Access to exposure records

This standard applies to any employer in general industry, maritime, or construction who makes, maintains, contracts for, or has access to employee exposure or medical records relating to employees exposed to toxic substances or harmful physical agents. See Scope and application in 1910.1020(b).

• It covers all employee exposure and medical records whether or not they were created to satisfy another OSHA standard.
• It covers records maintained in any manner, including in-house or contracted (fee-for-service) arrangements.

Access means the right and opportunity to examine and copy the records requested. See the definition of Access in 1910.1020(c)(1).

• Employers must therefore allow examination and provide copies (or copying facilities) as described in the standard.

A designated representative is any individual or organization that an employee gives written authorization to exercise record-access rights; a recognized or certified collective bargaining agent is treated automatically as a designated representative without written authorization for exposure records and analyses. See 1910.1020(c)(3).

• For medical records, specific written consent is still required for a designated representative to get access (see 1910.1020(e)(2)(ii)(B)).

Employee exposure records include environmental monitoring, biological monitoring that shows absorption, material safety data sheets showing health hazards, and—if the above are absent—chemical inventories or other records revealing where, when and what toxic substance was used. See 1910.1020(c)(5).

• Examples: personal air sampling results, lab analyses, biological test results for exposure, MSDS/SDS indicating hazards, or a chemical inventory showing use locations and dates.

Employee medical records include medical and employment histories, results of medical exams and lab tests (including biological monitoring not defined as exposure records), medical opinions and progress notes, first‑aid records, treatment descriptions, prescriptions, and employee medical complaints. See 1910.1020(c)(6)(i).

• Exclusions (not part of employee medical records) include routinely discarded physical specimens, separately maintained health insurance claims that are not accessible by employee name, records created solely for litigation that are privileged, and separately maintained voluntary employee assistance program records (1910.1020(c)(6)(ii)).

Employers must preserve each employee's medical record for the duration of employment plus thirty (30) years, unless a specific OSHA standard provides a different period. See 1910.1020(d)(1)(i).

• Exceptions: certain health insurance claims, some first‑aid records kept separately, and medical records of employees who worked less than one year (if provided to employee upon termination) are not subject to the 30‑year rule.

Employers must preserve employee exposure records for at least thirty (30) years. Background lab reports and worksheets may be kept for only one (1) year if the sampling results and summary background needed to interpret the sampling are retained for 30 years. See 1910.1020(d)(1)(ii).

• Material safety data sheets and identity records need not be retained for a specified period, so long as some record of the identity, where it was used, and when is retained for 30 years.

If an employer cannot reasonably provide access within fifteen (15) working days, the employer must, within those 15 working days, inform the requester of the reason for the delay and the earliest date when the record will be available. See 1910.1020(e)(1)(ii).

• The employer should communicate a realistic timetable and make records available as soon as possible thereafter.

An employer must provide a copy of the record or make copying facilities available without cost, or loan the record so the employee can copy it; however the employer may charge reasonable administrative costs for additional copies after an initial free copy has been provided. See 1910.1020(e)(1)(iii) and 1910.1020(e)(1)(v).

• Exceptions: employers may not charge for an initial request for newly added information to a record previously provided, nor for an initial request by a recognized or certified collective bargaining agent for an employee exposure record or analysis (1910.1020(e)(1)(v)(A)–(B)).

An employer may require only information that should be readily known to the requester and that may be necessary to locate or identify the requested records (for example, dates and locations where the employee worked during the period in question). See 1910.1020(e)(1)(ii).

• Keep requests limited to what is needed to identify the records so access is not unreasonably delayed.

A designated representative requesting unconsented access to employee exposure records must submit a written request that specifies with reasonable particularity the records to be disclosed and the occupational health need for access. See 1910.1020(e)(2)(i)(B).

• The request should identify the records sought and explain why the exposure information is needed for occupational health purposes.

A designated representative must have the employee's specific written consent to access that employee's medical records, and the written authorization must meet the elements of Specific written consent in 1910.1020(c)(12). See also 1910.1020(e)(2)(ii)(B).

• Required consent elements include employee name and signature, date, the authorized releaser and recipient, a general description of the medical information to be released, purpose, and an expiration date or condition (see 1910.1020(c)(12)(i)(A)–(G)).
• Consent is limited to records in existence on the date signed unless future releases are expressly authorized and is valid for up to one year unless revoked in writing (1910.1020(c)(12)(ii)–(iii)).

An employer may require that original X‑rays be examined on‑site or make other suitable arrangements for the temporary loan of the X‑ray rather than permit unrestricted removal. See 1910.1020(e)(1)(iv).

• Employers should ensure reasonable access while protecting original X‑ray films from loss or damage.

Yes. If a physician representing the employer believes that direct access to information about a specific diagnosis of a terminal illness or a psychiatric condition could be detrimental to the employee's health, the employer may deny direct access to that information and instead require access through a designated representative with specific written consent. See 1910.1020(e)(2)(ii)(D).

• The employee must be informed that access will only be provided to a designated representative under these circumstances.

When an analysis reports contents of medical records by direct identifiers or by information that could reasonably identify individuals, the employer must remove personal identifiers before providing access; if removal is not feasible and the employer can demonstrate that, the personally identifiable portions need not be provided. See 1910.1020(e)(2)(iii)(B) and 1910.1020(e)(3).

• Employers should remove or redact direct identifiers (names, SSNs, payroll numbers) and reasonably identifying indirect information before release.

An employer may delete trade secret information that discloses manufacturing processes or percentages in a mixture from records provided to employees or health professionals, provided the requester is notified that information was deleted; however, the employer may not withhold the specific chemical identity where required by the paragraph's conditions and must follow the procedures in 1910.1020(f)(2). See 1910.1020(f)(1).

• If deletion would substantially impair evaluation of where or when exposure occurred, the employer must provide alternative information sufficient to identify time/place of exposure (1910.1020(f)(2)).

If a treating physician or nurse determines that a medical emergency exists and the specific chemical identity is necessary for treatment, the employer must immediately disclose the specific chemical identity to the treating physician or nurse regardless of trade secret claims. See 1910.1020(f)(3).

• This is an immediate duty to protect employee health in emergencies.

In non‑emergency situations, the requester must submit a written request describing the occupational health need in reasonable detail and explain why the specific chemical identity is essential; the requester must also provide procedures to maintain confidentiality and execute a written confidentiality agreement with the employer. See 1910.1020(f)(4) and 1910.1020(f)(5).

• The request must detail the health purposes (assessment, monitoring, treatment, PPE selection, controls design, etc.) per 1910.1020(f)(4)(ii).
• The confidentiality agreement may limit use to those purposes and provide remedies for breach but may not require a penalty bond (1910.1020(f)(5)).

If a request is denied, the employer must provide a written denial within 30 days that supports the trade secret claim and explains why disclosure is denied and how alternatives might suffice; the requester may refer the denial to OSHA for consideration, and OSHA will review the evidence and may order disclosure if appropriate. See 1910.1020(f)(8), 1910.1020(f)(9), and 1910.1020(f)(10)–(11).

• OSHA may cite the employer if it finds the trade secret claim is not bona fide or disclosure is required to meet a legitimate need and confidentiality protections are in place.

Yes—despite trade secret claims, an employer must disclose required information to the Assistant Secretary upon request (1910.1020(f)(12)). Employers must also inform employees upon first hire and at least annually about the existence, location, availability of covered records, the person responsible for maintaining them, and employees' rights of access (1910.1020(g)(1)).

• Maintain a copy of the section and appendices and make them readily available to employees (1910.1020(g)(2)).

If a successor employer exists, the employer ceasing business must transfer all records subject to this standard to the successor, who must receive and maintain them; if there is no successor, the employer must notify affected current employees of their rights of access at least three (3) months prior to cessation. See 1910.1020(h)(1)–(2).

• Employers should document transfer arrangements to preserve employees' long‑term access rights.

No. OSHA does not mandate the form, manner, or process for preserving records as long as the information is preserved and retrievable, except chest X‑ray films must be preserved in their original state. See 1910.1020(d)(2).

• Employers can use paper, electronic, microfiche, etc., provided retrieval and integrity are maintained.

When OSHA presents a written access order under 29 CFR 1913.10(d), the employer must prominently post a copy of the written access order and its accompanying cover letter for at least fifteen (15) working days. See 1910.1020(e)(3)(ii) and the rules at 29 CFR 1913.10.

Analyses using exposure or medical records must be preserved and maintained for at least thirty (30) years. See 1910.1020(d)(1)(iii).

• If analyses report personally identifiable medical information, identifiers must be removed unless infeasible (1910.1020(e)(2)(iii)(B)).

Chest X‑ray films must be preserved in their original state; OSHA allows flexibility on form for other records as long as information is preserved and retrievable. See 1910.1020(c)(10) and 1910.1020(d)(2).

• Keep original films intact and store them with usual medical‑record safeguards.

Exposure means an employee is subjected to a toxic substance or harmful physical agent in employment through any route of entry, and includes past or potential exposures; it does not include situations where the employer can show the substance is present only in ways typical of non‑occupational situations. See 1910.1020(c)(8).

• Employers may show no occupational exposure if the substance’s presence is no different from everyday non‑work environments.

Yes. Nothing in this section precludes employees and collective bargaining agents from negotiating for access to more information than provided under the standard. See 1910.1020(e)(1)(vi).

• Collective bargaining can expand access but cannot reduce rights guaranteed by the standard.

Health insurance claims are excluded from the definition of employee medical record if they are maintained separately from the employer's medical program and are not accessible to the employer by employee name or other direct personal identifier. See 1910.1020(c)(6)(ii)(B).

• If the employer can access claims by employee name or identifier, those records may be treated differently.

Yes. A physician representing the employer may recommend that the employee or designated representative consult with the physician, accept a summary of facts and opinions instead of full records, or accept release of records only to a physician or other designated representative. See 1910.1020(e)(2)(ii)(C).

• These options aim to protect employee health while still providing necessary information.

Yes. A physician, nurse, or other responsible health care personnel maintaining medical records may delete from requested records the identity of a family member, personal friend, or fellow employee who provided confidential information about the employee's health status. See 1910.1020(e)(2)(ii)(E).

• Redaction must be limited to identifying third‑party sources of confidential information.

Employers must inform employees upon first entering employment and at least annually about the existence, location, and availability of covered records, the person responsible for maintaining them, and each employee's rights of access. See 1910.1020(g)(1)(i)–(iii).

• Employers must also keep a copy of this section and its appendices and make copies readily available upon request (1910.1020(g)(2)).

The employee's legal representative may directly exercise all of the deceased or legally incapacitated employee's rights under this section. See 1910.1020(c) and the standard's text addressing legal representatives' rights.

• Employers should obtain appropriate proof of legal representation (e.g., executor, guardian) when releasing records.

As of the memorandum dated February 5, 2025, OSHA announced that it will not enforce the COVID‑19 Healthcare ETS recordkeeping and reporting requirements (including establishment and provision of COVID‑19 logs and reporting of COVID‑19 fatalities and hospitalizations) until further notice. See the enforcement stay memorandum "COVID-19 recordkeeping enforcement stay" (Feb. 5, 2025).

• OSHA continues to enforce other applicable recordkeeping and reporting requirements under 29 CFR Part 1904.

Yes. 1910.1020 applies to employers who make or maintain exposure or medical records for employees exposed to toxic substances like asbestos; however, OSHA's asbestos requirements for construction activities are contained in 29 CFR 1926.1101, and asbestos remediation work on buildings is often covered by the construction asbestos standard rather than the general industry standard. See 1910.1020(b) and the asbestos interpretation "Asbestos remediation protocols" (Nov. 14, 2024).

• For remediation involving asbestos‑containing building materials, consult 29 CFR 1926.1101 as interpreted in OSHA letters when determining applicable recordkeeping and exposure‑control obligations.