Employee exposure and medical records

Employers must allow the employee and certain authorized people to access that employee's exposure and medical records. Under 1926.33 (which is identical to 1910.1020), the employee, the employee's designated representative (for example, a union official or an attorney with written permission), and OSHA/NIOSH investigators may obtain the records.

• A designated representative generally must present written authorization from the employee (or other documentation such as a power of attorney) to get copies.
• OSHA investigators may inspect and copy records as part of enforcement or investigation activities per 1910.1020.

Employers must keep both exposure records and medical records that document monitoring and health evaluations related to workplace hazards. Specifically, 1926.33 refers employers to 1910.1020, which requires maintaining items such as airborne exposure monitoring results, biological monitoring data, medical examination reports, physician written opinions, and any related workplace sampling information.

• Keep clear, accurate records of monitoring results and medical findings tied to each affected employee.
• Maintain any labels, material safety data, or other documentation if they form part of an exposure record under 1910.1020.

Employers must retain exposure records and medical records for long periods specified in 1910.1020, which applies equally to construction under 1926.33. Generally, exposure monitoring records must be kept for at least 30 years, and employee medical records must be kept for the duration of employment plus 30 years.

• These retention periods ensure that employees can access historical records that could affect long-latency health conditions.
• If an employer is unsure which records qualify as exposure or medical records, consult 1910.1020 for definitions and examples.

Employers must provide access to requested exposure and medical records promptly and within the time limit set in the standard: not to exceed 15 working days. Both 1926.33 and 1910.1020 require employers to furnish records to employees or their authorized representatives within that 15-working-day timeframe.

• Employers may provide records by allowing review at the workplace or by giving copies; if copies are requested, employers may charge a reasonable copying fee.
• If the employer needs more time, they should document the reason and notify the requester, but the standard’s limit remains the goal for timely access.

Yes, an employer may charge a reasonable fee for copying records but cannot refuse access because of cost. The access and retention rules in 1926.33 point to the record-access requirements in 1910.1020, which allow employers to recover reasonable copying costs when providing copies to employees or their authorized representatives.

• Charging for copies must not create an unreasonable barrier to access; employers typically may charge the actual cost of reproduction (paper, postage, or electronic delivery costs).
• If an employee chooses to review records onsite, employers should allow no-cost inspection.

No—employers cannot withhold employee exposure or medical records simply because they include trade secrets, but they must protect sensitive personal health information. The access rules in 1926.33 and 1910.1020 make clear that employees and their representatives are entitled to relevant records; trade secrets do not justify refusing access to an employee’s own exposure or medical records.

• Employers may redact bona fide trade-secret business data that is unrelated to the employee’s exposure or medical information, but personal health information must remain accessible.
• When redactions are made, document the reason and ensure the employee still receives all information necessary to understand their exposure and medical status.

An employee can designate a representative by giving the employer written authorization that identifies the representative and the scope of access; the employer may then provide records to that representative. 1926.33 directs users to 1910.1020, which requires written authorization (for privacy and verification) before an employer releases an employee’s records to a third party.

• Acceptable documentation typically includes a signed letter, a release form, or a power of attorney naming the representative.
• Employers should verify the authorization is valid (date, signature) before releasing records.

If an employer goes out of business or transfers operations, they must preserve and transfer employee exposure and medical records so employees can still access them. 1926.33 points to 1910.1020, which requires employers to notify employees where records will be transferred and to whom, and to ensure continued access after a sale, consolidation, or closure.

• Employers often transfer records to a successor employer, a government repository, or an agreed custodian and must inform affected employees of the new record location.
• Failure to preserve or transfer required records can be a violation of the standard.

Yes—OSHA inspectors have the authority to inspect and copy employee exposure and medical records as part of enforcement or investigation activities. The access provisions in 1926.33 refer to 1910.1020, which explicitly permits OSHA (and NIOSH) to review and copy records when carrying out inspections or investigations.

• Employers must make records available promptly to OSHA; withholding records can lead to citations and penalties.
• If records are kept offsite, employers must ensure they can produce them for an OSHA inspection within the timeframe required by the inspector.

Yes—employers may maintain exposure and medical records in electronic form so long as they remain accessible and preserved for the required retention period. 1926.33 refers employers to 1910.1020, which allows records in any format that ensures the record's integrity, confidentiality, and accessibility over the required retention period.

• Electronic systems must allow employees and authorized representatives to read and obtain copies in a timely manner.
• Employers should have backup and continuity plans so records are not lost during system failures or business changes.

Yes—any worker whose exposures or medicals are covered by the standard has the same rights to access their records, including subcontractors and temporary employees. 1926.33 adopts the access rules in 1910.1020, which apply to all employees who have workplace exposure or medical records maintained under the standard.

• Host employers and staffing agencies should coordinate to ensure temporary workers can obtain their records.
• If a subcontractor maintains the records, they must still comply with the same access, retention, and transfer obligations under 1910.1020.

The COVID-19 recordkeeping enforcement stay does not eliminate employer obligations under 1926.33 and 1910.1020; it only pauses enforcement of certain COVID-19-specific requirements in 29 CFR 1910.502. OSHA's memorandum explains that enforcement of COVID-19 log and reporting requirements in 29 CFR 1910.502 is stayed, but OSHA will continue to enforce general recordkeeping requirements under 29 CFR Part 1904 and existing access rules in 1910.1020. See the enforcement memorandum at https://www.osha.gov/laws-regs/standardinterpretations/2025-02-05 for details.

• In short: employers should continue to maintain exposure and medical records and provide access under 1910.1020 and 1926.33; only certain COVID-19-specific reporting requirements are currently not being enforced per the memorandum (https://www.osha.gov/laws-regs/standardinterpretations/2025-02-05).

Employers must make records available on request, and they should inform employees about that availability; the access rights and procedures are set out in 1910.1020, which applies to construction through 1926.33. While the standard does not prescribe a single required notice format, best practice is to communicate to employees—by poster, handbook, or training—that they may request and obtain their exposure and medical records.

• Employers should include who to contact, how to submit a request, and expected response time (the standard’s maximum is 15 working days for access).
• Clear internal procedures reduce delays and help meet the standard’s access requirements in 1910.1020.