eCFR =E2=80=94 Code = of Federal Regulations

=E2=80=A2	Browse
=E2=80=A2	Simple=20 Search
=E2=80=A2	Advanced=20 Search
	*=20 Boolean
	* Proximity
=E2=80=A2	Search=20 History
=E2=80=A2	Search=20 Tips
=E2=80=A2	Corrections
=E2=80=A2	Latest=20 Updates
=E2=80=A2	User=20 Info
=E2=80=A2	FAQs
=E2=80=A2	Agency=20 List
=E2=80=A2	Incorporation=20 by Reference
=E2=80=A2	e-CFR=20 Main Page

Download the Code of=20 Federal Regulations in XML.

The Electronic=20 Code of Federal Regulations (e-CFR) is a regularly updated, = unofficial=20 editorial compilation of CFR material and Federal Register = amendments=20 produced by the National Archives and Records Administration's = Office of=20 the Federal Register (OFR) and the Government Printing Office. =

Parallel Table of Authorities and Rules for the Code of = Federal=20 Regulations and the United States Code
Text | PDF

Find, review, and submit comments on Federal rules that are = open for=20 comment and published in the Federal Register using Regulations.gov.

Purchase=20 individual CFR titles from the U.S. Government Online = Bookstore.=20

Find issues of the CFR (including issues prior to 1996) at a = local Federal = depository=20 library.

[2]

Electronic Code of Federal Regulations

e-CFR Data is current as of November 21,=20 2013

Title 29: Labor
PART=20 1913=E2=80=94RULES OF AGENCY PRACTICE AND PROCEDURE CONCERNING = OSHA ACCESS TO=20 EMPLOYEE MEDICAL RECORDS

=C2=A71913.10 Rules of agency=20 practice and procedure concerning OSHA access to employee medical=20 records.

(a) General policy. = OSHA access=20 to employee medical records will in certain circumstances be = important to=20 the agency's performance of its statutory functions. Medical = records,=20 however, contain personal details concerning the lives of = employees. Due=20 to the substantial personal privacy interests involved, OSHA = authority to=20 gain access to personally identifiable employee medical = information will=20 be exercised only after the agency has made a careful = determination of its=20 need for this information, and only with appropriate safeguards to = protect=20 individual privacy. Once this information is obtained, OSHA = examination=20 and use of it will be limited to only that information needed to=20 accomplish the purpose for access. Personally identifiable = employee=20 medical information will be retained by OSHA only for so long as = needed to=20 accomplish the purpose for access, will be kept secure while being = used,=20 and will not be disclosed to other agencies or members of the = public=20 except in narrowly defined circumstances. This section establishes = procedures to implement these policies.

(b) Scope and = application. (1)=20 Except as provided in paragraphs (b) (3) through (6) below, this = section=20 applies to all requests by OSHA personnel to obtain access to = records in=20 order to examine or copy personally identifiable employee medical=20 information, whether or not pursuant to the access provisions of = 29 CFR=20 1910.1020(e).

(2) For the purposes of this section, =E2=80=9Cpersonally = identifiable employee=20 medical information=E2=80=9D means employee medical information = accompanied by=20 either direct identifiers (name, address, social security number, = payroll=20 number, etc.) or by information which could reasonably be used in = the=20 particular circumstances indirectly to identify specific employees = (e.g.,=20 exact age, height, weight, race, sex, date of initial employment, = job=20 title, etc.).

(3) This section does not apply to OSHA access to, or the use = of,=20 aggregate employee medical information or medical records on = individual=20 employees which is not in a personally identifiable form. This = section=20 does not apply to records required by 29 CFR part 1904, to death=20 certificates, or to employee exposure records, including = biological=20 monitoring records treated by 29 CFR 1910.1020(c)(5) or by = specific=20 occupational safety and health standards as exposure records.

(4) This section does not apply where OSHA compliance personnel = conduct=20 an examination of employee medical records solely to verify = employer=20 compliance with the medical surveillance recordkeeping = requirements of an=20 occupational safety and health standard, or with 29 CFR 1910.1020. = An=20 examination of this nature shall be conducted on-site and, if = requested,=20 shall be conducted under the observation of the recordholder. The = OSHA=20 compliance personnel shall not record and take off-site any = information=20 from medical records other than documentation of the fact of = compliance or=20 non-compliance.

(5) This section does not apply to agency access to, or the use = of,=20 personally identifiable employee medical information obtained in = the=20 course of litigation.

(6) This section does not apply where a written directive by = the=20 Assistant Secretary authorizes appropriately qualified personnel = to=20 conduct limited reviews of specific medical information mandated = by an=20 occupational safety and health standard, or of specific biological = monitoring test results.

(7) Even if not covered by the terms of this section, all = medically=20 related information reported in a personally identifiable form = shall be=20 handled with appropriate discretion and care befitting all = information=20 concerning specific employees. There may, for example, be personal = privacy=20 interests involved which militate against disclosure of this kind = of=20 information to the public (See, 29=20 CFR 70.26 and 70a.3).

(c) Responsible = persons=E2=80=94(1)=20 Assistant Secretary. The = Assistant=20 Secretary of Labor for Occupational Safety and Health (Assistant=20 Secretary) shall be responsible for the overall administration and = implementation of the procedures contained in this section, = including=20 making final OSHA determinations concerning:

(i) Access to personally identifiable employee medical = information=20 (paragraph (d)), and

(ii) Inter-agency transfer or public disclosure of personally=20 identifiable employee medical information (paragraph (m)).

(2) OSHA Medical Records=20 Officer. The Assistant Secretary shall designate an OSHA = official=20 with experience or training in the evaluation, use, and privacy = protection=20 of medical records to be the OSHA Medical Records Officer. The = OSHA=20 Medical Records Officer shall report directly to the Assistant = Secretary=20 on matters concerning this section and shall be responsible for: =

(i) Making recommendations to the Assistant Secretary as to the = approval or denial of written access orders (paragraph (d)),

(ii) Assuring that written access orders meet the requirements = of=20 paragraphs (d) (2) and (3) of this section,

(iii) Responding to employee, collective bargaining agent, and = employer=20 objections concerning written access orders (paragraph (f)),

(iv) Regulating the use of direct personal identifiers = (paragraph (g)),=20

(v) Regulating internal agency use and security of personally=20 identifiable employee medical information (paragraphs (h) through = (j)),=20

(vi) Assuring that the results of agency analyses of personally = identifiable medical information are, where appropriate, = communicated to=20 employees (paragraph (k)),

(vii) Preparing an annual report of OSHA's experience under = this=20 section (paragraph (l)), and

(viii) Assuring that advance notice is given of intended = inter-agency=20 transfers or public disclosures (paragraph (m)).

(3) Principal OSHA=20 Investigator. The Principal OSHA Investigator shall be the = OSHA=20 employee in each instance of access to personally identifiable = employee=20 medical information who is made primarily responsible for assuring = that=20 the examination and use of this information is performed in the = manner=20 prescribed by a written access order and the requirements of this = section=20 (paragraphs (d) through (m). When access is pursuant to a written = access=20 order, the Principal OSHA Investigator shall be professionally = trained in=20 medicine, public health, or allied fields (epidemiology, = toxicology,=20 industrial hygiene, biostatistics, environmental health, etc.). =

(d) Written access = orders=E2=80=94(1)=20 Requirement for written access=20 order. Except as provided in paragraph (d)(4) below, each = request=20 by an OSHA representative to examine or copy personally = identifiable=20 employee medical information contained in a record held by an = employer or=20 other recordholder shall be made pursuant to a written access = order which=20 has been approved by the Assistant Secretary upon the = recommendation of=20 the OSHA Medical Records Officer. If deemed appropriate, a written = access=20 order may constitute, or be accompanied by, an administrative = subpoena.=20

(2) Approval criteria for = written=20 access order. Before approving a written access order, the=20 Assistant Secretary and the OSHA Medical Records Officer shall = determine=20 that:

(i) The medical information to be examined or copied is = relevant to a=20 statutory purpose and there is a need to gain access to this = personally=20 identifiable information,

(ii) The personally identifiable medical information to be = examined or=20 copied is limited to only that information needed to accomplish = the=20 purpose for access, and

(iii) The personnel authorized to review and analyze the = personally=20 identifiable medical information are limited to those who have a = need for=20 access and have appropriate professional qualifications.

(3) Content of written = access=20 order. Each written access order shall state with = reasonable=20 particularity:

(i) The statutory purposes for which access is sought,

(ii) A general description of the kind of employee medical = information=20 that will be examined and why there is a need to examine = personally=20 identifiable information,

(iii) Whether medical information will be examined on-site, and = what=20 type of information will be copied and removed off-site,

(iv) The name, address, and phone number of the Principal OSHA=20 Investigator and the names of any other authorized persons who are = expected to review and analyze the medical information.

(v) The name, address, and phone number of the OSHA Medical = Records=20 Officer, and

(vi) The anticipated period of time during which OSHA expects = to retain=20 the employee medical information in a personally identifiable = form.

(4) Special = situations. Written=20 access orders need not be obtained to examine or copy personally=20 identifiable employee medical information under the following=20 circumstances:

(i) Specific written = consent.=20 If the specific written consent of an employee is obtained = pursuant to 29=20 CFR 1910.1020(e)(2)(ii), and the agency or an agency employee is = listed on=20 the authorization as the designated representative to receive the = medical=20 information, then a written access order need not be obtained. = Whenever=20 personally identifiable employee medical information is obtained = through=20 specific written consent and taken off-site, a Principal OSHA = Investigator=20 shall be promptly named to assure protection of the information, = and the=20 OSHA Medical Records Officer shall be notified of this person's = identity.=20 The personally identifiable medical information obtained shall = thereafter=20 be subject to the use and security requirements of paragraphs (h) = through=20 (m) of this section.

(ii) Physician = consultations. A=20 written access order need not be obtained where an OSHA staff or = contract=20 physician consults with an employer's physician concerning an = occupational=20 safety or health issue. In a situation of this nature, the OSHA = physician=20 may conduct on-site evaluation of employee medical records in = consultation=20 with the employer's physician, and may make necessary personal = notes of=20 his or her findings. No employee medical records, however, shall = be taken=20 off-site in the absence of a written access order or the specific = written=20 consent of an employee, and no notes of personally identifiable = employee=20 medical information made by the OSHA physician shall leave his or = her=20 control without the permission of the OSHA Medical Records = Officer.

(e) Presentation of written = access=20 order and notice to employees. (1) The Principal OSHA = Investigator,=20 or someone under his or her supervision, shall present at least = two (2)=20 copies each of the written access order and an accompanying cover = letter=20 to the employer prior to examining or obtaining medical = information=20 subject to a written access order. At least one copy of the = written access=20 order shall not identify specific employees by direct personal = identifier.=20 The accompanying cover letter shall summarize the requirements of = this=20 section and indicate that questions or objections concerning the = written=20 access order may be directed to the Principal OSHA Investigator or = to the=20 OSHA Medical Records Officer.

(2) The Principal OSHA Investigator shall promptly present a = copy of=20 the written access order (which does not identify specific = employees by=20 direct personal identifier) and its accompanying cover letter to = each=20 collective bargaining agent representing employees whose medical = records=20 are subject to the written access order.

(3) The Principal OSHA Investigator shall indicate that the = employer=20 must promptly post a copy of the written access order which does = not=20 identify specific employees by direct personal identifier, as well = as post=20 its accompanying cover letter (See, 29 CFR = 1910.1020(e)(3)(ii)).

(4) The Principal OSHA Investigator shall discuss with any = collective=20 bargaining agent and with the employer the appropriateness of = individual=20 notice to employees affected by the written access order. Where it = is=20 agreed that individual notice is appropriate, the Principal OSHA=20 Investigator shall promptly provide to the employer an adequate = number of=20 copies of the written access order (which does not identify = specific=20 employees by direct personal identifier) and its accompanying = cover letter=20 to enable the employer either to individually notify each employee = or to=20 place a copy in each employee's medical file.

(f) Objections concerning a = written=20 access order. All employee, collective bargaining agent, = and=20 employer written objections concerning access to records pursuant = to a=20 written access order shall be transmitted to the OSHA Medical = Records=20 Officer. Unless the agency decides otherwise, access to the = records shall=20 proceed without delay notwithstanding the lodging of an objection. = The=20 OSHA Medical Records Officer shall respond in writing to each = employee's=20 and collective bargaining agent's written objection to OSHA = access. Where=20 appropriate, the OSHA Medical Records Officer may revoke a written = access=20 order and direct that any medical information obtained by it be = returned=20 to the original recordholder or destroyed. The Principal OSHA = Investigator=20 shall assure that such instructions by the OSHA Medical Records = Officer=20 are promptly implemented.

(g) Removal of direct = personal=20 identifiers. Whenever employee medical information obtained = pursuant to a written access order is taken off-site with direct = personal=20 identifiers included, the Principal OSHA Investigator shall, = unless=20 otherwise authorized by the OSHA Medical Records Officer, promptly = separate all direct personal identifiers from the medical = information, and=20 code the medical information and the list of direct identifiers = with a=20 unique identifying number for each employee. The medical = information with=20 its numerical code shall thereafter be used and kept secured as = though=20 still in a directly identifiable form. The Principal OSHA = Investigator=20 shall also hand deliver or mail the list of direct personal = identifiers=20 with their corresponding numerical codes to the OSHA Medical = Records=20 Officer. The OSHA Medical Records Officer shall thereafter limit = the use=20 and distribution of the list of coded identifiers to those with a = need to=20 know its contents.

(h) Internal agency use of = personally=20 identifiable employee medical information. (1) The = Principal OSHA=20 Investigator shall in each instance of access be primarily = responsible for=20 assuring that personally identifiable employee medical information = is used=20 and kept secured in accordance with this section.

(2) The Principal OSHA Investigator, the OSHA Medical Records = Officer,=20 the Assistant Secretary, and any other authorized person listed on = a=20 written access order may permit the examination or use of = personally=20 identifiable employee medical information by agency employees and=20 contractors who have a need for access, and appropriate = qualifications for=20 the purpose for which they are using the information. No OSHA = employee or=20 contractor is authorized to examine or otherwise use personally=20 identifiable employee medical information unless so permitted. =

(3) Where a need exists, access to personally identifiable = employee=20 medical information may be provided to attorneys in the Office of = the=20 Solicitor of Labor, and to agency contractors who are physicians = or who=20 have contractually agreed to abide by the requirements of this = section and=20 implementing agency directives and instructions.

(4) OSHA employees and contractors are only authorized to use=20 personally identifiable employee medical information for the = purposes for=20 which it was obtained, unless the specific written consent of an = employee=20 is obtained as to a secondary purpose, or the procedures of = paragraphs (d)=20 through (g) of this section are repeated with respect to the = secondary=20 purpose.

(5) Whenever practicable, the examination of personally = identifiable=20 employee medical information shall be performed on-site with a = minimum of=20 medical information taken off-site in a personally identifiable = form.

(i) Security = procedures. (1)=20 Agency files containing personally identifiable employee medical=20 information shall be segregated from other agency files. When not = in=20 active use, files containing this information shall be kept = secured in a=20 locked cabinet or vault.

(2) The OSHA Medical Records Officer and the Principal OSHA=20 Investigator shall each maintain a log of uses and transfers of = personally=20 identifiable employee medical information and lists of coded = direct=20 personal identifiers, except as to necessary uses by staff under = their=20 direct personal supervision.

(3) The photocopying or other duplication of personally = identifiable=20 employee medical information shall be kept to the minimum = necessary to=20 accomplish the purposes for which the information was = obtained.

(4) The protective measures established by this section apply = to all=20 worksheets, duplicate copies, or other agency documents containing = personally identifiable employee medical information.

(5) Intra-agency transfers of personally identifiable employee = medical=20 information shall be by hand delivery, United States mail, or = equally=20 protective means. Inter-office mailing channels shall not be = used.

(j) Retention and = destruction of=20 records. (1) Consistent with OSHA records disposition = programs,=20 personally identifiable employee medical information and lists of = coded=20 direct personal identifiers shall be destroyed or returned to the = original=20 recordholder when no longer needed for the purposes for which they = were=20 obtained.

(2) Personally identifiable employee medical information which = is=20 currently not being used actively but may be needed for future use = shall=20 be transferred to the OSHA Medical Records Officer. The OSHA = Medical=20 Records Officer shall conduct an annual review of all = centrally-held=20 information to determine which information is no longer needed for = the=20 purposes for which it was obtained.

(k) Results of an agency = analysis=20 using personally identifiable employee medical information. = The=20 OSHA Medical Records Officer shall, as appropriate, assure that = the=20 results of an agency analysis using personally identifiable = employee=20 medical information are communicated to the employees whose = personal=20 medical information was used as a part of the analysis.

(l) Annual report. = The OSHA=20 Medical Records Officer shall on an annual basis review OSHA's = experience=20 under this section during the previous year, and prepare a report = to the=20 Assistant Secretary which shall be made available to the public. = This=20 report shall discuss:

(1) The number of written access orders approved and a summary = of the=20 purposes for access,

(2) The nature and disposition of employee, collective = bargaining=20 agent, and employer written objections concerning OSHA access to=20 personally identifiable employee medical information, and

(3) The nature and disposition of requests for inter-agency = transfer or=20 public disclosure of personally identifiable employee medical=20 information.

(m) Inter-agency transfer = and public=20 disclosure. (1) Personally identifiable employee medical=20 information shall not be transferred to another agency or office = outside=20 of OSHA (other than to the Office of the Solicitor of Labor) or = disclosed=20 to the public (other than to the affected employee or the original = recordholder) except when required by law or when approved by the=20 Assistant Secretary.

(2) Except as provided in paragraph (m)(3) of this section, the = Assistant Secretary shall not approve a request for an = inter-agency=20 transfer of personally identifiable employee medical information, = which=20 has not been consented to by the affected employees, unless the = request is=20 by a public health agency which:

(i) Needs the requested information in a personally = identifiable form=20 for a substantial public health purpose,

(ii) Will not use the requested information to make individual=20 determinations concerning affected employees which could be to = their=20 detriment,

(iii) Has regulations or established written procedures = providing=20 protection for personally identifiable medical information = substantially=20 equivalent to that of this section, and

(iv) Satisfies an exemption to the Privacy Act to the extent = that the=20 Privacy Act applies to the requested information (See, 5 U.S.C. 552a(b); 29 CFR=20 70a.3).

(3) Upon the approval of the Assistant Secretary, personally=20 identifiable employee medical information may be transferred = to:

(i) The National Institute for Occupational Safety and Health = (NIOSH)=20 and

(ii) The Department of Justice when necessary with respect to a = specific action under the Occupational Safety and Health Act.

(4) The Assistant Secretary shall not approve a request for = public=20 disclosure of employee medical information containing direct = personal=20 identifiers unless there are compelling circumstances affecting = the health=20 or safety of an individual.

(5) The Assistant Secretary shall not approve a request for = public=20 disclosure of employee medical information which contains = information=20 which could reasonably be used indirectly to identify specific = employees=20 when the disclosure would constitute a clearly unwarranted = invasion of=20 personal privacy (See, 5 = U.S.C.=20 552(b)(6); 29 CFR 70.26).

(6) Except as to inter-agency transfers to NIOSH or the = Department of=20 Justice, the OSHA Medical Records Officer shall assure that = advance notice=20 is provided to any collective bargaining agent representing = affected=20 employees and to the employer on each occasion that OSHA intends = to either=20 transfer personally identifiable employee medical information to = another=20 agency or disclose it to a member of the public other than to an = affected=20 employee. When feasible, the OSHA Medical Records Officer shall = take=20 reasonable steps to assure that advance notice is provided to = affected=20 employees when the employee medical information to be transferred = or=20 disclosed contains direct personal identifiers.

[45 FR 35294, May 23, 1980; 45 FR 54334, Aug. 15, = 1980, as=20 amended at 71 FR 16674, Apr. 3, 2006]

For questions or comments regarding e-CFR = editorial=20 content, features, or design, email ecfr@nara.gov.
For = questions=20 concerning e-CFR programming and delivery issues, email webteam@gpo.gov.

732 North Capitol Street, NW, Washington, DC = 20401-0001=20 202.512.1800

Privacy=20 | Important=20 Links | Accessibility = | =20 Sitemap | = COOP =