CPR and First Aid Certification for Staff in the US: Rules and Renewals
Plenty of US jobs need someone on staff with a current CPR and first aid card. Getting a copy of the card is easy. Knowing which cards have lapsed, two years later and across a whole team, is the part that slips.
This post covers the main certifying bodies, how long a card lasts and how to check one, when OSHA expects a trained first aid person on site, a few states that require certification for particular jobs, whether online courses count, and how to track renewals in WorkZerk.
Who issues CPR and first aid cards
Most workplace cards in the US come from the American Heart Association (AHA) or the American Red Cross. Other organizations run courses too, and OSHA's construction rule accepts "equivalent training" from them as long as it can be shown on paper (more on that below). If a law or licensing body names the providers it accepts, check that list before you rely on a card from anyone else.
| Provider | Typical workplace course | How long the card lasts | Where to check it |
|---|---|---|---|
| American Heart Association | Heartsaver First Aid CPR AED, or BLS for healthcare roles | 2 years, through the end of the month it was issued (AHA course card information) | heart.org/cpr/mycards |
| American Red Cross | Adult First Aid/CPR/AED | 2 years for classroom and blended courses (Red Cross) | Find My Certificate |
Two years is the common validity period, but it is set by the provider, not by federal law. Read the date on each card rather than assuming it.
eCards and digital certificates
Both providers now issue cards electronically.
AHA eCards. An authorized Training Center issues the eCard and the student has to claim it. An employer can confirm it at heart.org/cpr/mycards by entering the eCard code or scanning the QR code on the card. The AHA says the check confirms the card came from a valid Training Center and an instructor aligned with that Training Center (AHA eCards FAQ). An eCard the student never claimed doesn't show up as valid, so ask them to claim it before they send it to you.
Red Cross digital certificates. Each certificate has a unique ID and a QR code that lets an employer confirm it is valid. The person can find it with the Find My Certificate search, or in their Red Cross Learning Center account under My Certifications, and download or share it from there.
For either one, check that the name matches the person, that the course is the one the job needs (adult only, or adult and pediatric), and that the card is still in date.
When OSHA expects a trained first aid person
OSHA's general industry rule is short. Under 29 CFR 1910.151(b), if there is no infirmary, clinic or hospital in "near proximity" to the workplace that is used to treat all injured employees, you must have a person or persons "adequately trained to render first aid". First aid supplies must be readily available too.
OSHA has said what "near proximity" means in its letters of interpretation (March 23, 2007):
| Workplace | Response time OSHA expects |
|---|---|
| Where life-threatening injuries such as stopped breathing or severe bleeding can be expected | Emergency care within 3 to 4 minutes |
| Lower risk, such as offices | Up to 15 minutes may be reasonable |
If outside help can't reach your people in that time, you need trained people on site, on every shift.
Construction has its own rule. Under 29 CFR 1926.50(c), if no infirmary, clinic, hospital or physician is reasonably accessible in time and distance, a person with a valid first aid certificate from the U.S. Bureau of Mines, the American Red Cross, or equivalent training that can be verified by documentary evidence must be available at the worksite. That makes keeping a copy of the card part of the job.
Some standards go further and require first aid and CPR training outright, including permit-required confined spaces, logging and electric power work (OSHA, August 2, 2012).
OSHA doesn't set a refresher interval. It says retraining intervals are not mandated, while its best practices guide recommends CPR and AED retraining at least once a year (OSHA, February 23, 2023). In practice, the expiry on the card is the date most employers work to.
Online, blended and classroom courses
Where OSHA requires first aid training, an online course on its own doesn't meet it. OSHA's 2012 letter says "Online training alone would not meet the requirements of these training standards", because skills like bandaging and CPR can only be learned by practicing them (OSHA, August 2, 2012).
The providers draw the same line:
- AHA HeartCode (blended) is an online part followed by a hands-on skills session with an AHA instructor. You need both to get the course completion eCard, which is valid for two years (AHA HeartCode FAQs). Finishing the online part alone gives a certificate of completion for entry to the skills session, not a card.
- Red Cross online-only courses give a certificate of completion. The Red Cross says its online-only course "does not meet OSHA requirements for workplace certification". Its classroom and blended courses, where the person demonstrates the skills to an instructor, lead to the 2-year certification (Red Cross).
So when you ask for a card, ask for one from a classroom or blended course with a hands-on skills check, and say so in the request.
Jobs where state law requires it
On top of OSHA, many states require current CPR or first aid for particular roles. The rules vary a lot, so here are three well-documented examples rather than a full list.
| State | Who | What the law says |
|---|---|---|
| California | Directors and teachers at child day care centers, and family child care licensees who provide care | At least 15 hours of health and safety training, including pediatric first aid and pediatric CPR. Those two must be "current at all times" and renewed every two years, and staff must keep current course completion cards from the Red Cross, the AHA or an EMSA-approved program (Health and Safety Code 1596.866). From January 1, 2026, the courses must also cover anaphylaxis and epinephrine auto-injectors. |
| New York | Health clubs with 50 or more members | At least one AED on the premises, and during staffed business hours at least one employee or authorized volunteer holding valid certification in CPR and in operating an AED (General Business Law 627-a) |
| Texas | School district head band directors, head coaches and chief sponsors of extracurricular athletic activities, including cheerleading | Must maintain and submit to the district proof of current first aid and CPR certification from the Red Cross, the AHA or an organization with equivalent training (Education Code 33.086) |
Child care is covered at the federal level too. States that take Child Care and Development Fund money must set health and safety training requirements for providers, and pediatric first aid and CPR is one of the required topics (45 CFR 98.41). Each state decides the details, so check your child care licensing agency.
Lifeguards, pool operators, home health aides and others often have their own state or county rules. Check with the agency that licenses the role.
This is general information, not legal advice. Federal and state rules change, so check with OSHA, your state OSHA plan if you have one, and the agency that licenses your sector.
What to keep on file
For each person who holds a card, keep:
- a copy of the card or digital certificate
- the provider, the course name and whether it was classroom, blended or online
- the issue date and the expiry or renewal date
- who checked it, and when
What WorkZerk does with CPR and first aid cards
- Each person uploads their card from a private link on their phone, with no account or password.
- They have to enter the expiry date before they can send it. WorkZerk's AI check reads the date on the card and flags it when it differs from the one they typed.
- You approve or reject each card, and WorkZerk records who did it and when.
- The card is saved to the person's contact record, so it counts on every portal they are on.
- WorkZerk emails the person before the card expires, and again after, asking for the new one.
- The Document compliance report shows whose card is current, expiring, expired or missing.
What it does not do: WorkZerk does not check a card against the AHA or Red Cross lookup, book courses, or decide how many trained people you need on each shift. Those steps stay with you. The US starter packs don't include a CPR or first aid ask either, so you add one yourself, as below.
Setting it up in WorkZerk
1. Turn on two-factor authentication
Asking people to upload documents needs two-factor authentication on your account. Set it up under Account, then Two-factor authentication (opens in WorkZerk in a new tab).
2. Create a field for the card
Open Fields (opens in WorkZerk in a new tab) in the sidebar. Add a field called CPR and first aid, choose the Upload type, and tick Require an expiry date. See custom contact fields.
If some people hold separate CPR and first aid cards with different dates, create two fields instead, one for each. For child care staff, a field called Pediatric CPR and first aid keeps those cards apart from adult-only ones.
3. Ask for the card on a portal
Open Portals (opens in WorkZerk in a new tab) and pick or create one. On its Requests panel, click + Insert, choose Upload, and name it "CPR and first aid card". Pick your field under Document type and make sure Require expiry is on.
Say exactly what you accept in the description. For example: "Your current AHA or Red Cross adult first aid, CPR and AED card from a classroom or blended course. Online-only certificates are not accepted. Enter the expiry or recommended renewal date shown on the card."
To use it again, add the ask to a pack of your own under Request packs on Requests (opens in WorkZerk in a new tab), alongside the Staff onboarding (United States) starter pack.
4. Review and approve
Uploaded cards wait under Needs review on Requests (opens in WorkZerk in a new tab). Check the name, course and date, and look the card up at heart.org/cpr/mycards or the Red Cross Find My Certificate page. If the date is wrong, click Change date and correct it, then approve. Reject an online-only certificate and say why. Your reason goes back to the person. See reviewing uploads.
5. Switch on the reminders
Open Automations (opens in WorkZerk in a new tab). Switch on Document expiring reminder and Document expired reminder. Both start switched off. The expiring reminder goes 30 days before the date by default. Skills sessions book out, so consider stacking a second rule at 60 days. The reminders stop once the person uploads the new card. See automations.
6. See who is covered
Tag your trained people on their contact records, for example "First aid", or by shift. Then open Requests (opens in WorkZerk in a new tab), click Document compliance, and filter by that tag. Each person shows as current, expiring, needs review, expired or missing.
Set Expiring within to 60 days to see whose renewal to book, and use Download CSV when an inspector or licensing agency asks for proof. See document compliance.
Getting started
Start a free WorkZerk trial at workzerk.com, then work through the steps above. The getting started guide walks through a first portal end to end, or email us at [email protected].