Records Retention and Worker Privacy
5 minutes
5 Questions
Records retention and worker privacy are two intertwined legal obligations that safety professionals must balance. OSHA and other regulators require employers to create and keep specific records for defined periods. Under 29 CFR 1904, injury and illness records (OSHA 300 Log, 300A Summary, and 301 Incident Reports) must be retained for five years following the end of the calendar year they cover. Under 29 CFR 1910.1020 (Access to Employee Exposure and Medical Records), exposure records must be kept for at least 30 years, and medical records for the duration of employment plus 30 years. Training records, equipment inspection records, and program documentation often have shorter retention requirements set by specific standards, such as hazard communication or respiratory protection. Proper retention supports regulatory compliance, litigation defense, trend analysis, and continuity of hazard control. Worker privacy obligations limit how these records are accessed and disclosed. OSHA requires 'privacy concern cases' (e.g., sexual assault, mental illness, HIV, or injuries to intimate body parts) to be logged without the employee's name, with a separate confidential list maintained. Employees and their designated representatives have the right to access their own exposure and medical records, generally within 15 working days of a request. Medical information must be kept in files separate from general personnel records, as required by the Americans with Disabilities Act (ADA). HIPAA may apply when the employer operates a covered health plan or clinic, and drug-testing, genetic information (GINA), and workers' compensation records carry additional confidentiality duties. State privacy laws may impose further restrictions. For the ASP candidate, the key principle is that records must be complete, accurate, retained for the legally mandated period, and protected from unauthorized disclosure, while remaining accessible to employees, their representatives, and OSHA when legitimately requested. Failure in either area can result in citations, civil liability, and loss of employee trust.
Records Retention and Worker Privacy: A Complete ASP Exam Guide
Why This Topic Matters
Records retention and worker privacy sit at the intersection of legal compliance, ethics, and professional practice. On the BCSP ASP exam, these topics fall under the Legal and Regulatory domain, and they are tested because a safety professional who mishandles records can expose the employer to OSHA citations, civil liability, and discrimination claims, while simultaneously violating the trust of the workers they are supposed to protect. Occupational diseases such as asbestosis, silicosis, and noise-induced hearing loss have latency periods of decades, which is why exposure and medical records must survive far longer than ordinary business records. At the same time, those records contain some of the most sensitive personal information an employer holds, so access must be tightly controlled. Understanding both halves of this balance, keep it long enough and keep it confidential, is the core competency being assessed.
What It Is
Records retention refers to the legal requirements specifying which safety and health records an employer must create, how long they must be kept, and what happens to them when the business changes hands or closes. Worker privacy refers to the rules governing who may see those records, under what conditions, and what information must be shielded from disclosure. The primary federal sources are:
- 29 CFR 1904 (Recording and Reporting Occupational Injuries and Illnesses)
- 29 CFR 1910.1020 (Access to Employee Exposure and Medical Records)
- Substance-specific standards such as asbestos, lead, benzene, noise, and bloodborne pathogens, each of which contains its own recordkeeping paragraph
- The Americans with Disabilities Act (ADA), which requires medical information to be kept in separate confidential files
- The Genetic Information Nondiscrimination Act (GINA), which restricts collection and disclosure of genetic information
- HIPAA, which generally does not apply to employer-held occupational records but does affect health care providers who release information to employers
- 49 CFR Part 40 (DOT drug and alcohol testing records) for regulated transportation employers
How It Works: Key Retention Periods You Must Memorize
1. Injury and Illness Records (29 CFR 1904.33)
OSHA Forms 300 (Log), 300A (Summary), and 301 (Incident Report), along with any privacy case list, must be retained for 5 years following the end of the calendar year that the records cover. During that period the employer must update the 300 Log to reflect newly discovered recordable cases or changes in classification; the 300A and 301 do not have to be updated. The 300A must be certified by a company executive and posted from February 1 through April 30 of the following year. Establishments with 10 or fewer employees at all times during the prior year, and those in partially exempt low-hazard industries, are exempt from routine recordkeeping but must still report fatalities (within 8 hours) and in-patient hospitalizations, amputations, and losses of an eye (within 24 hours).
2. Exposure Records (29 CFR 1910.1020)
Employee exposure records must be preserved for at least 30 years. Exposure records include environmental monitoring results, biological monitoring results that measure exposure (as opposed to diagnosing a condition), safety data sheets, and any other record revealing the identity of a toxic substance or harmful physical agent. Two exceptions: (a) background data such as laboratory reports and worksheets need only be kept 1 year if the sampling results, methodology, and interpretation are retained for 30 years, and (b) SDSs and chemical inventories may be discarded if some record of the identity of the substance, where it was used, and when it was used is kept for 30 years.
3. Medical Records (29 CFR 1910.1020)
Employee medical records must be preserved for the duration of employment plus 30 years. Exceptions: health insurance claims records maintained separately from the employer medical program; first aid records of one-time treatment for minor injuries made by a non-physician and kept separately; and medical records of employees who worked less than one year, provided the records are given to the employee upon termination.
4. Analyses Using Exposure or Medical Records
Any epidemiological or statistical analysis using these records must be kept for 30 years, with personal identifiers removed before employee access.
5. Standard-Specific Periods Frequently Tested
- Occupational Noise (1910.95): noise exposure measurement records 2 years; audiometric test records for the duration of the affected employee's employment
- Respiratory Protection (1910.134): fit test records until the next fit test is administered; medical evaluations per 1910.1020
- Bloodborne Pathogens (1910.1030): medical records (including hepatitis B vaccination status and post-exposure follow-up) for duration of employment plus 30 years; training records for 3 years; sharps injury log 5 years per 1904
- Asbestos, Lead, Benzene, and other substance-specific standards: generally follow 1910.1020 (exposure 30 years, medical duration plus 30 years), with objective data and training records often set at shorter periods
- Hazard Communication (1910.1200): SDS retention handled under 1910.1020 as described above
- Lockout/Tagout (1910.147): periodic inspection certification, which must be at least annual, kept until superseded
- Powered Industrial Trucks (1910.178): operator evaluation every 3 years
- DOT drug and alcohol testing (49 CFR 40): positive results and refusals 5 years; negative results 1 year; the records must be kept in a secure location with controlled access
6. Transfer and Disposal of Records
When an employer ceases to do business, records must be transferred to the successor employer. If there is no successor, the employer must notify current employees of their access rights at least 3 months before cessation and notify the Director of NIOSH at least 3 months before disposal. NIOSH may request the records be transferred to it.
How It Works: Access and Privacy Rules
Access Under 1910.1020
Employees, their designated representatives, and OSHA have the right of access. Requests must be fulfilled within 15 working days. The first copy is provided free of charge. A designated representative needs specific written consent from the employee to access medical records, but a recognized collective bargaining agent may access exposure records without consent. Employers must inform employees of these rights at hire and annually. If a physician believes direct access to a record could be detrimental to the employee's health, the employer may limit access to a designated representative of the employee's choosing. Trade secret chemical identities may be withheld, but the employer must disclose health hazard information and provide the identity to a health professional in a medical emergency or, with a confidentiality agreement, in non-emergency situations.
Access Under 1904.35 and 1904.40
Employees, former employees, personal representatives, and authorized employee representatives may view the OSHA 300 Log, and the employer must provide a copy by the end of the next business day. An employee or personal representative is entitled to the 301 form for that employee's own injury by the end of the next business day; an authorized employee representative may receive the right-hand portion of the 301 within 7 calendar days with personal identifiers removed. Government representatives (OSHA, NIOSH, state agencies) must be given records within 4 business hours.
Privacy Concern Cases (1904.29)
For certain injuries and illnesses the employer must enter privacy case instead of the employee's name on the 300 Log and keep a separate confidential list linking case numbers to names. Privacy concern cases are: injuries or illnesses to an intimate body part or the reproductive system; injuries or illnesses resulting from sexual assault; mental illnesses; HIV infection, hepatitis, or tuberculosis; needlestick and sharps injuries contaminated with another person's blood or potentially infectious material; and any other illness the employee voluntarily requests be kept private. The employer may also use discretion in describing the injury on the Log if the description itself would identify the employee. Note that the OSHA 300A Summary contains no names, so it may be posted publicly.
ADA and GINA Confidentiality
The ADA requires that all medical information obtained through examinations or inquiries be kept in separate medical files, apart from personnel files, and treated as confidential. Disclosure is limited to supervisors who need to know about restrictions or accommodations, first aid and safety personnel when emergency treatment may be required, and government officials investigating compliance. GINA prohibits requesting, requiring, or purchasing genetic information, including family medical history, and requires any such information lawfully obtained to be kept confidential in separate files. Safety professionals coordinating medical surveillance must be careful that questionnaires do not solicit family medical history unless a GINA safe-harbor notice is used.
Drug Testing, Monitoring, and Investigations
Drug and alcohol test results, fitness-for-duty evaluations, and incident investigation witness statements all raise privacy issues. Best practice and most state laws require results to be disclosed only to those with a legitimate need to know, stored securely, and never placed in general personnel files. Video surveillance, GPS tracking, and wearable technology used for safety purposes should be covered by a written policy and employee notification, and the data retained only as long as necessary for the stated purpose.
Workers Compensation and Insurance Records
Workers compensation claim files are governed primarily by state law, but if they contain medical information they must also be protected under ADA confidentiality rules. Health insurance claim records maintained separately are exempt from 1910.1020 retention, which is a commonly tested distinction.
Putting It Together: A Decision Framework
When facing any records question, ask three questions in order:
1. What type of record is it? Injury/illness (1904), exposure (1910.1020), medical (1910.1020), training, inspection, or administrative.
2. How long must it be kept? 5 years for 1904 forms; 30 years for exposure; duration plus 30 for medical; standard-specific for training and inspections.
3. Who may see it and how fast? Employee access is broad and quick (next business day for 1904, 15 working days for 1910.1020, 4 business hours for government). Third-party access requires written consent for medical records, and privacy concern cases require name removal.
Exam Tips: Answering Questions on Records Retention and Worker Privacy
Tip 1: Master the numbers table. The ASP exam rewards memorization of specific periods. Lock in these pairings: 300/300A/301 = 5 years; exposure = 30 years; medical = employment plus 30 years; noise measurements = 2 years; BBP training = 3 years; 300A posting = Feb 1 to Apr 30; 1910.1020 access = 15 working days; 1904 employee access = end of next business day; government access = 4 business hours; NIOSH notification before disposal = 3 months; fatality report = 8 hours; hospitalization/amputation/eye loss = 24 hours.
Tip 2: Distinguish exposure from medical. If a question describes a record that tells you what the worker was exposed to (air sampling, noise dosimetry, SDS, blood lead as a measure of dose), it is an exposure record and the answer is 30 years. If it describes a record about the worker's health status (physician opinions, exam results, diagnoses, audiograms, vaccination status), it is a medical record and the answer is duration of employment plus 30 years. Biological monitoring can appear in either category depending on wording, so read carefully.
Tip 3: Watch for the short-service exception. Questions love the employee who worked only eight months. Medical records for workers employed less than one year need not be retained if provided to the employee at termination. Exposure records have no such exception.
Tip 4: Know the privacy concern case list cold. Expect a scenario asking whether a specific injury should be entered by name or as a privacy case. Memorize the six categories: intimate body part or reproductive system, sexual assault, mental illness, HIV/hepatitis/TB, contaminated needlestick or sharps, and voluntary request for any illness. A broken arm, a back strain, or an ordinary laceration is entered by name even if the employee prefers otherwise, because the voluntary request option applies to illnesses, not injuries.
Tip 5: Consent rules are a favorite distractor. Medical records require specific written consent before release to anyone other than the employee or OSHA. Exposure records can be accessed by a collective bargaining representative without individual consent. If an answer choice suggests releasing medical records to a union steward or a supervisor without the employee's written authorization, it is wrong.
Tip 6: Remember separate files under the ADA. When a question asks where to store fitness-for-duty results, medical restrictions, or drug test outcomes, the correct answer always involves a separate, confidential medical file with restricted access, never the general personnel file.
Tip 7: Successor employer, then NIOSH. For business closure questions, the sequence is: transfer to successor if one exists; if not, notify employees and NIOSH at least 3 months in advance. Simply shredding records after the business closes is never the right answer.
Tip 8: The 300A is the only publicly visible form. If a question asks which record may be posted where all employees can see it, the answer is the 300A Summary, because it contains totals and no individual names. The 300 Log and 301 forms are never posted.
Tip 9: Updating applies only to the Log. During the 5-year retention period, only the 300 Log must be updated for newly discovered cases or changes; the employer is not required to update the 300A or 301. A question implying you must re-certify and re-post an old summary is a trap.
Tip 10: Read for the role of the requester. The identity of who is asking changes the answer. Employee or personal representative: broad access, fast turnaround. Authorized employee representative: 300 Log in full, 301 only with identifiers removed within 7 days. Government inspector: everything within 4 business hours. Third party or insurer: written consent required for medical information.
Tip 11: When in doubt, choose the more protective option. If two choices seem plausible and one keeps the record longer or restricts access more tightly while still giving the employee their own rights, that choice is usually correct. OSHA minimums are floors, and the exam rarely penalizes longer retention or stronger confidentiality, but it will penalize premature destruction or improper disclosure.
Tip 12: Connect retention to latency. If you forget a number, reason from purpose. Records about chemical and physical agent exposure exist to support diagnosis of diseases that appear decades later, so they are kept 30 years. Injury logs exist to track trends and support inspections, so 5 years suffices. Training records exist to prove competency for the current program cycle, so they are short. This logic will often lead you to the right answer even under exam pressure.
Summary
Records retention and worker privacy together ensure that evidence of workplace exposures and health outcomes survives long enough to protect workers, while the personal details within those records are shielded from inappropriate disclosure. For the ASP exam, know the specific retention periods, the access timelines, the privacy concern case categories, the consent rules for medical versus exposure records, and the ADA requirement for separate confidential files. Approach every question by identifying the record type, the retention clock, and the requester's role, and you will be able to answer confidently and accurately.
Records retention and worker privacy sit at the intersection of legal compliance, ethics, and professional practice. On the BCSP ASP exam, these topics fall under the Legal and Regulatory domain, and they are tested because a safety professional who mishandles records can expose the employer to OSHA citations, civil liability, and discrimination claims, while simultaneously violating the trust of the workers they are supposed to protect. Occupational diseases such as asbestosis, silicosis, and noise-induced hearing loss have latency periods of decades, which is why exposure and medical records must survive far longer than ordinary business records. At the same time, those records contain some of the most sensitive personal information an employer holds, so access must be tightly controlled. Understanding both halves of this balance, keep it long enough and keep it confidential, is the core competency being assessed.
What It Is
Records retention refers to the legal requirements specifying which safety and health records an employer must create, how long they must be kept, and what happens to them when the business changes hands or closes. Worker privacy refers to the rules governing who may see those records, under what conditions, and what information must be shielded from disclosure. The primary federal sources are:
- 29 CFR 1904 (Recording and Reporting Occupational Injuries and Illnesses)
- 29 CFR 1910.1020 (Access to Employee Exposure and Medical Records)
- Substance-specific standards such as asbestos, lead, benzene, noise, and bloodborne pathogens, each of which contains its own recordkeeping paragraph
- The Americans with Disabilities Act (ADA), which requires medical information to be kept in separate confidential files
- The Genetic Information Nondiscrimination Act (GINA), which restricts collection and disclosure of genetic information
- HIPAA, which generally does not apply to employer-held occupational records but does affect health care providers who release information to employers
- 49 CFR Part 40 (DOT drug and alcohol testing records) for regulated transportation employers
How It Works: Key Retention Periods You Must Memorize
1. Injury and Illness Records (29 CFR 1904.33)
OSHA Forms 300 (Log), 300A (Summary), and 301 (Incident Report), along with any privacy case list, must be retained for 5 years following the end of the calendar year that the records cover. During that period the employer must update the 300 Log to reflect newly discovered recordable cases or changes in classification; the 300A and 301 do not have to be updated. The 300A must be certified by a company executive and posted from February 1 through April 30 of the following year. Establishments with 10 or fewer employees at all times during the prior year, and those in partially exempt low-hazard industries, are exempt from routine recordkeeping but must still report fatalities (within 8 hours) and in-patient hospitalizations, amputations, and losses of an eye (within 24 hours).
2. Exposure Records (29 CFR 1910.1020)
Employee exposure records must be preserved for at least 30 years. Exposure records include environmental monitoring results, biological monitoring results that measure exposure (as opposed to diagnosing a condition), safety data sheets, and any other record revealing the identity of a toxic substance or harmful physical agent. Two exceptions: (a) background data such as laboratory reports and worksheets need only be kept 1 year if the sampling results, methodology, and interpretation are retained for 30 years, and (b) SDSs and chemical inventories may be discarded if some record of the identity of the substance, where it was used, and when it was used is kept for 30 years.
3. Medical Records (29 CFR 1910.1020)
Employee medical records must be preserved for the duration of employment plus 30 years. Exceptions: health insurance claims records maintained separately from the employer medical program; first aid records of one-time treatment for minor injuries made by a non-physician and kept separately; and medical records of employees who worked less than one year, provided the records are given to the employee upon termination.
4. Analyses Using Exposure or Medical Records
Any epidemiological or statistical analysis using these records must be kept for 30 years, with personal identifiers removed before employee access.
5. Standard-Specific Periods Frequently Tested
- Occupational Noise (1910.95): noise exposure measurement records 2 years; audiometric test records for the duration of the affected employee's employment
- Respiratory Protection (1910.134): fit test records until the next fit test is administered; medical evaluations per 1910.1020
- Bloodborne Pathogens (1910.1030): medical records (including hepatitis B vaccination status and post-exposure follow-up) for duration of employment plus 30 years; training records for 3 years; sharps injury log 5 years per 1904
- Asbestos, Lead, Benzene, and other substance-specific standards: generally follow 1910.1020 (exposure 30 years, medical duration plus 30 years), with objective data and training records often set at shorter periods
- Hazard Communication (1910.1200): SDS retention handled under 1910.1020 as described above
- Lockout/Tagout (1910.147): periodic inspection certification, which must be at least annual, kept until superseded
- Powered Industrial Trucks (1910.178): operator evaluation every 3 years
- DOT drug and alcohol testing (49 CFR 40): positive results and refusals 5 years; negative results 1 year; the records must be kept in a secure location with controlled access
6. Transfer and Disposal of Records
When an employer ceases to do business, records must be transferred to the successor employer. If there is no successor, the employer must notify current employees of their access rights at least 3 months before cessation and notify the Director of NIOSH at least 3 months before disposal. NIOSH may request the records be transferred to it.
How It Works: Access and Privacy Rules
Access Under 1910.1020
Employees, their designated representatives, and OSHA have the right of access. Requests must be fulfilled within 15 working days. The first copy is provided free of charge. A designated representative needs specific written consent from the employee to access medical records, but a recognized collective bargaining agent may access exposure records without consent. Employers must inform employees of these rights at hire and annually. If a physician believes direct access to a record could be detrimental to the employee's health, the employer may limit access to a designated representative of the employee's choosing. Trade secret chemical identities may be withheld, but the employer must disclose health hazard information and provide the identity to a health professional in a medical emergency or, with a confidentiality agreement, in non-emergency situations.
Access Under 1904.35 and 1904.40
Employees, former employees, personal representatives, and authorized employee representatives may view the OSHA 300 Log, and the employer must provide a copy by the end of the next business day. An employee or personal representative is entitled to the 301 form for that employee's own injury by the end of the next business day; an authorized employee representative may receive the right-hand portion of the 301 within 7 calendar days with personal identifiers removed. Government representatives (OSHA, NIOSH, state agencies) must be given records within 4 business hours.
Privacy Concern Cases (1904.29)
For certain injuries and illnesses the employer must enter privacy case instead of the employee's name on the 300 Log and keep a separate confidential list linking case numbers to names. Privacy concern cases are: injuries or illnesses to an intimate body part or the reproductive system; injuries or illnesses resulting from sexual assault; mental illnesses; HIV infection, hepatitis, or tuberculosis; needlestick and sharps injuries contaminated with another person's blood or potentially infectious material; and any other illness the employee voluntarily requests be kept private. The employer may also use discretion in describing the injury on the Log if the description itself would identify the employee. Note that the OSHA 300A Summary contains no names, so it may be posted publicly.
ADA and GINA Confidentiality
The ADA requires that all medical information obtained through examinations or inquiries be kept in separate medical files, apart from personnel files, and treated as confidential. Disclosure is limited to supervisors who need to know about restrictions or accommodations, first aid and safety personnel when emergency treatment may be required, and government officials investigating compliance. GINA prohibits requesting, requiring, or purchasing genetic information, including family medical history, and requires any such information lawfully obtained to be kept confidential in separate files. Safety professionals coordinating medical surveillance must be careful that questionnaires do not solicit family medical history unless a GINA safe-harbor notice is used.
Drug Testing, Monitoring, and Investigations
Drug and alcohol test results, fitness-for-duty evaluations, and incident investigation witness statements all raise privacy issues. Best practice and most state laws require results to be disclosed only to those with a legitimate need to know, stored securely, and never placed in general personnel files. Video surveillance, GPS tracking, and wearable technology used for safety purposes should be covered by a written policy and employee notification, and the data retained only as long as necessary for the stated purpose.
Workers Compensation and Insurance Records
Workers compensation claim files are governed primarily by state law, but if they contain medical information they must also be protected under ADA confidentiality rules. Health insurance claim records maintained separately are exempt from 1910.1020 retention, which is a commonly tested distinction.
Putting It Together: A Decision Framework
When facing any records question, ask three questions in order:
1. What type of record is it? Injury/illness (1904), exposure (1910.1020), medical (1910.1020), training, inspection, or administrative.
2. How long must it be kept? 5 years for 1904 forms; 30 years for exposure; duration plus 30 for medical; standard-specific for training and inspections.
3. Who may see it and how fast? Employee access is broad and quick (next business day for 1904, 15 working days for 1910.1020, 4 business hours for government). Third-party access requires written consent for medical records, and privacy concern cases require name removal.
Exam Tips: Answering Questions on Records Retention and Worker Privacy
Tip 1: Master the numbers table. The ASP exam rewards memorization of specific periods. Lock in these pairings: 300/300A/301 = 5 years; exposure = 30 years; medical = employment plus 30 years; noise measurements = 2 years; BBP training = 3 years; 300A posting = Feb 1 to Apr 30; 1910.1020 access = 15 working days; 1904 employee access = end of next business day; government access = 4 business hours; NIOSH notification before disposal = 3 months; fatality report = 8 hours; hospitalization/amputation/eye loss = 24 hours.
Tip 2: Distinguish exposure from medical. If a question describes a record that tells you what the worker was exposed to (air sampling, noise dosimetry, SDS, blood lead as a measure of dose), it is an exposure record and the answer is 30 years. If it describes a record about the worker's health status (physician opinions, exam results, diagnoses, audiograms, vaccination status), it is a medical record and the answer is duration of employment plus 30 years. Biological monitoring can appear in either category depending on wording, so read carefully.
Tip 3: Watch for the short-service exception. Questions love the employee who worked only eight months. Medical records for workers employed less than one year need not be retained if provided to the employee at termination. Exposure records have no such exception.
Tip 4: Know the privacy concern case list cold. Expect a scenario asking whether a specific injury should be entered by name or as a privacy case. Memorize the six categories: intimate body part or reproductive system, sexual assault, mental illness, HIV/hepatitis/TB, contaminated needlestick or sharps, and voluntary request for any illness. A broken arm, a back strain, or an ordinary laceration is entered by name even if the employee prefers otherwise, because the voluntary request option applies to illnesses, not injuries.
Tip 5: Consent rules are a favorite distractor. Medical records require specific written consent before release to anyone other than the employee or OSHA. Exposure records can be accessed by a collective bargaining representative without individual consent. If an answer choice suggests releasing medical records to a union steward or a supervisor without the employee's written authorization, it is wrong.
Tip 6: Remember separate files under the ADA. When a question asks where to store fitness-for-duty results, medical restrictions, or drug test outcomes, the correct answer always involves a separate, confidential medical file with restricted access, never the general personnel file.
Tip 7: Successor employer, then NIOSH. For business closure questions, the sequence is: transfer to successor if one exists; if not, notify employees and NIOSH at least 3 months in advance. Simply shredding records after the business closes is never the right answer.
Tip 8: The 300A is the only publicly visible form. If a question asks which record may be posted where all employees can see it, the answer is the 300A Summary, because it contains totals and no individual names. The 300 Log and 301 forms are never posted.
Tip 9: Updating applies only to the Log. During the 5-year retention period, only the 300 Log must be updated for newly discovered cases or changes; the employer is not required to update the 300A or 301. A question implying you must re-certify and re-post an old summary is a trap.
Tip 10: Read for the role of the requester. The identity of who is asking changes the answer. Employee or personal representative: broad access, fast turnaround. Authorized employee representative: 300 Log in full, 301 only with identifiers removed within 7 days. Government inspector: everything within 4 business hours. Third party or insurer: written consent required for medical information.
Tip 11: When in doubt, choose the more protective option. If two choices seem plausible and one keeps the record longer or restricts access more tightly while still giving the employee their own rights, that choice is usually correct. OSHA minimums are floors, and the exam rarely penalizes longer retention or stronger confidentiality, but it will penalize premature destruction or improper disclosure.
Tip 12: Connect retention to latency. If you forget a number, reason from purpose. Records about chemical and physical agent exposure exist to support diagnosis of diseases that appear decades later, so they are kept 30 years. Injury logs exist to track trends and support inspections, so 5 years suffices. Training records exist to prove competency for the current program cycle, so they are short. This logic will often lead you to the right answer even under exam pressure.
Summary
Records retention and worker privacy together ensure that evidence of workplace exposures and health outcomes survives long enough to protect workers, while the personal details within those records are shielded from inappropriate disclosure. For the ASP exam, know the specific retention periods, the access timelines, the privacy concern case categories, the consent rules for medical versus exposure records, and the ADA requirement for separate confidential files. Approach every question by identifying the record type, the retention clock, and the requester's role, and you will be able to answer confidently and accurately.
Test mode:
ASP - Records Retention and Worker Privacy Example Questions
Test your knowledge of Records Retention and Worker Privacy
Question 1
At a fabrication plant, the recognized union steward submits a written request for two items: the department's area air sampling results for welding fume, and one named welder's audiogram and the physician's written opinion. The welder has signed nothing authorizing release of personal records, and the steward says the welder verbally agreed. Under OSHA's rule on employee access to exposure and medical records, which response is MOST appropriate?
Question 2
What is the primary reason that worker exposure and medical records for toxic substances must be kept for decades after employment ends?
Question 3
At a hospital, a nurse is stuck by a needle contaminated with a patient's blood. The safety coordinator confirms that the case is recordable under the applicable OSHA recordkeeping rule. The nurse asks that her name not be seen by coworkers and employee representatives who may later review the injury and illness log. The coordinator must meet the recording requirement and also protect the nurse's identity. Which action BEST meets both obligations?
Unlock Premium Access
Associate Safety Professional (ASP)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2616 Superior-grade Associate Safety Professional (ASP) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- ASP: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Cancel anytime: 7-day trial with all premium features!
More Records Retention and Worker Privacy questions
19 questions (total)