OSHA AI Agent
Get instant answers to any safety question.
Request Demo
OSHA 2400.5

Medical record access procedures

14 Questions & Answers

Questions & Answers

Under 2400.5(a): What must the Privacy Officer do when an individual requests access to their medical records (including psychological records)?

The Privacy Officer must make a preliminary determination about whether giving the requester access could have an adverse effect on the requester. If the Privacy Officer determines access could be harmful, OSHRC must notify the requester in writing and advise that the records can be released only to a physician the requester designates. See 2400.5(a).

Under 2400.5(a): Does this rule apply to psychological records as well as other medical records?

Yes — the rule explicitly covers psychological records as well as any other medical records about the requester. The regulation states the Privacy Officer must consider psychological records when deciding whether access could have an adverse effect. See 2400.5(a).

Under 2400.5(b): What steps must be completed before OSHRC forwards medical records to a physician designated by the requester?

OSHRC must complete three steps before forwarding the records: (1) the requester must inform OSHRC of the designated physician's identity, (2) OSHRC must verify the physician's identity, and (3) the physician must agree to review the records with the requester to explain them and provide counseling to temper any adverse reaction. See 2400.5(b) and the subparagraphs 2400.5(b)(1), 2400.5(b)(2), and 2400.5(b)(3).

Under 2400.5(b)(1): What does the requester need to provide to OSHRC to designate a physician?

The requester must inform OSHRC of the identity of the physician they designate to receive and review the records. The regulation does not prescribe the form of that notice, only that OSHRC be informed of the physician's identity. See 2400.5(b)(1).

Under 2400.5(b)(2): Is OSHRC required to verify the identity of the designated physician before releasing records, and does the standard say how to verify it?

Yes — OSHRC must verify the designated physician's identity before releasing records, but the standard does not specify particular methods for verification. It only requires that OSHRC has verified the physician's identity. See 2400.5(b)(2).

Under 2400.5(b)(3): What must the designated physician agree to before OSHRC can release medical records to them?

The designated physician must agree to review the records with the requester, explain what the records mean, and offer counseling aimed at tempering any adverse reaction the requester might have. This agreement is a condition for OSHRC to forward the records. See 2400.5(b)(3).

Under 2400.5(c): What happens if the requester does not designate a physician or respond within 60 calendar days after OSHRC asks for a designation?

If the requester fails to respond or designate a physician within 60 calendar days of OSHRC's written request, OSHRC will hold the records in abeyance and inform the requester that this may be treated as a technical denial; OSHRC must also advise the requester of rights to administrative appeal and judicial review in a U.S. district court. See 2400.5(c).

Under 2400.5(c): What happens if the designated physician refuses to agree to the release conditions?

If the designated physician fails to agree to the release conditions, OSHRC will hold the records in abeyance and notify the requester that this may be construed as a technical denial; OSHRC must also advise the requester of administrative appeal rights and the right to judicial review in a U.S. district court. See 2400.5(c).

Under 2400.5: If the Privacy Officer decides access will not have an adverse effect, can the requester get their records directly?

Yes — if the Privacy Officer determines that access would not have an adverse effect on the requester, the restriction that limits release to a designated physician does not apply, and the records may be made available to the requester. This follows from the requirement that the Privacy Officer first determine whether access could have an adverse effect. See 2400.5(a).

Under 2400.5(b): Must the person designated by the requester be a physician, or can they be another kind of clinician?

The regulation requires release to a physician designated by the requester when access could have an adverse effect; it specifically uses the term "physician." The text does not provide for designations of other types of clinicians in place of a physician. See 2400.5(b).

Under 2400.5(b)(3): Does the physician need to be physically present with the requester when reviewing the records?

The regulation requires the physician to agree to review the records with the requester and provide explanation and counseling, but it does not specify whether that review must be in-person; the key requirement is the physician's agreement to carry out the review and counseling. See 2400.5(b)(3).

Under 2400.5: What records are covered by this access procedure?

The procedure covers any medical record about the requester, explicitly including psychological records. In short, any medical or psychological record pertaining to the requester is subject to these access and restriction rules. See 2400.5(a).

Under 2400.5(c): If OSHRC holds records in abeyance and the requester appeals, what rights must OSHRC advise the requester about?

OSHRC must advise the requester of the right to an administrative appeal and the right to seek judicial review in a district court of the United States. The regulation requires OSHRC to provide this advisement when records are placed in abeyance and may be construed as a technical denial. See 2400.5(c).

Under 2400.5: If a requester designates a physician, can OSHRC send the records to that physician before OSHRC verifies the physician's identity and gets the physician's agreement?

No — OSHRC must verify the physician's identity and obtain the physician's agreement to review and counsel the requester before forwarding the records. Both verification and the physician's agreement are explicit prerequisites to release. See 2400.5(b)(2) and 2400.5(b)(3).