Employer Responsibilities for Worker Exposure and Medical Records

The Occupational Safety and Health Administration’s (OSHA) requires employers to provide workers with access to their exposure and medical records. This handout highlights what employers should know concerning these records, as outlined in the OSHA Standard Title 29 of the Code of Federal Regulations (CFR) Part 1910.1020, Access to Employee Exposure and Medical Records.

What should an employer do?

As an employer, you should:

Preserve and maintain accurate medical and exposure records for each worker.

Inform workers of the existence, location, and availability of those medical and exposure records.

Give workers any informational material regarding the standard that OSHA makes available.

Make records available to workers, their designated representatives, and to OSHA, as required.

What types of medical and exposure records must an employer maintain?

Exposure records include the following:

Monitoring results of workplace air or measurements of toxic substances or harmful physical agents in the workplace, including personal, area, grab, wipe, or other forms of sampling results.

Biological monitoring results, such as blood and urine test results.

Material Safety Data Sheets (MSDS) containing information about a substance’s hazards to human health.

Medical records are those records concerning a worker’s health status that were created or maintained by a physician, nurse, health care professional, or technician, and include the following:

Medical and employment questionnaires or histories.

Results of medical examinations and laboratory tests.

Medical opinions, diagnoses, progress notes, and recommendations.

First-aid records.

Descriptions of treatments and prescriptions.

Worker medical complaints.

In addition, you must maintain any analyses (i.e., compilations of data or statistical studies) of medical and exposure records that concern working conditions or the workplace.

Do employers have to make all medical records available?

No, the following are not considered “medical records” under the standard:

Physical specimens, such as blood and urine samples.

Records concerning health insurance claims if they are (1) maintained separately from your medical program and its records, and (2) not accessible by worker name or other personal identifier (e.g., social security number or home address).

Records created only for use in litigation that are privileged from discovery.

Records created as part of voluntary worker assistance programs, such as records for alcohol and drug abuse or personal counseling, if they are maintained separately from your medical program and its records.

Trade secret information involving manufacturing processes or a percentage of a chemical substance in a mixture, as long as you inform health professionals and workers, and their designated representatives, that the information has been deleted from medical and exposure records. If the exclusion of the trade secret information substantially impairs the evaluation of when and where the exposure occurred, however, the employer must provide alternative information to the worker.

What if an employer does not have exposure records for a particular worker?

If an employer does not have exposure records that document the amount of a toxic substance or harmful physical agent that the requesting worker has been exposed to:

The employer should give the requesting worker the records of other workers (with personal identifiers removed) with similar duties or working conditions that reasonably indicate the amount and nature of exposures the worker requesting the records may have had.

The employer may be required to supply exposure records that reasonably indicate the amount and nature of toxic substances or harmful physical agents at a particular workplace, or used in a specific working condition, to which the requesting worker is being assigned or transferred.

How long does an employer have to keep worker medical records?

Unless another OSHA rule specifically provides a different period of time, you must keep medical records for at least the duration of the worker’s employment plus 30 years, except for:

Health insurance claim records that the employer maintains separately from the employer’s medical program and its records.

First-aid records made onsite, by a non-physician, of one-time treatment and later observations of minor scratches, scrapes, or other injuries that did not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job.

Medical records of workers who have worked for less than 1 year as long as the employer offers all such records to the worker upon termination of employment.

How long does an employer have to keep worker exposure records and other exposure information?

Unless another OSHA rule specifically provides a different period of time, you must keep exposure records for at least 30 years, except for

Background data related to environmental or workplace monitoring or measuring, such as laboratory reports and worksheets, must only be retained for 1 year, so long as the employer preserves certain interpretive documents relevant to the interpretation of the data for 30 years.

MSDS and other specified records concerning the identity of a substance or agent, so long as the employer keeps some record of the identity, preferably the chemical name and information on when and where it was used, for 30 years.

Biological monitoring results designated as exposure records by specific OSHA standards shall be preserved and maintained as required by the specific standard governing their use.

Analyses using medical or exposure records for at least 30 years.

What if an employer goes out of business?

You must transfer all records subject to the standard to the successor employer; or, if there is no successor, notify current workers at least 3 months before the business closes of their right to access their records. You should either transfer the records required to be preserved under the standard to the National Institute for Occupational Safety and Health (NIOSH), or notify the Director of NIOSH in writing of your intent to dispose of the records 3 months before that disposal.

Does the standard cover an employer who runs a business in a State that operates its own job safety plan?

Yes. OSHA requires States with their own safety and health programs to have rules and enforcement programs that are at least as effective as those of the federal program. If you are an employer in a State plan, you have at least the same responsibilities and rights as employers in States under federal OSHA jurisdiction, but your State plan may have additional requirements.

COPYRIGHT ©2006, ISO Services Properties, Inc.