The OSHA rule on seeing your exposure and medical records is 29 CFR 1910.1020, Access to employee exposure and medical records. This explainer reads the current eCFR text; it does not describe a rule change.
Who does the rule cover?
1910.1020(b)(1) states: "This section applies to each general industry, maritime, and construction employer who makes, maintains, contracts for, or has access to employee exposure or medical records, or analyses thereof, pertaining to employees exposed to toxic substances or harmful physical agents."
Under (c)(4), "employee" means "a current employee, a former employee, or an employee being assigned or transferred to work where there will be exposure to toxic substances or harmful physical agents."
What counts as an exposure record or a medical record?
An exposure record, under (c)(5), includes workplace monitoring or measuring of a toxic substance or harmful physical agent; biological monitoring results that directly assess absorption, but not results which assess "the biological effect of a substance or agent" or "an employee's use of alcohol or drugs"; and material safety data sheets "indicating that the material may pose a hazard to human health". Otherwise, a chemical inventory or other record showing the identity of a toxic substance or harmful physical agent and where and when it was used counts.
A medical record, under (c)(6)(i), is "a record concerning the health status of an employee which is made or maintained by a physician, nurse, or other health care personnel or technician". Paragraph (c)(6)(ii) leaves out routinely discarded physical specimens, litigation records privileged from discovery, voluntary employee assistance program records kept separately from the employer's medical program, and health insurance claims records kept separately from that program and "not accessible to the employer by employee name or other direct personal identifier".
How fast must the employer respond?
Under (e)(1)(i), the employer "shall assure that access is provided in a reasonable time, place, and manner." If that cannot happen within fifteen (15) working days, the employer must, within that time, tell the requester "the reason for the delay and the earliest date when the record can be made available." Under (e)(1)(ii), the employer may ask only for information that "should be readily known to the requester" and that may be necessary to locate or identify the records.
Do I have to pay for a copy?
For a first copy, the employer must (e)(1)(iii) either provide a copy "without cost", make copying facilities available without cost, or lend the record "for a reasonable time to enable a copy to be made." Additional copies may carry "reasonable, non-discriminatory administrative costs" (e)(1)(v).
Who else can see my records?
A designated representative is anyone you authorize in writing (c)(3); a recognized or certified collective bargaining agent counts automatically for exposure records and analyses using exposure or medical records. For your medical records, a representative needs your "specific written consent" (e)(2)(ii)(B).
Under (e)(2)(ii)(D), if a physician representing the employer believes direct access to information about a specific diagnosis of a terminal illness or a psychiatric condition "could be detrimental to the employee's health", the employer may deny direct access to that information only. It must still provide it to a designated representative with specific written consent, "even when it is known that the designated representative will give the information to the employee."
How long must records be kept?
Unless a specific standard sets a different period, paragraph (d)(1) requires:
- Medical records: "at least the duration of employment plus thirty (30) years". Exceptions include separately kept health insurance claims, some minor first aid records, and records of employees who worked under one year if given to them when employment ends.
- Exposure records: "at least thirty (30) years". Background data may be kept one year only if the sampling results, the collection methodology (sampling plan), a description of the analytical and mathematical methods, and a summary of other background data are kept at least 30 years. Safety data sheets need not be kept for any set period if a record of the substance's identity, where it was used and when is kept for 30 years; a footnote says sheets for chemicals currently in use under the Hazard Communication Standard must be kept per 1910.1200(g).
- Analyses using exposure or medical records: at least 30 years.
An employer that stops doing business must transfer the records to a successor employer (h)(1); with no successor, (h)(2) requires it to notify affected current employees of their access rights "at least three (3) months prior to the cessation of the employer's business."
Will my employer tell me about these rights?
Under (g)(1), "Upon an employee's first entering into employment, and at least annually thereafter," the employer must inform "current employees covered by this section" of the records that exist, where they are, who maintains them, and "Each employee's rights of access to these records."
What about trade secrets?
Paragraph (f) allows withholding some trade secrets, with conditions. Where a treating physician or nurse determines that a medical emergency exists and the specific chemical identity is necessary for emergency or first-aid treatment, (f)(3) requires the employer to "immediately disclose the specific chemical identity of a trade secret chemical to the treating physician or nurse".
Where to study this
Our OSHA general industry section lists our topics. The bloodborne pathogens study guide covers the bloodborne pathogens standard, whose medical records rule points to 1910.1020.