Employee Access to Exposure and Medical Records: What 29 CFR 1910.1020 Requires

29 CFR 1910.1020 gives employees and their designated representatives a right of access to relevant exposure and medical records (1910.1020(a)). For employers, the questions are how long to keep them and how fast to respond.

Which employers and records are covered?

The section applies to each general industry, maritime, and construction employer who makes, maintains, contracts for, or has access to employee exposure or medical records, or analyses of them, for employees exposed to toxic substances or harmful physical agents (1910.1020(b)(1)). It applies whether or not a specific standard mandates the records (1910.1020(b)(2)), and to records made or maintained in any manner (1910.1020(b)(3)).

What counts as an exposure or medical record?

An employee exposure record contains any of the following (1910.1020(c)(5)):

Workplace monitoring or measuring of a toxic substance or harmful physical agent, including related background data (1910.1020(c)(5)(i)).
Biological monitoring results that directly assess absorption by body systems, but not results that assess the biological effect of a substance or agent or an employee's use of alcohol or drugs (1910.1020(c)(5)(ii)).
Material safety data sheets indicating that the material may pose a hazard to human health (1910.1020(c)(5)(iii)).
In the absence of the above, a chemical inventory or other record revealing where and when a substance or agent was used and its identity (1910.1020(c)(5)(iv)).

An employee medical record is a record concerning an employee's health status that is made or maintained by a physician, nurse, or other health care personnel or technician, including first aid records (1910.1020(c)(6)(i)).

It does not include (1910.1020(c)(6)(ii)):

Physical specimens routinely discarded as part of normal medical practice.
Health insurance claims records, if maintained separately from your medical program and its records and not accessible to you by employee name or other direct personal identifier.
Records created solely in preparation for litigation that are privileged from discovery.
Voluntary employee assistance program records, if maintained separately from your medical program and its records.

How long must you keep them?

Unless a specific standard provides a different period, you must preserve records as follows (1910.1020(d)(1)).

Medical records: at least the duration of employment plus 30 years (1910.1020(d)(1)(i)). Two types need not be kept for any specified period:

Health insurance claims records maintained separately from your medical program and its records (1910.1020(d)(1)(i)(A)).
First aid records (not including medical histories) of one-time treatment and subsequent observation of minor scratches, cuts, burns, splinters, and the like that do not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job, if made on-site by a non-physician and maintained separately from your medical program and its records (1910.1020(d)(1)(i)(B)).

Medical records of employees who worked for you less than one year need not be kept beyond the term of employment if they are provided to the employee upon termination (1910.1020(d)(1)(i)(C)).

Exposure records: at least 30 years (1910.1020(d)(1)(ii)), except that:

Background data such as laboratory reports and worksheets need only be kept one year if the sampling results, sampling plan, a description of the analytical and mathematical methods, and a summary of other relevant background data are kept at least 30 years (1910.1020(d)(1)(ii)(A)).
Material safety data sheets and (c)(5)(iv) records need not be kept for any specified period if some record of the identity of the substance or agent (chemical name if known), where it was used, and when it was used is kept at least 30 years (1910.1020(d)(1)(ii)(B)).
Biological monitoring results designated as exposure records by a specific standard are kept as that standard requires (1910.1020(d)(1)(ii)(C)).

Analyses using exposure or medical records: at least 30 years (1910.1020(d)(1)(iii)).

What happens when someone asks for a record?

You must assure that access is provided in a reasonable time, place, and manner. If you cannot reasonably provide access within 15 working days, you must, within those 15 working days, tell the requester the reason for the delay and the earliest date the record can be made available (1910.1020(e)(1)(i)).

When a copy is requested, you must assure that a copy is provided without cost, that copying facilities are made available without cost, or that the record is loaned for a reasonable time so a copy can be made (1910.1020(e)(1)(iii)). Once a record has been provided without cost, you may charge reasonable, non-discriminatory administrative costs for additional copies of it, with two exceptions listed in the rule (1910.1020(e)(1)(v)). For an original X-ray, you may restrict access to on-site examination or make other suitable arrangements for a temporary loan (1910.1020(e)(1)(iv)).

A designated representative is any individual or organization to which an employee gives written authorization to exercise a right of access. A recognized or certified collective bargaining agent is treated automatically as one for exposure records and analyses (1910.1020(c)(3)). To see an employee's medical records, a representative needs that employee's specific written consent (1910.1020(e)(2)(ii)(B)), a defined term with required contents (1910.1020(c)(12)).

Other paragraphs add limits that are not covered in detail here:

A designated representative's request for unconsented access to exposure records must be in writing and specify with reasonable particularity the records requested and the occupational health need for access (1910.1020(e)(2)(i)(B)).
Where a physician representing you believes that direct employee access to information about a specific diagnosis of a terminal illness or a psychiatric condition could be detrimental to the employee's health, you may deny direct access to that information only and provide it instead to a designated representative having specific written consent (1910.1020(e)(2)(ii)(D)).
Trade secret data that discloses manufacturing processes or the percentage of a chemical substance in a mixture may be deleted from a requested record if the requester is notified of the deletion, subject to the rest of paragraph (f) (1910.1020(f)(1)).

What must employees be told, and what if you close?

Upon an employee's first entering into employment, and at least annually thereafter, you must inform current employees covered by the section of the existence, location, and availability of covered records, the person responsible for maintaining and providing access to them, and each employee's rights of access (1910.1020(g)(1)).

If you are ceasing to do business, you must transfer all covered records to the successor employer (1910.1020(h)(1)). With no successor, you must notify affected current employees of their rights of access at least three months before the business ceases (1910.1020(h)(2)).

Steps to take

List your exposure and medical records with the retention period for each.
Be ready to provide access, or to explain the delay and give the earliest available date, within 15 working days of a request.
Give the (g)(1) information at hire and at least annually.

Source

This article relies on 29 CFR 1910.1020, Access to employee exposure and medical records on osha.gov. The regulation itself always controls. States that run their own OSHA-approved State Plans may have additional or stricter rules.