not as a substitute for ventilation and sick-leave policy.

This section is for HSE practitioner reference and is not medical advice. Decisions about vaccination, fitness for work, or accommodations for an individual worker should involve an occupational-health professional or the worker’s own clinician.

• Encourage, rarely mandate — facilitate access through on-site clinics or paid time to vaccinate. Mandates raise exemption, accommodation, and employment-law questions that vary by jurisdiction and are best taken to counsel.
• Accommodate higher-risk workers — adjust tasks, location, scheduling, or controls for those at greater risk of severe outcomes, in line with occupational-health advice.
• Route individual decisions to occupational health — specific symptoms, exposure concerns, and fitness-for-work belong with a clinician, not a policy document.

The misconception to correct is treating vaccination as the primary control. It earns its place — it lowers both severity and transmission — but a workplace that leans on vaccination while leaving ventilation poor and sick leave punitive has only one thin layer doing the work of several. Competent persons building these plans typically work from recognized training pathways — NEBOSH, IOSH, or OSHA outreach — which place vaccination where it belongs in the stack.

Frequently Asked Questions

Conclusion

The industry’s recurring mistake with respiratory infections at work is building controls around last season’s pathogen instead of the route every airborne agent shares. A plan written for COVID-19 that never touched ventilation was never a plan against airborne disease — it was a plan against one virus’s news cycle.

The single highest-impact change is to move money and attention up the hierarchy, into the air. Engineering controls — ventilation, filtration, and ASHRAE 241’s equivalent clean-airflow targets — protect everyone in a room without depending on anyone remembering a rule, and they keep working when the next agent arrives unannounced.

Pair that with non-punitive sick leave and an honest read of your reporting threshold under OSHA or the HSE, and you have something a competent person can defend to an auditor in either jurisdiction. The masks still matter — but they are the last layer, not the first. A workplace that starts with respirators has usually skipped the controls that would have made the respirators almost unnecessary.