Custody and confidentiality of employee medical records

June 14, 1991
Douglas C. Scott, M.D., M.P.H.
Western Center for Occupational and Environmental Medicine
[Recipient address omitted]
Dear Dr. Scott:
Thank you for writing to the Occupational Safety and Health Administration (OSHA). I am responding to your letter of May 2, 1991 to the OSHA Regional Office in Denver, Colorado regarding 29 CFR 1910.120 and [29 CFR 1926.1101]. The employer is required to establish and maintain a record for each employee that is subject to medical surveillance. In actual practice, the physician's office maintains physical custody of the records under agreement with the employer. Procedures need to be established to allow access, storage, transfer, and disposal of these records in accordance with 29 CFR 1910.1020, while keeping personal medical information confidential. The employee medical record in custody of the physician should include:

a. medical and employment questionnaires or histories including job description and occupational exposures, b. the results of medical examinations and laboratory tests including X-rays, spirometry, audiograms, etc., c. medical opinions, diagnoses, and recommendations, d. first aid records, e. descriptions of treatments and prescriptions, and f. employee medical complaints.

The physician's written opinion to the employer should not reveal specific findings, test results, or diagnoses unrelated to occupational exposures. Instead, it should include:

a. whether the employee has any medical condition that would place the employee at increased risk from occupational exposure, b. limitations to assigned work or use of protective equipment, c. a statement that the employee has been informed of the results of the medical examination, and d. (for [29 CFR 1926.1101]) a statement that the employee has been informed of the increased risk of lung cancer attributable to the combined effect of smoking and asbestos exposure.

The employer is required to provide to the physician:

a. a copy of the applicable standard and appendices,
b. a description of the employee's duties,
c. the employee's representative or anticipated exposure levels,
d. a description of personal protective equipment, and
e. information from previous medical examinations.

As you are aware, the exact wording of these standards can be found in the appropriate portion of the Code of Federal Regulations. Perhaps reviewing specific portions of these standards with your employer clients will help to establish who is responsible for what, assuring their employees' safe and healthful working conditions. If you need more information please do not hesitate to contact me or Dr. Angela Presson in [the OSHA Office of Occupational Medicine at (202) 693-2323]. Sincerely,

Richard F. Kuehne, M.D., M.P.A., M.P.H.
Medical Officer
Office of Occupational Medicine
[Corrected 4/18/2003]