Under 2400.5(a): What must the Privacy Officer do when an individual requests access to their medical records (including psychological records)?
The Privacy Officer must make a preliminary determination about whether giving the requester access could have an adverse effect on the requester. If the Privacy Officer determines access could be harmful, OSHRC must notify the requester in writing and advise that the records can be released only to a physician the requester designates. See 2400.5(a).