Employee Access to Their Own Medical Records

Employees who have a possible exposure to or uses toxic substances or harmful physical agents at their work site or employers who have employees that may be exposed, need to know, and understand their rights and responsibilities under OSHA’s Standard 1910.1020 on Access to Employee Exposure and Medical Records.

It is generally recognized that the OSHA 1910 standards apply to General Industry, but this particular standard applies to general industry as well as the maritime and construction industries.

OSHA Standard 1910.1020(b)(1) This section applies to each general industry, maritime, and construction employer who makes, maintains, contracts for, or has access to employee exposure or medical records, or analyses thereof, pertaining to employees exposed to toxic substances or harmful physical agents.

For employees who may have been exposed to toxic substances or harmful physical agents in the workplace, this OSHA regulation may help detect, prevent, and treat occupational disease. Employees have the right to access relevant exposure and medical records.

Designated employee representatives may access employee medical, or exposure records and analyses created from those records only in very specific circumstances. Designated employee representatives include any individual or organization to whom an employee has given written authorization to exercise a right of access.

Note: While this article was not written to specifically address medical and vaccination records related to COVID-19, an interpretation letter provided by OSHA in July of 2021 clarifies exactly how OSHA Standard 1910.1020 does apply to the coronavirus pandemic.

"A record concerning an employee’s work-related exposure to SARS-CoV-2 is considered an employee exposure record and a record of COVID-19 medical test results, medical evaluations, or medical treatment is considered an employee medical record within the meaning of this standard."

This OSHA standard applies to records documenting the amount of employee exposure to “toxic substances and harmful physical agents.” Toxic substances and harmful physical agents may include the following:

• Metals and dusts, such as, lead, cadmium, and silica.
• Biological agents, such as bacteria, viruses, and fungi.
• Physical stress, such as noise, heat, cold, vibration, repetitive motion, and ionizing and non-ionizing radiation.

Employees have the right to access exposure and medical records and analyses based on the records that concern their employment. Employers must permit employees and, in certain circumstances their designated representatives, to access exposure and medical records relevant to the employee, free of charge, within a reasonable period of time.

OSHA Standard 1910.1020(e)(1)(i) Whenever an employee or designated representative requests access to a record, the employer shall assure that access is provided in a reasonable time, place, and manner. If the employer cannot reasonably provide access to the record within fifteen (15) working days, the employer shall within the fifteen (15) working days apprise the employee or designated representative requesting the record of the reason for the delay and the earliest date when the record can be made available.

Employees, or designated representatives, may access their medical and exposure records in one of three ways, as the employer may:

• provide a copy of the records to the employee.
• provide facilities for the employee to copy the document.
• loan the document to the employee to copy it offsite.

Employees have the right to access any employee exposure records that show the measuring or monitoring of their own exposure to a toxic substance or harmful physical agent. If employers do not have any records that specifically chart the employee’s exposure levels, then the employee has the right to access the exposure records of other employees (with personal identifiers removed) who engage in similar work or working conditions and may have experienced exposures similar to theirs. Employee exposure records include the following:

• Monitoring results of workplace air or measurements of toxic substances or harmful physical agents in the workplace, including personal, area, grab, wipe, or other forms of sampling results.
• Biological monitoring results, such as blood and urine test results.
• Safety data sheets (SDSs) containing information about a substance’s hazards to human health.

Employees also have the right to access any employee medical records concerning their health status that were created or maintained by a physician, nurse, health care professional, or technician. Employee medical records include the following:

• Medical and employment questionnaires or histories.
• Results of medical examinations and laboratory tests.
• Medical opinions, diagnoses, progress notes, and recommendations.
• First-aid records.
• Descriptions of treatments and prescriptions.
• Employee medical complaints.

In addition, employees may access any analyses (compilations of data or statistical studies) of employee medical and exposure records that concern their working conditions or workplace. If an analysis includes information that could be used to identify individual employees (directly or indirectly) the employer is required to remove these “identifiers” to the extent possible before permitting employee access to the analysis. Examples of identifiers include an employee’s name, address, social security number, and job title.

This OSHA standard states that employers have a responsibility to:

• Preserve and maintain accurate medical and exposure records for each employee.
• Inform workers of the existence, location, and availability of those medical and exposure records.
• Give employees any informational material regarding this standard that OSHA makes available to you.
• Make records available to employees, their designated representatives, and to OSHA, as required.

The Americans with Disabilities Act of 1990 (ADA), 42 U.S.C. §12112(d)(3)(B)-(C) generally requires employers to keep employee medical information confidential. Equal Employment Opportunity Commission (EEOC) standards, however, do not prohibit employers from making the disclosures required by OSHA’s medical access standard.

To clarify, employers do not have to make all records available. The following are not considered “medical records” under this standard:

• Physical specimens, such as blood and urine samples.
• Records concerning health insurance claims if they are (1) maintained separately from your medical program and its records, and (2) not accessible by employee name or other personal identifier.
• Records created only for use in litigation that are privileged from discovery.
• Records created as part of voluntary employee assistance programs, such as records for alcohol and drug abuse or personal counseling, if they are maintained separately from your medical program and its records.
• Trade secret information involving manufacturing processes or a percentage of a chemical substance in a mixture, as long as employers inform health professionals and employees that they have deleted that information from medical and exposure records. If the exclusion of the trade secret information substantially impairs the evaluation of when and where the exposure occurred, however, employers must provide alternative information to the employee consistent with the requirements of the standard.

Unless another OSHA rule specifically provides a different period of time, employers must keep the following documentation.

Employee medical records must be saved for at least the duration of the employee’s employment plus 30 years, except for:

• Health insurance claims records that are maintained separately from the medical program and its records.
• First-aid records made onsite by a non-physician of one-time treatment and later observations of minor scratches, scrapes, or other injuries that did not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job.
• Medical records of employees who have worked for less than 1 year as long as the employer offers all such records to the employee upon termination of employment.

Employee exposure records must be saved for at least 30 years, except for:

• Background data related to environmental, or workplace, monitoring or measuring—such as laboratory reports and worksheets—must only be retained for 1 year, so long as certain interpretive documents relevant to the interpretation of the data is saved for 30 years.
• SDSs and other specified records concerning the identity of a substance or agent, so long as some record of the identity is saved, preferably the chemical name and information on when and where it was used, for 30 years.
• Biological monitoring results designated as exposure records by specific OSHA standards shall be preserved and maintained as required by the specific standard governing their use.

Analyses using medical or exposure records must be saved for at least 30 years.

If an organization ceases to operate, employers must do one of two things:

1. Transfer all records subject to this standard to the successor employer OR, if there is no successor,
2. Notify current employees at least 3 months before the business closes of their right to access their records. Employers must also either transfer the records required to be preserved under this standard to the National Institute for Occupational Safety and Health (NIOSH) or notify the Director of NIOSH in writing of your intent to dispose of the records 3 months before that disposal.

OSHA requires states with their own safety and health programs to have rules and enforcement programs that are at least as effective as those of the federal program. Employees and employers in any state with an OSHA-approved state plan have the same rights and responsibilities as states under federal OSHA jurisdiction but state plans may have additional requirements.

For more information on state plans, contact the state plan in your state or visit OSHA’s website at www.osha.gov.