Access to Employee Exposure and Medical Records is OSHA's standard, 29 CFR 1910.1020, that gives workers, their designated representatives and OSHA the right to see records of workers' exposure to toxic substances and harmful physical agents, along with related medical records. It also requires employers to keep those records for decades, often 30 years or more.
Occupational diseases such as cancers and lung disease can take years to appear. The standard makes sure the evidence of past exposure still exists, and can be reached, when a worker or doctor needs it. It applies to any employer that creates or has access to these records, whether or not another standard required them.
What Is 29 CFR 1910.1020?
29 CFR 1910.1020 sits in Subpart Z, Toxic and Hazardous Substances. It covers three kinds of records:
- Employee exposure records. Workplace monitoring results, such as personal, area, grab and wipe samples, with methods and background data. They also include biological monitoring that measures absorption of a substance, such as blood or urine levels, safety data sheets that indicate a possible health hazard, and, where nothing else exists, chemical inventories showing what was used, where and when.
- Employee medical records. Records about an employee's health made or kept by a physician, nurse or other health care personnel. These include questionnaires and histories, exam and lab results, medical opinions and diagnoses, first aid records, treatment descriptions and employee medical complaints.
- Analyses. Any compilation of data or statistical study based at least in part on exposure or medical records.
What is excluded
Under 1910.1020(c)(6)(ii), medical records do not include physical specimens routinely discarded, health insurance claims records kept separately and not accessible to the employer by name, records created only for litigation and privileged from discovery, and voluntary employee assistance program records kept separately from the employer's medical program.
Toxic substance or harmful physical agent
The standard applies to chemicals, biological agents and physical stresses such as noise, heat, vibration and radiation that appear in the latest printed edition of NIOSH's Registry of Toxic Effects of Chemical Substances (RTECS), that have shown evidence of an acute or chronic health hazard, or that are the subject of a safety data sheet indicating a possible hazard. In practice, this captures most substances employers monitor.
Who Must Comply?
Under 1910.1020(b), the standard applies to general industry, maritime and construction employers who make, maintain, contract for or have access to exposure or medical records of employees exposed to toxic substances or harmful physical agents. It applies whether or not a specific OSHA standard required the records, and whether they are kept in house or by a clinic, consultant or other contractor.
Employee is defined broadly. It includes current employees, former employees and employees being assigned or transferred to work involving exposure. If an employee is deceased or legally incapacitated, their legal representative may exercise these rights.
The standard creates a duty to preserve and provide access to records that exist. It does not by itself require employers to monitor exposure or perform medical exams. Those duties come from substance-specific standards such as the respirable crystalline silica standard. State-plan states may have equivalent or stricter rules.
Record Retention Requirements
1910.1020(d) sets long retention periods:
- Medical records: the duration of employment plus 30 years.
- Exposure records: at least 30 years.
- Analyses: at least 30 years.
There are limited exceptions:
- Medical records of employees who worked less than one year need not be retained beyond employment if they are given to the employee when employment ends.
- Records of one-time, minor first aid treatment made on site by a non-physician and kept separately need not be retained, provided there was no medical treatment, loss of consciousness, work or motion restriction or job transfer.
- Exposure background data, such as lab reports and worksheets, need only be kept for one year if the sampling results, sampling plan, methods and a summary of background data are kept for 30 years.
- Safety data sheets need not be kept for a fixed period if some record of the substance's identity, where it was used and when it was used is kept for at least 30 years.
Records may be kept in any form, including electronic, as long as the information is preserved and retrievable. Chest X-ray films must be kept in their original state. A substance-specific standard may set its own period for biological monitoring results.
Key Access Requirements
Response time and cost
When an employee or designated representative asks for a record, the employer must provide access in a reasonable time, place and manner. If access cannot be given within 15 working days, the employer must, within those 15 working days, explain the delay and give the earliest date the record will be available. The first copy is free, either as a copy, use of copying equipment or a loan of the record. Later copies may carry a reasonable, non-discriminatory charge.
Exposure records
Employees may see records of their own exposure. If none exist, they may see records of other employees with similar duties that reasonably indicate their exposure. A designated representative may request exposure records without employee consent by submitting a written request that states the occupational health need. A recognized collective bargaining agent counts as a designated representative for exposure records and analyses without written authorization.
Medical records
Each employee may see their own medical records. A designated representative needs the employee's specific written consent, which must include the elements in 1910.1020(c)(12) and generally lasts no more than one year. Appendix A provides a sample authorization letter. In limited cases involving a terminal illness or psychiatric condition, a physician may decide that direct access could harm the employee and provide the information through a designated representative instead.
OSHA access and trade secrets
The employer must promptly give OSHA access to exposure and medical records on request. If OSHA presents a written access order for personally identifiable medical information, the employer must post it for at least 15 working days. Employers may withhold trade secret information under 1910.1020(f), but must disclose a specific chemical identity immediately to a treating physician or nurse in a medical emergency.
Employee Notice and Transfer of Records
Under 1910.1020(g), employers must inform employees when they are first hired, and at least annually after that, about the existence, location and availability of these records, the person responsible for maintaining them and their rights of access. The employer must keep a copy of the standard and its appendices available to employees.
Under 1910.1020(h), when an employer ceases to do business, it must transfer all records to the successor employer. If there is no successor, it must notify affected current employees of their access rights at least 3 months before ceasing to do business.
Common Compliance Mistakes
- Purging records too early. Applying a general seven-year document policy to exposure monitoring and medical files.
- Losing records with a vendor. Leaving records with an industrial hygiene consultant or clinic and losing track of them when the contract ends.
- Skipping the annual notice. Never telling employees that records exist and how to request them.
- Missing the 15 working day window. No process to route and answer requests from current or former employees.
- Mixing medical and personnel files. Storing medical records where supervisors can see them.
- Forgetting records in a sale or closure. No plan for transferring records to a successor.
OSHA adjusts its maximum penalty amounts each year; see OSHA's penalties page for current figures.
How to Comply: Step by Step
- Inventory your records. Find every exposure monitoring report, biological monitoring result, medical surveillance file and analysis, including those held by contractors.
- Set retention rules. Apply employment plus 30 years for medical records and 30 years for exposure records and analyses, and stop routine destruction of these files.
- Separate medical files. Keep medical records confidential and limit access to health care personnel and authorized staff.
- Name a records custodian. Assign a person responsible for maintaining records and answering requests.
- Build a request process. Log each request, verify written consent when required and respond within 15 working days.
- Notify employees. Give the required notice at hire and at least annually, for example in onboarding and in an annual hazard communication refresher.
- Plan for transitions. Include record transfer in contracts with vendors and in any sale or closure plan.
How SMS360 Helps
SMS360's Document Library gives EHS teams a central place to store exposure monitoring reports, safety data sheets and related records, with permissions that limit who can see sensitive files. Documents can be organized by site, substance or employee group and retrieved quickly when a request comes in. Tasks and reminders help keep annual employee notices and periodic records reviews on schedule.
Frequently Asked Questions
How long must employers keep employee exposure records?
Exposure records must be kept for at least 30 years under 29 CFR 1910.1020(d). Some background data, such as lab worksheets, may be kept for one year if the sampling results, methods and a summary are kept for 30 years. A substance-specific standard may set different rules for biological monitoring.
How long must employee medical records be kept?
Medical records must be kept for the duration of employment plus 30 years. Exceptions include separately kept health insurance claims records, certain minor first aid records and records of employees who worked less than one year if those records are given to the employee when they leave.
How quickly must an employer respond to a records request?
The employer must provide access in a reasonable time, place and manner. If it cannot do so within 15 working days, it must explain the delay within that period and state the earliest date the record will be available. The first copy must be provided at no cost.
Can former employees request their records?
Yes. The standard defines employee to include former employees, so they keep the right to access their own exposure and medical records. For a deceased or incapacitated employee, a legal representative may exercise that right.
