OSHA's Other Recordkeeping Standard: Access to Employee Exposure and Medical Records

hen most people hear the phrase "OSHA recordkeeping," they think of the log of occupational illnesses and injuries required by 29 CFR104, but OSHA has another recordkeeping standard. It is not recordkeeping in the sense of collecting statistical data, but recordkeeping in the literal sense, retaining records, and the retention period is significant at least 30 years.

So what is this other recordkeeping regulation? It is "Access to Employee Exposure and Medical Records," 29 CFR1910.1020. It may be viewed as a companion standard to the hazard communication rule. While hazard communication requires that employees be informed of the hazards posed by chemicals to which they may be exposed and the precautions to take when working with those chemicals, "Access to Exposure and Medical Records" allows them to examine the results of monitoring that measured their level of exposure to those chemicals, and any medical records that might provide information about whether or not their health status was affected by their exposure. Unlike hazard communication, which addresses only chemical hazards, the access rule also includes exposure to biological hazards such as bacteria, viruses and fungi, and physical hazards such as radiation and vibration.

Many OSH practitioners are blissfully unaware of the obligation to retain certain records, such as the results of employee air sampling, for three decades. Three factors contribute to this ignorance. First, the standard's title is deceptive. While it clearly indicates that employees must be allowed to see certain records, there is no hint that records including the results of employee exposure monitoring such as air sampling or wipe tests for lead must be kept for what amounts to a working lifetime. The second factor contributing to the oversight is that many of the cognoscente often refer to the regulation by an abbreviated title, "access to medical records," leading the uninitiated to incorrectly infer that the regulation pertains primarily or even exclusively to medical records. Third, the regulation does not garner high-profile enforcement activity as other regulations that more obviously directly protect workers, such as confined spaces or trenching and excavating.

A word of caution about this last point enforcement. Many years ago, violations related to maintaining the log of occupational illness and injuries were often viewed dismissively. That all changed when OSHA became more concerned about ergonomic hazards and started to cite certain meat packers for violations of the recordkeeping standard for failing to record injuries caused by repetitive motion. Moreover, in some situations, each case of failing to record an employee's injury counted as a separate violation. Consequently, the fines imposed by these violations were often substantial.

By analogy, OSHA may one day decide that each record that an employee was not allowed to access might count as a separate violation. Thus, a ream of denied documents could translate into 500 violations. Since failing to inform employees that they have a right to access certain documents is a violation, employers who have not informed their employees of this right could conceivably be cited for each employee they failed to inform or perhaps even for each releasable record in their file. Far-fetched perhaps, but before OSHA took an active interest in ergonomics, $100,000 citations for failing to log an occupational illness or injury were unheard of.

What is a Record?

As Lewis Carroll once wrote, the best place to begin is at the beginning. In that light, the standard defines a record as "any item, collection or grouping of information regardless of the form or process by which it is maintained (e.g., paper document, microfiche, microfilm, X-ray film or automated data processing)." The standard further differentiates between exposure records and medical records:

Medical record. The standard defines an employee medical record as "a record concerning the health status of an employee which is made or maintained by a physician, nurse or other health care personnel, or technician." Medical records include:

• Medical and employment questionnaires or histories (including job description and occupational exposures).
• The results of medical examinations (pre-employment, pre-assignment, periodic or episodic) and laboratory tests (including chest and other X-ray examinations taken for the purpose of establishing a baseline or detecting occupational illnesses and all biological monitoring not defined as an "employee exposure record").
• Medical opinions diagnoses, progress notes, and recommendations.
• First aid records.
• Descriptions of treatments and prescriptions.
• Employee medical complaints.

While at first glance this list looks overwhelming, there are a number of exceptions provided. These exceptions include medical information in the form of:

• Physical specimens(e.g., blood or urine samples) that are routinely discarded as a part of normal medical practice.
• Records concerning voluntary employee assistance programs. (Alcohol, drug abuse or personal counseling programs) if maintained separately from the employer's medical program and its records.
• Records concerning health insurance claims. If maintained separately from the employer's medical program and its records, and not accessible to the employer by employee name or other direct personal identifier such as Social Security number, payroll number, etc.), or
• Records created solely in preparation for litigation that are privileged from discovery under the applicable rules of procedure or evidence.

Employee exposure records. The standard defines an "employee exposure record" as a record containing any of the following kinds of information:

• Environmental (workplace) monitoring or measuring of a toxic substance or harmful physical agent, including personal, area, grab, wipe or other form of sampling, as well as related collection and analytical methodologies, calculations and other background data relevant to interpretation of the results obtained.
• Biological monitoring results which directly assess the absorption of a toxic substance or harmful physical agent by body systems (e.g., the level of a chemical in the blood, urine, breath, hair, fingernails, etc.) but not including results that assess the biological effect of a substance or agent or which assess an employee's use of alcohol or drugs.
• Material safety data sheets. Indicating the material may pose a hazard to human health; or in their absence, a chemical inventory or any other record which reveals where and when used and the identity (e.g., chemical, common or trade name) of a toxic substance or harmful physical agent.

Access Rule: Chemical Hazards and More

Unlike the hazard communication rule that pertains only to chemical hazards, "toxic substance or harmful physical agent" as defined by the access regulation means "any chemical substance, biological agent ( bacteria, virus, fungus, etc.) or physical stress (noise, heat, cold, vibration, repetitive motion, ionizing and nonionizing radiation, hypo- or hyperbaric pressure, etc.)" which is:

• Listed in the latest printed copy of the NIOSH registry of toxic effects of chemical substances
• Has yielded positive evidence of an acute or chronic health hazard in testing conducted by, or known to, the employer
• Is the subject of a material safety data sheet kept by, or known to, the employer indicating that the material may pose a hazard to human health.

As a practical matter, this means that records concerning exposure to biological hazards such as mold, ergonomic stresses or radiation would be considered employee exposure records. For example, evaluations of exposure to ultraviolet light emitted from welding operations, or exposure to radiofrequency energy at a transmitting antenna tower or microwave dish, or evaluation of repetitive motion stresses posed by working on an assembly line, would all be considered to be exposure records.

Exposure to mold is much in the news theses days, since biological hazards are included in the definition of toxic substance or harmful physical agent. What about all the microbial contaminants measured during an indoor air quality survey? OSHA answered that question in an August 2002 letter of interpretation. Richard E. Fairfax, then director of OSHA's directorate of enforcement programs, explained "that if the [biological agent(s)] [mold] meet the definition of a toxic substance or harmful physical agent, the sampling results are employee exposure records." But Fairfax further commented that "in many cases the tests indicate the bacteria or fungi levels of contamination is non-toxic, is typical of office/work environments, and reflects background levels of contamination. These records would not be considered employee exposure records under 1910.1020. On the other hand, if test results show the existence of a toxic bacteria such as Stachybotrys chartarum, the records would be considered to be employee exposure records because of the known health hazards associated with the bacteria."

Retention Requirements

The access rule does not specify the form, manner or process by which an employer preserves a record so long as the information contained in the record is preserved and retrievable, except that chest X-ray films must be preserved in their original state.

Employee medical records. The medical record for each employee must be preserved and maintained for at least the duration of employment plus 30 years, unless a specific occupational safety and health standard provides a different period of time. For example, the noise standard, 29 CFR1910.95, requires that noise exposure measurement records be retained for only two years and that audiometric test records be retained for the duration of the affected employee's employment. There are exceptions made for:

• Employees who have worked less than a year for an employer. The medical records of these employees need not be retained beyond the term of employment if they are provided to the employee upon the termination of employment.
• Health insurance claims records maintained separately from the employer's medical program and its records.
• First aid records (not including medical histories) of one-time treatment and subsequent observation of minor scratches, cuts, burns, splinters and the like which do not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job, if made on-site by a non-physician and if maintained separately from the employer's medical program and its records.

Employee exposure records. Employee exposure records similarly must be preserved and maintained for at least 30 years, except that:

• Background data to environmental (workplace) monitoring or measuring, such as laboratory reports and worksheets, need only be retained for 1 year so long as the sampling results, the collection methodology (sampling plan), a description of the analytical and mathematical methods used, and a summary of other background data relevant to interpretation of the results obtained, are retained for at least 30 years
• Biological monitoring results designated as exposure records by specific occupational safety and health standards shall be preserved and maintained as required by the specific standard.
• Material safety data sheets and chemical inventory lists concerning the identity of a substance or agent need not be retained for any specified period as long as some record of the identity (chemical name, if known) of the substance or agent, where it was used and when it was used is retained for at least 30 years. Material safety data sheets must be kept for those chemicals currently in use that are affected by the hazard communication standard in accordance with 29 CFR 1910.1200(g)

What is Access and Who Gets It?

Access in the context of the rule means not only the right and opportunity to examine records but also to copy them if so desired. Upon request for a copy of a releasable document, an employee must either be provided with a copy or with the facilities to make a photocopy at no charge.

Access by employees. Employees are entitled to access medical records of which they are the subject. An exception is when an employee requests access to his or her medical records and a physician representing the employer believes that direct employee access to information contained in the records regarding a specific diagnosis of a terminal illness or psychiatric condition could be detrimental to the employee's health. In that case, the employer may inform the employee that access will only be provided to a designated representative of the employee having specific written consent, and deny the employee's request for direct access to this information only. In such a case, the employer must ensure the access of the designated representative to this information even when it is known that he or she will give the information to the employee.

Unless protected as a trade secret, employees have a right to access exposure records that are relevant to them. Relevant exposure records are not limited to records that show an employee's individually specific exposure to a toxic substance. In the absence of directly relevant records, such as personal sampling conducted on the requesting employee, records of other employees with past or present job duties or working conditions similar to those of the employee that could indicate the amount and nature of the toxic substances or harmful physical agents to which the employee has been exposed, are also considered relevant.

For example, consider two spray painters painting opposite ends of a rail car. Personal samples collected on one painter would be indicative of the exposure to the other painter if they were using the same materials and the nature of their jobs and work practices were similar. Thus, the sampling results would be relevant to both painters.

Access by a designated representative. An employee may provide written authorization for access to an individual or an organization for the purpose of access to employee exposure records or analyses using exposure or medical records. For example, an employee might designate a spouse, personal physician or safety and health consultant to serve as a designated representative. In fact, appendix A to the standard is a sample authorization letter for the release of employee medical record information to a designated representative.

A recognized or certified collective bargaining agent is treated automatically as a designated representative without regard to written employee authorization.

Access by OSHA. Representatives of the Secretary of Labor are also granted access to records and the manner by which OSHA may gain access is explained in 29 CFR 1913.10. It explains how OSHA must preserve confidentiality of certain medical information.

Preservation and Transfer of Records

Whenever an employer is ceasing to do business, the employer must transfer all records subject to the regulation to the successor employer. The successor employer must receive and maintain these records.

When there is no successor employer, the employer must notify affected current employees of their right to access to records at least three months prior to the cessation of the employer's business.

When an employer either is ceasing to do business and there is no successor to receive and maintain the records or intends to dispose of any records required to be preserved for at least 30 years, the employer must notify the director of NIOSH in writing of the impending disposal of records at least three months prior to their disposal and transfer the records to the director of NIOSH if so required by a specific OSHA standard.

An employee may grant written authorization to any individual or organization to exercise the employee's right of access for the purpose of providing access to employee exposure records and analyses using exposure records or medical records such as an epidemiological study prepared by a university. A recognized or certified collective bargaining agent must be treated automatically as a designated representative without regard to written authorization.

Upon request by an employee or designated representative to access those records relevant to the employee, access must be provided at a reasonable time, place and manner within 15 working days. If the employer cannot reasonably provide access to the record within 15 working days, the employer must tell the requester within 15 days of the reason for the delay and the earliest date that the record can be made available.

Protection of Trade Secret Information

The access rule's provisions for protection of trade secrets are essentially the same as those under hazard communication. A trade secret is defined as "any confidential formula, pattern, process, device or information or compilation of information that is used in an employer's business that gives the employer an opportunity to obtain an advantage over competitors who do not know or use it."

An employer can withhold trade secret information in an otherwise disclosable record provided that three conditions are met. First, the claim that the information being withheld is a trade secret can be supported. Second, the employer informs the requesting party that the specific chemical identity is being withheld as a trade secret. And third, all other available information on the properties and effects of the toxic substance is disclosed.

There is also a provision for release of trade secret information in an emergency. When a treating physician or nurse determines that a medical emergency exists and the specific chemical identity is necessary for emergency or first aid treatment, the employer must immediately disclose the specific chemical identity of a trade secret chemical to them. However, the employer may require a written statement of need and confidentiality agreement as soon as circumstances permit. The agreement may stipulate that use of the information is restricted to specific health purposes and may provide for legal remedies including a stipulation of a reasonable pre-estimate of likely damages in the event of breach of the agreement. However, it may not include a requirement for posting a penalty bond.

Contributing Editor John F. Rekus, PE, CIH, CSP, is an independent consultant. He has more than 20 years of regulatory experience and may be reached at (410) 583-7954.