Who retains employee medical records?
Employers must retain employees' medical records for the duration of their employment plus 30 years. Employers, however, may not be the entity actually holding those records. The OSHA regulation at 1910.1020 defines an employee medical record as “a record concerning the health status of an employee which is made or maintained by a physician, nurse, or other health care personnel or technician” (emphasis added).
For example, the medical evaluation questionnaire required by 1910.134, Respiratory Protection, is a medical record. Employers, however, do not necessarily retain the questionnaire but only retain the health care professional’s written recommendation.
As another example, an employer must create and maintain a record for each employee subject to medical surveillance under an OSHA standard, such as employees exposed to lead. In actual practice, the physician’s office maintains physical custody of the records under an agreement with the employer. This requires establishing procedures to allow access, storage, transfer, and disposal of these records per 1910.1020, while keeping personal medical information confidential.
What does each entity retain?
The employee medical record retained by the physician should include:
- Medical and employment questionnaires or histories including the job description and occupational exposures;
- The results of medical examinations and laboratory tests including X-rays, spirometry, audiograms, etc.;
- Medical opinions, diagnoses, and recommendations;
- First aid records;
- Descriptions of treatments and prescriptions; and
- Employee medical complaints.
The physician’s written opinion to the employer should not reveal specific findings, test results, or diagnoses unrelated to occupational exposures. Instead, among other things, it should include:
- Whether the employee has any medical condition that would place the employee at increased risk from occupational exposure,
- Limitations to assigned work or use of protective equipment, and
- A statement that the employee has been informed of the results of the medical examination.
The employer is required to provide to the physician:
- A copy of the applicable OSHA standard and appendices,
- A description of the employee’s duties,
- The employee’s representative or anticipated exposure levels,
- A description of personal protective equipment, and
- Information from previous medical examinations.
In addition, employers may have “employee exposure records” that must be retained for 30 years. Examples include the results of workplace monitoring for things like noise or other sampling, as well as information on chemical exposure.
Key to remember: The medical office, not the employer, likely retains most medical records, but the employer must ensure employee access.
