Managing Work-Related Medical Surveillance Exam Records

The Code of Federal Regulations (20 CFR, Part 1910.1020, Occupational Safety and Health Standards) contains a number of recordkeeping rules that apply to these exams. The Occupational Safety and Health Administration (OSHA) is responsible for ensuring that covered employers comply with applicable recordkeeping regulations. Violators may be subject to fines.

What is a Record?

Two sections in Subpart Z, Toxic and Hazardous Substances, Access to employee exposure and medical records (with related agency interpretations) describe what constitutes a record. Recordkeeping rules apply to paper documents, electronic records and other media:

1910.1020(c)(10)

“‘Record’ means any item, collection or grouping of information regardless of the form or process by which it is maintained (e.g., paper document, microfiche, microfilm, X-ray film, or automated data processing).”

1910.1020(d)(2)

“Nothing in this section is intended to mandate the form, manner or process by which an employer preserves a record so long as the information contained in the record is preserved and retrievable, except that chest X-ray films shall be preserved in their original state.”

Record Maintenance

Specific storage times apply to medical surveillance records. The intent is to establish a baseline for comparisons over time.

Medical records for each employee must be preserved and maintained for at least the duration of employment, plus 30 years. Analyses using exposure or medical records also must be preserved and maintained for at least 30 years. Federal timeframes may be applied in states with less stringent storage requirements.

There are some exceptions to the employment-plus-30-year rule:

Less than one year of employment: Medical records of employees who have worked for less than one year for an employer do not need to be retained beyond the term of employment as long as they are provided to the employee upon departure.

Background information: Worksite environmental monitoring or measurements such as laboratory reports and worksheets only need to be retained for one year. However, sampling results, collection methodology, a description of analytical and mathematical methods used, and summaries of other background data relevant to interpretation of results must be retained for at least 30 years.

Safety Data Sheets (SDS): Formerly referred to as material safety data sheets or MSDS, SDS and other records concerning the identity of a substance or agent do not need to be retained for a specific period of time as long as the following are retained for at least 30 years: identity (chemical name if known) of the substance or agent, where it was used and when it was used. SDS must be kept for chemicals currently in use as defined in OSHA’s Hazard Communication Standard. SDS in a 16-section format were adopted in 2012; information reported on the SDS is largely the same as that reported on the MSDS.

Biological monitoring: Results designated as exposure records under specific occupational safety and health standards must be preserved and maintained as required by the applicable standard.

Environmental hazards: These types of records are typically not part of an occupational medical record. Information may include site visit or hazard monitoring results, worksite health and safety committee reports, and accident investigation files.

Using Information

OSHA requires employers to take specific actions when an employee’s medical surveillance exam results indicate that an exposure level exceeds a specific limit. A provider who tests an individual for such an exposure level at the request of the employer may disclose that test result to the employer without authorization from the individual being tested.

When an employee has a physiological response to an exposure in excess of the relevant OSHA standard and needs to be medically removed from that exposure, other injury and illness recording criteria apply. Refer to 29 CFR 1904.9, Recording and Reporting Occupational Injuries and Illnesses.

When a medical surveillance exam uncovers personal health issues, it is likely to contain information protected under the Health Insurance Portability and Accountability Act (HIPAA), a federal law intended to ensure patient privacy and security. Protected health information may only be shared with an employer with an employee’s consent or in the event of an emergency.

Recommended Practices

Whether a record exists in a paper or electronic format, storage must be secure and accessible only to certain parties. Industry experts recommend storing electronic records on a password-protected server or in a cloud computing environment. A growing number of medical providers, employers and third parties retained by employers to manage occupational health records use data warehouses to expedite secure access and reduce the likelihood of loss or damage to paper records in the event of a fire or natural disaster. WorkCare uses a dedicated occupational health software system and stores electronic records in a secure, off-site location.

When managing medical surveillance records, the American Health Information Management Association (AHIMA) recommends applying the same general principles as those used when managing other types of health and business records:

• Clearly document the identity of the individual to which it pertains.
• Make entries during the ordinary course of business, at or near the time of an encounter.
• Provide record entries that are legible, signed, dated and timed.
• Keep occupational health records separate from general records.

Documentation must be physically or electronically secured to protect against unauthorized access, use and/or disclosure. Accordingly, the AHIMA recommends:

• Using role-based access, unique user logins and safeguards such as encryption and firewalls.
• Establishing administrative practices for access to file cabinets, shred bins and secured fax locations.
• Performing routine access audits and random review of records to ensure accurate and complete documentation.

Industry experts say old paper and microfilm records may not be worth converting to electronic formats until there is a need. Electronic formats such as optical disk and magnetic tape may be converted over time using available technology to facilitate data transfer.

References

1. “The Privacy and Security of Occupational Health Records;” Journal of AHIMA 84, No.4, April 2013: 52-56.
2. Occupational Health Services: A Practical Approach, 2nd ed; Guidotti, Tee et al., eds. Oxon: Routledge, 2012: 174-187.

DOWNLOAD