Privacy, Confidentiality and Access to Records

Why This Topic Matters

Safety professionals sit at the intersection of several sensitive data streams: injury and illness records, exposure monitoring results, medical surveillance findings, drug and alcohol test results, workers' compensation files, and investigation reports. Mishandling this information can expose the employer to regulatory citations, civil liability, discrimination claims, and a loss of employee trust that undermines the entire safety program. At the same time, employees and OSHA have a legal right to see certain records, so the safety professional must balance two duties that pull in opposite directions: protecting privacy and guaranteeing access.

On the CSP exam, this topic appears within the Program Management domain because it tests whether you can run a recordkeeping system that is simultaneously compliant, ethical, and defensible. Expect questions that mix regulatory detail (retention periods, response deadlines, who may request what) with professional judgment (what to do when a supervisor wants to see a worker's medical file). The BCSP Code of Ethics also explicitly requires that certificants hold confidential information in trust, so this is an ethics topic as much as a compliance topic.

What the Topic Covers

Privacy is an individual's right to control information about himself or herself, particularly health and personal information. Confidentiality is the obligation of the person or organization holding that information to protect it from unauthorized disclosure. Access to records is the legal right of specified parties (the employee, a designated representative, and regulators) to obtain copies of certain safety and health records within defined timeframes. A well-run program defines who owns each record, where it is kept, who may see it, how long it is retained, and how it is destroyed.

Key Regulatory Framework (United States)

1. OSHA 29 CFR 1910.1020, Access to Employee Exposure and Medical Records
This is the single most testable standard in this area. It applies to employers who have employees exposed to toxic substances or harmful physical agents and who maintain exposure or medical records.

Exposure records include environmental (workplace) monitoring results, biological monitoring results (unless they are medical), Safety Data Sheets or other chemical inventory records, and any other record showing the identity of a toxic substance or harmful physical agent. Exposure records must be retained for at least 30 years. SDS and chemical inventory records may be discarded if a record identifying the substance, where and when it was used is kept for 30 years.

Medical records include medical and employment questionnaires or histories, results of examinations and lab tests, medical opinions and diagnoses, descriptions of treatments and prescriptions, and employee medical complaints. Medical records must be retained for the duration of employment plus 30 years. Exceptions: health insurance claims records maintained separately, first aid records of one-time treatment and subsequent observation of minor injuries, and medical records of employees who worked for less than one year if the records are given to the employee upon termination.

Analyses using exposure or medical records (for example, an epidemiological study) must be retained for at least 30 years and must have personal identifiers removed before employee access is granted.

Access rights: Each employee, former employee, and designated representative has a right of access to the employee's own exposure records, to exposure records of other employees with past or present job duties or working conditions related to or similar to those of the employee, and to the employee's own medical records. OSHA representatives also have access. The employer must provide access in a reasonable time, place, and manner, and in no event later than 15 working days after the request. If access cannot be provided within 15 working days, the employer must state the reason and the earliest date it will be available. The first copy must be provided free of charge; reasonable costs may be charged for subsequent copies.

Designated representative: Any individual or organization to whom the employee gives specific written consent. A recognized or certified collective bargaining agent (union) is automatically a designated representative for exposure records without written consent, but still needs specific written consent for medical records.

Physician discretion: When a physician believes direct access to a medical record about a terminal illness or psychiatric condition could be detrimental to the employee, the employer may deny direct employee access but must provide the record to a designated representative with specific written consent.

Trade secrets: The employer may withhold the specific chemical identity or process information that is a trade secret, but must disclose the information to a health professional treating an exposed employee in a medical emergency, or under a confidentiality agreement in non-emergency situations. The employer may not withhold information on the health effects or properties of the substance.

Employee notification: Upon initial employment and at least annually thereafter, employers must inform employees of the existence, location, and availability of records, the person responsible for maintaining them, and their rights of access. Transfer of records on cessation of business must follow 1910.1020(h), including notifying NIOSH if no successor employer exists.

2. OSHA 29 CFR Part 1904, Recording and Reporting Occupational Injuries and Illnesses
Part 1904 governs the OSHA 300 Log, 300A Summary, and 301 Incident Report and contains important privacy and access provisions.

Privacy concern cases (1904.29(b)(6) through (b)(10)): The employer must NOT enter the employee's name on the OSHA 300 Log, writing privacy case instead, for: an injury or illness to an intimate body part or reproductive system; an injury or illness resulting from a sexual assault; mental illnesses; HIV infection, hepatitis, or tuberculosis; needlestick injuries and cuts from sharp objects contaminated with another person's blood or other potentially infectious material; and other illnesses if the employee voluntarily requests that his or her name not be entered. The employer must keep a separate, confidential list of the case numbers and employee names. The employer may also use discretion in describing the injury if the description itself would identify the employee.

Employee access under 1904.35: The employer must provide employees, former employees, personal representatives, and authorized employee representatives with access to the OSHA 300 Log by the end of the next business day. The 301 Incident Report describing an employee's own injury must be given to that employee or personal representative by the end of the next business day. Authorized employee representatives (unions) may obtain 301 forms for other employees within 7 calendar days, but only the right-hand side of the form describing the injury; personal information on the left side must be removed. Copies for employees and their representatives are free.

Retention and posting: Part 1904 records must be retained for 5 years following the end of the calendar year they cover and updated during that period. The 300A Summary must be posted from February 1 to April 30 of the following year. Although the 300 Log contains names, the 300A Summary that is posted does not, which is why only the summary is posted publicly.

Government access: OSHA, NIOSH, and state agencies acting under OSHA plans must be given records within 4 business hours of request.

3. Americans with Disabilities Act (ADA)
Medical information obtained through post-offer examinations, fitness-for-duty exams, or accommodation requests must be kept on separate forms and in separate medical files, apart from personnel files, and treated as confidential. Disclosure is permitted only to supervisors and managers regarding necessary restrictions and accommodations, to first aid and safety personnel if the condition might require emergency treatment, and to government officials investigating compliance. The ADA also limits medical inquiries to those that are job-related and consistent with business necessity.

4. Genetic Information Nondiscrimination Act (GINA)
Employers may not request, require, or purchase genetic information, including family medical history, and any genetic information obtained incidentally must be kept confidential in the separate medical file. Safety professionals must ensure that health questionnaires and medical surveillance forms do not solicit family history inappropriately.

5. HIPAA
The HIPAA Privacy Rule applies to covered entities (health plans, healthcare clearinghouses, and providers who transmit health information electronically). Most employers are NOT covered entities in their role as employers, and OSHA-required records maintained by the employer are generally not protected health information under HIPAA. However, an onsite occupational health clinic may be a covered entity, and HIPAA permits disclosures to employers for OSHA-required medical surveillance and work-related injury information. Exam questions often test the distinction: HIPAA does not block an employer from obtaining records it needs to comply with OSHA, but the employer must then protect those records under OSHA and ADA confidentiality rules.

6. Drug and Alcohol Testing (49 CFR Part 40 and state laws)
DOT-regulated testing results are confidential and may be released only to the employer, the Medical Review Officer, the Substance Abuse Professional, and others as expressly permitted. Many states have additional restrictions on who may see test results.

7. FMLA, Workers' Compensation, and State Privacy Laws
FMLA medical certifications must be kept confidential in the separate medical file. Workers' compensation files contain both medical and claims information and typically have state-specific privacy rules. State laws (for example, California's data privacy statutes) and international frameworks such as the EU General Data Protection Regulation (GDPR) impose further requirements for multinational employers, including data minimization, purpose limitation, and the right of individuals to access and correct their personal data.

8. Whistleblower and Anti-Retaliation Protections
Section 11(c) of the OSH Act and 1904.35(b)(1) require employers to have a reasonable procedure for employees to report injuries without fear of retaliation. Confidentiality of complainants to OSHA is protected; OSHA will not reveal the identity of an employee who requests confidentiality when filing a complaint.

How a Confidentiality and Access Program Works in Practice

Step 1: Inventory records. Identify every record type the safety function creates or holds and classify it: exposure, medical, injury/illness, training, inspection, investigation, security, or personnel. Classification determines retention, access, and confidentiality rules.

Step 2: Define custodians. Assign a responsible person for each category. Medical records should be under the control of a licensed health professional or a clearly designated custodian, physically and electronically segregated from personnel files.

Step 3: Establish access controls. Use the principle of need to know and least privilege. Supervisors need to know work restrictions, not diagnoses. Incident investigators need facts about the event, not unrelated medical history. Lock cabinets, password-protect databases, log access, and encrypt data in transit and at rest.

Step 4: Build a written access procedure. Document how an employee requests records, what written consent form is used for designated representatives, how identity is verified, the 15-working-day clock for 1910.1020 records, the next-business-day clock for 1904 records, and how copies are provided.

Step 5: Train and notify. Provide the annual 1910.1020(g) notification, train supervisors on ADA confidentiality, and train anyone who handles records.

Step 6: Retain and dispose properly. Apply the 30-year, duration-plus-30-year, and 5-year schedules; follow legal holds during litigation; destroy records securely (shredding, certified data destruction) when retention ends; and transfer records to successor employers or notify NIOSH on business closure.

Step 7: Handle incident investigations carefully. Investigation reports should focus on causal factors and corrective actions. Witness statements and medical details should be protected, and the report should avoid unnecessary personal information. Consider attorney-client privilege implications when counsel directs an investigation.

Step 8: Audit. Periodically verify that privacy cases are coded correctly on the 300 Log, that the confidential name list exists, that medical files are separate, and that access requests were fulfilled on time.

Ethical Dimension

The BCSP Code of Ethics requires certificants to keep confidential personal and business information obtained during professional practice, unless disclosure is required by law or is necessary to protect the health and safety of others. The ethical safety professional protects worker privacy even when no specific regulation applies, refuses improper requests from management, and discloses information only to those with a legitimate need. When the law and an employer's wishes conflict, the law and the duty to protect workers prevail.

Exam Tips: Answering Questions on Privacy, Confidentiality and Access to Records

Tip 1: Memorize the numbers and attach each to its source.
30 years for exposure records; duration of employment plus 30 years for medical records; 15 working days for 1910.1020 access; end of the next business day for the 300 Log and an employee's own 301; 7 calendar days for a union to receive other employees' 301 forms; 4 business hours for government access to 1904 records; 5 years retention for 1904 records; posting of the 300A from February 1 to April 30; less-than-one-year employment exception for medical records; annual notification of rights. Questions frequently swap working days with calendar days, so read carefully.

Tip 2: Distinguish exposure records from medical records.
Co-workers with similar exposures can see exposure records; nobody but the employee, a representative with specific written consent, and OSHA can see an individual's medical records. A union gets exposure records automatically but needs written consent for medical records. If a question involves a diagnosis, opinion, test result, or treatment, treat it as medical.

Tip 3: Know the privacy concern case list cold.
Intimate body parts or reproductive system, sexual assault, mental illness, HIV/hepatitis/tuberculosis, contaminated sharps and needlesticks, and any other illness the employee asks to keep private. Note that a routine musculoskeletal injury or a non-contaminated laceration is NOT a privacy case even if the employee asks, unless it is an illness. Remember the separate confidential list of names.

Tip 4: When in doubt, choose the answer that separates medical information from personnel files and limits disclosure to need-to-know.
The ADA model (separate file, restricted to restrictions and accommodations for supervisors, emergency information for first aid personnel, and compliance information for government) is the default correct framework.

Tip 5: Do not let HIPAA distract you.
If a question suggests HIPAA prevents an employer from obtaining medical surveillance results required by OSHA, that is usually a distractor. HIPAA permits disclosures needed for OSHA compliance; the employer's obligation is then to protect the information under OSHA and ADA rules.

Tip 6: Watch for the trade secret exception.
The employer may withhold a chemical's specific identity as a trade secret, but never the health hazard information, and must disclose the identity to a treating health professional in an emergency.

Tip 7: Recognize scenario questions testing judgment.
A supervisor asking for an employee's full medical file: the correct response is to provide only the work restrictions. A manager asking to remove a case from the 300 Log because the employee requested privacy: the correct response is to record it as a privacy case, not to omit it. A former employee requesting exposure records: former employees have the same access rights. A business closing with no successor: notify NIOSH and transfer records as required.

Tip 8: Apply the hierarchy of obligations.
Legal requirement first, then professional ethics (BCSP Code), then company policy, then individual preference. An answer that prioritizes convenience or management preference over legal access rights or confidentiality duties is wrong.

Tip 9: Read for the party making the request.
Employee, former employee, designated representative, union, OSHA, NIOSH, state agency, supervisor, insurer, attorney. Each has different rights. The exam often builds the entire question around who is asking.

Tip 10: Eliminate absolute distractors.
Answers stating that records may never be disclosed or must be kept forever are usually wrong. The correct answers reflect specific, bounded rules.

Sample Practice Questions

Question 1: An employee requests a copy of her noise dosimetry results from three years ago. Under 1910.1020, within what timeframe must the employer provide access?
Answer: Within 15 working days of the request. Dosimetry results are exposure records.

Question 2: A union steward, without written consent from the affected worker, requests the 301 form for a co-worker's injury. What must the employer do?
Answer: Provide the form within 7 calendar days with the personal information on the left side removed; the steward is an authorized employee representative entitled to the right-hand portion only.

Question 3: A machine operator contracts hepatitis from a contaminated needlestick while handling trash. How should the case appear on the OSHA 300 Log?
Answer: As a privacy concern case, with the words privacy case instead of the name, and the name kept on a separate confidential list.

Question 4: A worker employed for eight months leaves the company. What is the minimum retention requirement for her medical surveillance file?
Answer: The record need not be retained if it is provided to the employee upon termination, because she was employed less than one year; otherwise it must be kept for the duration of employment plus 30 years.

Question 5: A plant manager asks the safety director to show him an employee's complete fitness-for-duty exam results to decide on a job assignment. What is the appropriate response?
Answer: Provide only the information on work restrictions and necessary accommodations; the full medical record must remain confidential under ADA and 1910.1020 principles.

Summary

Privacy, confidentiality, and access to records are governed by a web of OSHA standards (1910.1020 and Part 1904), employment laws (ADA, GINA, FMLA), health privacy law (HIPAA), drug testing regulations, state and international privacy law, and the BCSP Code of Ethics. The successful CSP candidate memorizes the retention periods and response deadlines, understands who may access what, recognizes privacy concern cases, segregates medical information, and applies a need-to-know standard. In practice and on the exam, the right answer protects the worker's privacy while guaranteeing the worker's and the regulator's legitimate right of access.