Employee exposure and medical records

Employers must keep accurate exposure monitoring records and medical surveillance records for employees who are or may be exposed to hazardous substances. See 1915.1020 and the identical requirements at 1910.1020.

• Exposure monitoring records typically include the chemical identity, sampling or monitoring data, dates of monitoring, sampling and analytical methods used, results, and the identity of the monitoring personnel or laboratory.
• Medical records usually include the employee’s name and identifier, job title, dates of employment/exposure, medical examination results, clinical laboratory test results, physicians’ written opinions, and any medical complaints related to exposure.

(See 1910.1020 for the full scope of required record elements.)

Exposure monitoring records must generally be retained for at least 30 years. This retention requirement is part of the access and maintenance obligations in 1910.1020 and applies equally under 1915.1020.

• Keep original monitoring data, chain-of-custody where relevant, and any documentation of sampling/analysis methods.
• If an employer ceases business or transfers operations, records must be preserved and made available to successor employers or OSHA as required by the standard.

Employers must retain employee medical records for the duration of employment plus 30 years, as required by the medical recordkeeping provisions in 1910.1020 and applied under 1915.1020.

• Maintain physicians’ written opinions, lab results, and any other documents produced as part of medical surveillance.
• If a worker leaves employment, the employer must still preserve those medical records for the additional 30-year period or transfer them as required by the standard.

An employee has the right to access his or her own exposure and medical records, and may designate a representative to obtain copies. These access rights are set out in 1910.1020 and apply to shipyard employment under 1915.1020.

• Employees may review and obtain copies without unreasonable delay or charge, subject to limited, specific exceptions in the standard.
• An employee’s designated personal representative (for example, a health care provider or union representative) may obtain records only if the employee provides written consent or a valid authorization.
• Employers must provide assistance where needed to help employees understand technical information contained in records.

Yes, employers may charge a reasonable fee to provide copies of exposure and medical records so long as the fee does not effectively deny employees access. The handling of access and copying is governed by 1910.1020, applied through 1915.1020.

• Fees should reflect the actual cost of copying or producing the records and must not be so high as to prevent access.
• Employers must provide access within a reasonable time frame and should document any fee policy applied.

No. An authorized union representative may access an individual employee’s exposure and medical records only if the employee has authorized that representative in writing. This access rule follows the employee access and representative provisions in 1910.1020 and applies under 1915.1020.

• The written authorization should specify which records may be released and to whom.
• Absent written authorization, unions may still request aggregated or de-identified exposure data that does not identify individual employees.

When an employee requests access, the employer must provide access and, if requested, copies of the records within a reasonable time and in a manner that allows the employee to understand the information. These procedures are required by 1910.1020 and apply under 1915.1020.

• The employer should offer to explain technical terms or test results and may facilitate review with a medical professional if needed.
• If copies are requested, the employer may charge a reasonable copying fee but must not delay access unreasonably.

When a business closes or an employer ceases operations, the employer must ensure that exposure and medical records remain accessible either by transfer to a successor employer, deposit with the appropriate OSHA office, or another arrangement that preserves employee access. The transfer and preservation duties are specified by 1910.1020 and apply under 1915.1020.

• Employers should notify employees how and where records will be kept and how they may obtain copies.
• If records are transferred to a successor employer, employees must be informed of the new custodian and how to access records.

Yes. OSHA has authority to inspect and copy employee exposure and medical records during inspections and investigations under OSHA standards, including 1910.1020 and as applied in 1915.1020.

• Employers must make records available to OSHA compliance officers upon request.
• Employers should preserve records required by the standard so they can be produced during inspections or submitted electronically if requested.

Yes, employers must protect the confidentiality of medical records while still providing access to the employee and authorized representatives. The confidentiality and privacy expectations are part of the requirements in 1910.1020 and apply under 1915.1020.

• Do not disclose medical records to third parties without the employee’s written consent or unless required by law.
• Employers may provide de-identified or aggregated exposure data that does not identify individual employees for workplace safety analysis.

Employers should protect Social Security numbers and other personal identifiers to maintain confidentiality while preserving the records required by 1910.1020 and 1915.1020.

• Limit access to identifiable records to authorized personnel and provide records directly to the employee or their authorized representative only.
• When releasing records for aggregate reporting or safety analysis, remove personal identifiers so individuals cannot be readily identified.

Yes. Employers must correct errors in records promptly and maintain a clear record of corrections consistent with good recordkeeping practices required by 1910.1020 and 1915.1020.

• Corrections should be dated and signed, and the original data should not be deleted; note the reason for the correction.
• If employees dispute entries in their medical records, employers should include the employee’s written statement in the file while maintaining the employer’s original documentation.

Yes. Electronic recordkeeping is permitted as long as records are accurate, accessible, and preserved for the required retention period under 1910.1020 and 1915.1020.

• Ensure employees can obtain readable copies and that electronic files are backed up, secured, and maintained for the full retention period (e.g., 30 years where applicable).
• Employers must produce electronic records during OSHA inspections on request.

Employers may share medical surveillance information in a way that protects employee confidentiality and complies with 1910.1020 and 1915.1020.

• Share only the job-related fitness-for-duty information or work restrictions from a physician’s written opinion, not detailed medical test results or diagnoses, unless the employee consents.
• Use aggregated or de-identified data to guide safety improvements without revealing individual medical details.

Third-party requests for identifiable employee medical or exposure records generally require the employee’s written authorization unless disclosure is compelled by law. These privacy expectations are outlined in 1910.1020 and apply under 1915.1020.

• Before releasing identifiable records, obtain a signed release from the affected employee(s) or verify a valid subpoena or other legal compulsion.
• When appropriate, provide de-identified aggregate data instead of individual records to protect privacy.

When transferring records to a successor employer, the custodian should include complete exposure and medical records necessary for continuity of employee protection and surveillance, as required by 1910.1020 and enforced under 1915.1020.

• Include identifying information, dates of monitoring/tests, exposure data, physicians’ written opinions, and any work restrictions.
• Notify employees of the transfer, provide them information on how to access the records, and preserve confidentiality during the transfer.

Yes. Employers must provide assistance so employees can understand technical exposure and medical information upon request, consistent with 1910.1020 and 1915.1020.

• This may include arranging for a knowledgeable professional (for example, an occupational health provider or industrial hygienist) to explain results.
• Employers should not delay access while arranging explanations; provide the records promptly and offer clarifications.

Yes, employers may properly destroy records once the required retention period has elapsed, provided there is no legal hold, ongoing litigation, or other regulatory requirement that extends retention; the retention rules are set out in 1910.1020 and apply under 1915.1020.

• Before destroying records, confirm there are no pending claims, lawsuits, or administrative holds requiring preservation.
• Maintain documentation of destruction (date, method, and authority) in case questions arise later.

OSHA has temporarily stayed enforcement of certain COVID-19 recordkeeping and reporting requirements under 29 CFR 1910.502; therefore, OSHA stated it will not enforce the COVID-19 log and reporting provisions in that ETS at this time. See OSHA’s enforcement stay memorandum at https://www.osha.gov/laws-regs/standardinterpretations/2025-02-05. However, employers must still follow applicable recordkeeping requirements under 29 CFR part 1904. For general employee exposure and medical records obligations, see 1910.1020 and 1915.1020.

• If covered by other OSHA standards (for example, hazardous substance standards), retain and provide records as required by those standards and by 1910.1020.
• Continue to follow recordkeeping under 29 CFR part 1904 for OSHA injury and illness logs.

No. When an employee requests their exposure records, the employer must provide the actual exposure monitoring data (or complete medical records) and may also offer summaries or explanations. This obligation is described in 1910.1020 and applies under 1915.1020.

• Summaries are useful as a supplement, but do not replace the duty to provide original or accurate monitoring results and associated documentation.
• If technical complexity is an issue, provide the data promptly and offer interpretive assistance.

Employers may set reasonable times and places for record review as long as they do not unreasonably delay or deny access required by 1910.1020 and 1915.1020.

• Reasonable scheduling to ensure privacy, allow a staff member to be present for explanations, or to retrieve archived records is acceptable.
• Employers must provide access promptly and should not create barriers that effectively deny access (e.g., requiring multiple in-person appointments when electronic copies are readily available).

If an employee is deceased or incapacitated, an authorized legal representative, next of kin, or someone with proper written authorization may request the records; employers must follow privacy and access rules in 1910.1020 and 1915.1020.

• Require documentation of legal authority (for example, power of attorney, executor papers, or written consent) before releasing identifiable medical records.
• If appropriate documentation is provided, provide the records and preserve confidentiality consistent with the standard.