Sharing employee medical and exposure records

October 24, 2013

Marc Garland, CSP

Safety Director

Precision Environmental Co.

[Recipient address omitted]

Dear Mr. Garland,

Thank you for your June 17, 2013, letter to the Occupational Safety and Health Administration’s (OSHA’s) Directorate of Enforcement Programs. You requested guidance concerning OSHA requirements addressing the release of employee exposure and medical records to persons other than the employee. Your questions are paraphrased below followed by our responses. This letter constitutes OSHA’s interpretation only of the requirements discussed and may not be applicable to any question not detailed in your original correspondence.

Background: Precision Environmental Company is an asbestos abatement contractor that often receives requests to provide copies of written employee medical opinions and exposure monitoring results, including negative exposure assessments. These requests, which are not made by employees or their representatives, are typically from project oversight consultants, project owners, or state and local inspectors. In some cases, the request for records is made just prior to issuance of final project payment.

Question 1: Can other persons such as, but not limited to, project oversight consultants, project owners, or state and local inspectors legally request access to employee medical and exposure records?

Response: OSHA’s regulation at 29 CFR 1910.1020, Access to employee exposure and medical records, provides a right of access for employee exposure and medical records by employees, their designated representatives and OSHA representatives. Section 1910.1020(a) states, in relevant part:

“Purpose. The purpose of this section is to provide employees and their designated representatives a right of access to relevant exposure and medical records; and to provide representatives of the Assistant Secretary a right of access to these records in order to fulfill responsibilities under the Occupational Safety and Health Act”

Section 1910.1020(b)(1) goes on to state: “This section applies to each general industry, maritime, and construction employer who makes, maintains, contracts for, or has access to employee exposure or medical records, or analysis thereof, pertaining to employees exposed to toxic substances or harmful physical agents.” Accordingly, this regulation requires employers to provide access to employee exposure and medical records to employees, their designated representatives, and OSHA. It does not require employers to provide access to records to other individuals such as project oversight consultants, project owners, or state and local inspectors.

With regard to employee medical records, your letter specifically mentions OSHA’s regulation at 29 CFR 1913.10, Rules of agency practice and procedure concerning OSHA access to employee medical records. Please be aware that this regulation includes rules that OSHA must follow when Agency personnel access personally identifiable employee medical information. This regulation does not apply to employers. As stated above, each employer is responsible for assuring compliance with the access provisions in 29 CFR 1910.1020.

You should also be aware that there may be other federal, state or local laws and regulations that place limits on the use and disclosure of individually-identifiable exposure and medical records. As an example, we suggest you contact the U.S. Department of Health and Human Service (HHS) to determine whether privacy regulations issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) may place limits on the disclosure of medical records to persons/entities other than the individual who is the subject of the record. The HHS can be reached at:

U.S. Department of Health and Human Services

200 Independence Avenue, S.W.

Washington, D.C. 20201

Toll Free: 1-877-696-6775

http://www.hhs.gov/

We also suggest that you contact your state or local regulatory agencies (e.g., the State Health Department) for guidance on their requirements addressing access to employee exposure and medical records.

Question 2: Can the “other persons” listed in Question 1 require an employee to sign an authorization letter (similar to the sample in Section 1910.1020 App A) for the release of employee medical or exposure record information prior to the awarding of a contract? Can such persons request an employee’s signed release prior to the issuance of an individual’s asbestos abatement license by a State agency?

Response: OSHA’s regulation at Section 1910.1020 does not include provisions that “require” employees to sign a written authorization for the release of their exposure and medical records. However, Section 1910.1020(e)(2) does allow employees to grant a right of access through written authorization to “designated representatives.” Section 1910.1020(c)(3) provides that “designated representative” means “any individual or organization to which an employee gives written authorization to exercise a right of access. For the purpose of access to employee exposure records and analyses using exposure and medical records, a recognized or certified collective bargaining agent shall be treated automatically as a designated representative without regard to written employee authorization.”

As stated above, there may be state or local requirements addressing an employer’s ability to release an employee’s medical records. OSHA suggests you contact your state or local regulatory agency for their guidance. Any questions regarding a state’s requirement to obtain an asbestos abatement license should be directed to your appropriate state licensing agency.

Question 3: Are there any circumstances not discussed where the “other persons” described in Question 1 may request access to employee medical or exposure records without individual signed authorization?

Response: Again, please refer to the response to question 1. There are no other circumstances covered by OSHA which require the release of employee exposure and medical records to “other persons.”

Thank you for your interest in occupational safety and health. We hope you find this information helpful. OSHA requirements are set by statute, standards, and regulations. Our interpretation letters explain these requirements and how they apply to particular circumstances, but they cannot create additional employer obligations. This letter constitutes OSHA's interpretation of the requirements discussed. Note that our enforcement guidance may be affected by changes to OSHA rules. Also, from time to time we update our guidance in response to new information. To keep apprised of such developments, you can consult OSHA's website at http://www.osha.gov. If you have any further questions, please feel free to contact the Office of Health Enforcement at

(202) 693-2190.

Sincerely,

Thomas Galassi, Director

Directorate of Enforcement Programs