The Occupational Safety and Health Administration (OSHA) requires maintaining medical and exposure records under 1910.1020. The standard covers records documenting the amount of employee exposure to toxic substances and harmful physical agents. This section applies to all employers who have employees exposed to toxic substances or harmful physical agents that may include:

• Metals and dusts such as lead, cadmium, and silica.
• Biological agents such as bacteria, viruses, and fungi.
• Physical stress such as noise, heat, cold, vibration, repetitive motion, and ionizing and non-ionizing radiation.

Employees who are or may be exposed to toxic substances or harmful physical agents must be given access to their medical and exposure records. This access is designed to improve the detection, treatment, and prevention of occupational disease. Further, OSHA requires that employers maintain such records for a long period of time because the symptoms of illnesses that come from the exposure may not appear until many years later.

• Key terms about medical and exposure records are defined in this section.

Access: The right and opportunity to examine and copy.

Designated representative: Any individual or organization to whom an employee gives written authorization to exercise a right of access. For the purposes of access to employee exposure records and analyses using exposure or medical records, a recognized or certified collective bargaining agent shall be treated automatically as a designated representative without regard to written employee authorization.

Employee: A current employee, a former employee, or an employee being assigned or transferred to work where there will be exposure to toxic substances or harmful physical agents. In the case of a deceased or legally incapacitated employee, the employee’s legal representative may directly exercise all the employee’s rights pertaining to 1910.1020.

Employee exposure record: A record containing any of the following kinds of information:

• Environmental (workplace) monitoring or measuring of a toxic substance or harmful physical agent, including personal, area, grab, wipe, or other form of sampling, as well as related collection and analytical methodologies, calculations, and other background data relevant to interpretation of the results obtained;
• Biological monitoring results which directly assess the absorption of a toxic substance or harmful physical agent by body systems (e.g., the level of a chemical in the blood, urine, breath, hair, fingernails, etc.) but not including results which assess the biological effect of a substance or agent or which assess an employee’s use of alcohol or drugs;
• Safety Data Sheets indicating that the material may pose a hazard to human health; or
• In the absence of the above, a chemical inventory or any other record which reveals where and when used and the identity (e.g., chemical, common, or trade name) of a toxic substance or harmful physical agent.

Employee medical record: A record concerning the health status of an employee which is made or maintained by a physician, nurse, or other health care personnel or technician, including:

• Medical and employment questionnaires or histories (including job descriptions and occupational exposures);
• The results of medical examinations (pre-employment, pre-assignment, periodic, or episodic) and laboratory tests (including chest and other X-ray examinations taken for the purpose of establishing a baseline or detecting occupational illnesses and all biological monitoring not defined as an “employee exposure record”);
• Medical opinions, diagnoses, progress notes, and recommendations;
• First aid records;
• Descriptions of treatments and prescriptions; and
• Employee medical complaints.

“Employee medical record” does not include medical information in the form of: (1) Physical specimens (e.g., blood or urine samples) which are routinely discarded as a part of normal medical practice; (2) Records concerning health insurance claims if maintained separately from the employer’s medical program and its records, and not accessible to the employer by employee name or other direct personal identifier (e.g., Social Security number, payroll number, etc.); (3) Records created solely in preparation for litigation which are privileged from discovery under the applicable rules of procedure or evidence; or (4) Records concerning voluntary employee assistance programs (alcohol, drug abuse, or personal counseling programs) if maintained separately from the employer’s medical program and its records.

Exposure or exposed: An employee is subjected to a toxic substance or harmful physical agent in the course of employment through any route of entry (inhalation, ingestion, skin contact or absorption, etc.), and includes past exposure and potential (e.g., accidental or possible) exposure, but does not include situations where the employer can demonstrate that the toxic substance or harmful physical agent is not used, handled, stored, generated, or present in the workplace in any manner different from typical non-occupational situations.

Record: Any item, collection, or grouping of information regardless of the form or process by which it is maintained (e.g., paper document, microfiche, microfilm, X-ray film, or automated data processing).

Toxic substance or harmful physical agent: Any chemical substance, biological agent (bacteria, virus, fungus, etc.), or physical stress (noise, heat, cold, vibration, repetitive motion, ionizing and non-ionizing radiation, hypo- or hyperbaric pressure, etc.) which:

• Is listed in the latest printed edition of the National Institute for Occupational Safety and Health (NIOSH) Registry of Toxic Effects of Chemical Substances (RTECS); or
• Has yielded positive evidence of an acute or chronic health hazard in testing conducted by, or known to, the employer; or
• Is the subject of a safety data sheet kept by or known to the employer indicating that the material may pose a hazard to human health.

• Requirements for covered employers include workplace assessment, maintaining accurate medical and exposure records for employees, providing employee access to their records, and more.

Covered employers must:

• Assess the workplace for any toxic substance or harmful physical agent exposures that may generate medical or exposure records.
• Preserve and maintain accurate medical and exposure records for each employee.
• Keep employee medical records for at least the duration of employment plus 30 years.
• Keep employee exposure records for at least 30 years.
• Provide employees access to their medical and exposure records and make records available to employees’ designated representatives, and to the Occupational Safety and Health Administration (OSHA).
• Inform employees annually of the existence and location of medical and exposure records and the process and rights for accessing them.

Note: In 2019, OSHA removed the requirement for employers to use Social Security numbers to identify employees in exposure monitoring, medical surveillance, and other records. However, OSHA does not require employers to remove Social Security numbers from existing records. Further, OSHA does not prohibit employers from continuing to use Social Security numbers to identify employees. Employers are simply no longer required to include employee Social Security numbers in those records.

• Employees must be notified of the existence, location, and availability of their medical and exposure records, and must be allowed to access such records in a reasonable amount of time.

At the time of initial employment and at least annually thereafter, employees must be told of the existence, location, and availability of their medical and exposure records. Additionally, employers must:

• Inform them of their rights under the access standard;
• Make copies of the standard available; and
• Inform them of who is responsible for maintaining and providing access to records.

The term “access” implies that access must be provided in a reasonable manner and place. If an employer can’t provide the material within 15 days after an employee’s request, the employer must state the reason for the delay and the earliest date when the records will be made available.

Responses to initial requests and new information that has been added to an initial request must be provided without cost to the employee or representative. Employers may:

• Give employees copies of the requested records,
• Provide the records and facilities for copying them, or
• Lend employees their records for copying offsite.

In addition, employers must make medical and exposure records available, on request, to Occupational Safety and Health Administration (OSHA) representatives to examine and copy.

Analyses using exposure or medical records

Employees may also access any analyses (compilations of data or statistical studies) of employee medical and exposure records that concern their working conditions or workplaces.

If an analysis includes information that could be used to directly or indirectly identify individual employees, the employer must remove these identifiers to the extent possible before permitting employee access to the analysis. Examples of identifiers include an employee’s name, address, Social Security number, and job title.

• Employers are required to provide employees and their designated representatives access to any medical records relevant to the employee.
• Some types of records, such as physical samples or records concerning health insurance claims, may not be subject to the standard.

Employees may access any employee medical records concerning their health status that were created or maintained by a physician, nurse, health care professional, or technician. Employee medical records include the following:

• Medical and employment questionnaires or histories.
• Results of medical examinations and laboratory tests.
• Medical opinions, diagnoses, progress notes, and recommendations.
• First-aid records.
• Descriptions of treatments and prescriptions.
• Employee medical complaints.

Employers are required to provide employees and their designated representatives access to medical records relevant to the employee. Access to the medical records of another employee may be provided only with the specific written consent of that employee.

Prior to employee access to medical records, physicians, on behalf of employers, are encouraged to discuss with employees the contents of their medical records. Physicians also may recommend ways of disclosing medical records other than by direct employee access. Where appropriate, a physician representing the employer can elect to disclose information on specific diagnoses of terminal illness or psychiatric conditions only to an employee’s designated representative, and not directly to the employee.

In addition, a physician, nurse, or other responsible healthcare person who maintains medical records may delete from requested medical records the names of persons who provided confidential information concerning an employee’s health status.

Records not covered

The following are not considered “medical records” under this standard:

• Physical specimens, such as blood and urine samples.
• Records concerning health insurance claims if they are (1) maintained separately from your medical program and its records, and (2) not accessible by employee name or other personal identifier (e.g., Social Security number or home address).
• Records created only for use in litigation that are privileged from discovery.
• Records created as part of voluntary employee assistance programs, such as records for alcohol and drug abuse or personal counseling, if they are maintained separately from your medical program and its records.
• Trade secret information involving manufacturing processes or a percentage of a chemical substance in a mixture, as long as the employer informs health professionals and employees and their designated representatives that it deleted that information from medical and exposure records. If the exclusion of the trade secret information substantially impairs the evaluation of when and where the exposure occurred, however, employers must provide alternative information consistent with 1910.1020.

• Employees may access any employer records of exposure to a toxic substance. If such records are not available for that employee, the employer must provide records from other employees (with personal identifying information removed) who are likely to have had similar exposures.
• Employees may also access records that indicate the likely exposure they might reasonably experience when being assigned or transferred to a new area or task in the workplace.

Exposure records must reasonably indicate the identity, amount, and nature of the toxic substances or harmful physical agents to which the employee has been exposed.

Employees may access any employee exposure records that show the measuring or monitoring of their own exposure to a toxic substance or harmful physical agent.

If the employer does not have any records that specifically chart an employee’s exposure levels, the employer must provide records of other employees (with personal identifiers removed) whose job duties or working conditions reasonably indicate the amount and nature of exposures the requesting employee may have had. Access to these records does not require the written consent of the other employees.

Employers also may be required to supply exposure records that reasonably indicate the amount and nature of toxic substances or harmful physical agents at a particular workplace, or used in a specific working condition, to which the requesting employee is being assigned or transferred.

Employee exposure records include the following:

• Monitoring results of workplace air or measurements of toxic substances or harmful physical agents in the workplace, including personal, area, grab, wipe, or other forms of sampling results.
• Biological monitoring results, such as blood and urine test results.
• Safety Data Sheets (SDSs) containing information about a substance’s hazards to human health.

Union representatives have to indicate an occupational health need for requested records if they do not have written authorization of the employee(s) involved.

• When releasing records, employers may delete information that would expose trade secrets, but must state that such deletions have been made. If the deletion impairs the evaluation of an employee exposure, employers must provide alternative information as needed to protect employee health.

The Occupational Safety and Health Administration (OSHA) allows employers to delete trade secrets that disclose manufacturing processes or the percentage of a chemical substance in a mixture, but employers must state when such deletions are made. When deletion impairs the evaluation of where or when exposure occurs, employers must provide sufficient alternative information needed to protect employee health.

Where it is necessary to protect employee health, employers may be required to release trade secret information but condition access on a written agreement not to abuse the trade secret or to disclose the chemical’s identity.

• In most cases, employers must retain exposure records for at least 30 years, and employee medical records for the duration of employment plus 30 years.

Employers must preserve and maintain accurate medical and exposure records for employees. Section 1910.1020 applies to any medical or exposure records created in compliance with other the Occupational Safety and Health Administration (OSHA) rules or at the employer’s own volition.

OSHA does not mandate the form, manner, or process for preserving records, except that chest X-ray films must be preserved in their original state.

Keep exposure records and data analyses based on them for at least 30 years, except that:

• Background data related to environmental, or workplace, monitoring or measuring (such as laboratory reports and worksheets) must only be retained for one year, so long as the employer preserves certain interpretive documents relevant to the interpretation of the data for 30 years.
• Safety Data Sheets (SDSs) and other specified records concerning the identity of a substance or agent need not be retained, so long as the employer keeps some record of the identity, preferably the chemical name and information on when and where it was used, for 30 years.
• Biological monitoring results designated as exposure records by specific OSHA standards must be preserved and maintained as required by the specific standard governing their use.
• Analyses using medical or exposure records must be retained for at least 30 years.

Keep medical records for at least the duration of employment plus 30 years, except for:

• Health insurance claims records maintained separately from the medical program and its records.
• First-aid records made onsite by a non-physician of one-time treatment and later observations of minor scratches, scrapes, or other injuries that did not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job.
• Medical records of employees who have worked for less than one year, as long as the employer offers all such records to the employee upon termination of employment.

Note: Maintaining temperature records or asking workers to complete written questionnaires will qualify as "medical records" under 1910.1020 if made or maintained by a physician, nurse, or other health care personnel, or technician. However, if employers do not record workers' temperatures, or if workers' temperatures are recorded but not made or maintained by a health care personnel or technician, then simply taking a temperature would not amount to a record that must be retained.

• If a company goes out of business, medical and exposure records must be passed on to the successor employer.
• If there is no successor, employers must inform employees of their access rights, and either transfer such records to NIOSH, or notify NIOSH of the employer’s intent to dispose of the records.

If a company ceases to do business, it must provide the successor employer with all employee medical and exposure records.

When there is no successor to receive the records, the employer must inform the current affected employees of their access rights at least three months prior to the cessation of business.

The employer also must either transfer the records required to be preserved to the National Institute for Occupational Safety and Health (NIOSH), or notify the Director of NIOSH in writing of its intent to dispose of the records three months before that disposal.