Records Retention Requirements

1. Why Records Retention Matters to the Safety Professional

Records are the evidence that a safety and health program actually exists and actually works. A hazard that was identified, a worker who was trained, an exposure that was measured, an injury that was investigated – none of these events can be proven, trended, audited, or defended without a record. On the CSP exam, records retention sits inside the Program Management domain because the safety professional is expected to design, implement, and manage the systems that create, store, protect, retrieve, and eventually destroy those records in compliance with law.

Records retention is important for five practical reasons:

• Legal compliance – OSHA, EPA, DOT, MSHA, and state agencies prescribe specific retention periods. Failure to produce a record on request is itself a citable violation, independent of whether the underlying hazard was controlled.
• Latency of occupational disease – many illnesses (asbestosis, mesothelioma, silicosis, cancers from benzene or hexavalent chromium) appear decades after exposure. This is the reason behind the famous 30-year requirement for exposure and medical records.
• Litigation and claims defense – workers' compensation, toxic tort, and wrongful-death actions are decided on documentation. The absence of a record is often treated as proof the activity never occurred.
• Program evaluation and continuous improvement – trend analysis, leading and lagging indicator tracking, root-cause patterns, and audit follow-up all depend on retrievable historical data.
• Employee rights – workers and their designated representatives have a legal right to access certain records, and the employer must know what to produce and how quickly.

2. What Records Retention Is

Records retention is the systematic practice of keeping documents for a defined period, protecting their integrity and confidentiality during that period, making them accessible to those with a legal right to see them, and disposing of them in a controlled manner when the period ends. A records retention schedule is the written policy that lists each record type, the governing requirement, the retention trigger (for example, end of calendar year, end of employment, date of training, closure of a process), the retention period, the storage location and medium, the records custodian, and the destruction method.

Safety-related records generally fall into these categories:

• Injury and illness records – OSHA 300 Log, 300A Summary, 301 Incident Reports, privacy case lists, sharps injury logs, first-aid logs.
• Exposure records – industrial hygiene sampling results, noise dosimetry, biological monitoring, Safety Data Sheets or chemical inventories that identify what substances were used, where, and when.
• Medical records – medical surveillance results, audiograms, respirator medical evaluations, vaccination records, physician written opinions, employee medical complaints.
• Training records – rosters, certifications, test results, competency evaluations, fit-test records.
• Inspection, testing, and maintenance records – crane and hoist inspections, pressure vessel tests, fire extinguisher inspections, LOTO periodic inspection certifications, confined-space permits.
• Program documents – written programs, hazard assessments, process hazard analyses, management-of-change records, compliance audits, incident investigation reports.
• Environmental records – hazardous waste manifests, biennial reports, inspection logs, emergency response plans, Tier II reports.
• Transportation records – driver qualification files, hours-of-service logs, vehicle inspection and maintenance reports, drug and alcohol testing records, hazmat training records.

3. How It Works: The Key Regulatory Requirements You Must Know

3.1 OSHA Injury and Illness Recordkeeping – 29 CFR 1904

• The OSHA 300 Log, 300A Annual Summary, 301 Incident Reports, and privacy case list must be retained for 5 years following the end of the calendar year that the records cover.
• During that 5-year period the employer must update the 300 Log to include newly discovered recordable cases and to reflect changes in classification, days away, or restricted days. The 300A Summary does not have to be updated.
• The 300A must be posted from February 1 to April 30 of the year following the year covered.
• Records must be provided to current and former employees, personal representatives, and authorized representatives by the end of the next business day when the 300 Log is requested; the 301 form must be provided to the employee by the end of the next business day and to an authorized representative within 7 calendar days (with personal information removed except for the description-of-injury section).
• Government representatives (OSHA, NIOSH, state) must receive copies within 4 business hours.
• If the business changes ownership, the prior owner must transfer the records to the new owner, who must preserve them for the remainder of the retention period.

3.2 Access to Employee Exposure and Medical Records – 29 CFR 1910.1020 (applied to construction by 1926.33)

This is the single most heavily tested retention standard. Learn it in detail.

• Employee medical records must be preserved for at least the duration of employment plus 30 years.
• Employee exposure records must be preserved for at least 30 years.
• Analyses using exposure or medical records (for example, epidemiological studies) must be preserved for at least 30 years.
• Exceptions to the medical-record rule:
– Health insurance claims records maintained separately from the employer's medical program have no retention requirement under this standard.
– First-aid records of one-time treatment and subsequent observation of minor injuries made by a non-physician need not be retained.
– Medical records of employees who worked less than one year need not be retained if they are provided to the employee upon termination.
• Exceptions and special cases for exposure records:
– Background data for workplace monitoring (laboratory reports, worksheets) need only be kept for 1 year, provided the sampling results, collection methodology, description of analytical and mathematical methods, and a summary of relevant data are retained for 30 years.
– Safety Data Sheets (or the older MSDS) need not be kept for 30 years, but some record identifying the chemical identity, where it was used, and when it was used must be retained for 30 years. This is why many employers simply archive SDS files for 30 years.
– Biological monitoring results designated as exposure records by a specific standard are retained as exposure records.
• Access timing – when an employee or designated representative requests a record, the employer must provide access within 15 working days; if it cannot, it must explain why and give the earliest date.
• Notification – employers must inform employees of the existence, location, and availability of records, who is responsible for maintaining them, and their rights of access upon initial employment and at least annually thereafter.
• Transfer of records – an employer ceasing business must transfer records to a successor employer. If there is no successor, the employer must notify affected current employees of their rights of access at least 3 months before cessation and notify the Director of NIOSH at least 3 months before disposal of the records. Trade secret chemical identities may be withheld in some cases, but must be released to a health professional in a medical emergency.

3.3 Substance-Specific OSHA Standards

Most substance-specific standards (asbestos, lead, benzene, cadmium, hexavalent chromium, methylene chloride, formaldehyde, silica, etc.) incorporate the 1910.1020 periods: exposure monitoring records for 30 years and medical surveillance records for duration of employment plus 30 years. Notable additional details:

• Asbestos (1910.1001 / 1926.1101) – training records retained for 1 year beyond the last date of employment of the employee. Building owners must retain records of the presence, location, and quantity of ACM and PACM for the duration of ownership and transfer them to successive owners.
• Lead (1910.1025) – objective data supporting an exemption from initial monitoring is kept 30 years; medical removal records retained for duration of employment.
• Respirable crystalline silica – exposure and medical records follow 1910.1020; objective data retained as long as relied upon.

3.4 Occupational Noise Exposure – 29 CFR 1910.95

• Noise exposure measurement records – retained for 2 years.
• Audiometric test records – retained for the duration of the affected employee's employment. (Note how this differs from the 30-year rule – a favorite exam distractor.)
• Records must be made available to employees, former employees, designated representatives, and OSHA.

3.5 Respiratory Protection – 29 CFR 1910.134

• Medical evaluation records are retained per 1910.1020 (duration of employment plus 30 years).
• Fit-test records are retained until the next fit test is administered (fit tests are required at least annually).
• The written program must be retained and available.

3.6 Bloodborne Pathogens – 29 CFR 1910.1030

• Medical records (HBV vaccination status, post-exposure evaluation, healthcare professional's written opinion) – duration of employment plus 30 years.
• Training records – 3 years from the date of training.
• Sharps injury log – retained per 1904 (5 years following the end of the calendar year).

3.7 Process Safety Management – 29 CFR 1910.119

• Process hazard analyses and all updates/revalidations – retained for the life of the process.
• Incident investigation reports – retained for 5 years.
• Compliance audits – the two most recent audit reports must be retained.
• Training records – must document the identity of the employee, date of training, and the means used to verify understanding; must reflect the most recent refresher (every 3 years).
• Mechanical integrity – inspection and test documentation (date, inspector, equipment identification, description of test, results) must be retained.
• Contractor employee injury and illness log – maintained for contract employees working in process areas.
• Process safety information – must be retained and kept current for the life of the process.

3.8 Other Frequently Tested OSHA Provisions

• Permit-required confined spaces (1910.146) – canceled entry permits retained for at least 1 year to facilitate the annual program review.
• Control of hazardous energy (1910.147) – periodic inspection certification (at least annually) identifying the machine, date, employees included, and inspector. No specific retention period beyond documenting the current inspection, but best practice is to retain until superseded plus the organizational standard.
• Powered industrial trucks (1910.178) – certification of training and evaluation (operator name, date of training, date of evaluation, evaluator). Evaluation required at least every 3 years.
• Personal protective equipment (1910.132) – written certification of the hazard assessment and of training.
• Cranes – under 1910.179, monthly inspection records of hooks, hoist chains, and ropes are kept with the inspector's signature and date; under 1926.1412 (construction cranes), monthly inspection documentation is retained a minimum of 3 months and annual inspection documentation a minimum of 12 months.
• Hazard communication (1910.1200) – no stated retention period for SDS, but 1910.1020 requires chemical identity, location, and dates of use to be retained for 30 years.
• Emergency action and fire prevention plans – must be in writing and available; retained while current.

3.9 EPA / RCRA – 40 CFR Parts 262 and 264/265

• Hazardous waste manifests – generator keeps a signed copy for 3 years from the date the waste was accepted by the initial transporter.
• Biennial reports and exception reports – 3 years from the due date of the report.
• Test results, waste analyses, and land disposal restriction notifications – 3 years from the date the waste was last sent to on-site or off-site treatment, storage, or disposal.
• Inspection logs at TSDFs – 3 years.
• Personnel training records at TSDFs and large quantity generators – retained until closure of the facility for current employees and 3 years after termination for former employees.
• All RCRA retention periods are automatically extended during any unresolved enforcement action or when requested by the EPA Administrator.
• EPCRA Tier II – no federal retention requirement, but 3 years is commonly used; SARA 313 TRI supporting documentation must be kept 3 years.

3.10 DOT / FMCSA / PHMSA – 49 CFR

• Hazmat employee training records (172.704) – retained for the duration of employment and 90 days thereafter; recurrent training every 3 years.
• Driver qualification files (391.51) – retained for as long as the driver is employed plus 3 years.
• Records of duty status / hours of service (395.8) – retained for 6 months.
• Driver vehicle inspection reports (396.11) – retained for 3 months.
• Annual (periodic) vehicle inspection reports (396.21) – retained for 14 months.
• Vehicle maintenance records (396.3) – retained 1 year at the location where the vehicle is housed and 6 months after the vehicle leaves the carrier's control.
• Drug and alcohol testing records (382.401) – positive results, refusals, and annual summaries: 5 years; records of the collection process and EBT calibration: 2 years; negative and canceled drug tests and alcohol results below 0.02: 1 year; education and training records: 2 years after ceasing to perform those functions.
• Accident register (390.15) – retained for 3 years after the date of the accident.

3.11 MSHA – 30 CFR

• Part 50 accident, injury, and illness reports (Form 7000-1) and employment/production reports – retained 5 years after submission.
• Part 48 training certificates (Form 5000-23) – retained for 2 years after the miner ceases employment, or for 60 days after the mine closes.
• Part 46 training records – retained 2 years after the miner ceases work or 60 days after mine closure.
• Part 56/57 inspection and examination records of workplaces, electrical equipment, etc. – generally 1 year.

3.12 Related Employment Records

• FLSA payroll records – 3 years; supporting time cards 2 years.
• FMLA records – 3 years.
• ADA / GINA – medical information must be kept in separate, confidential files apart from personnel files.
• Workers' compensation – varies by state, commonly 5 to 10 years or the statute of limitations plus a margin; many employers default to the 30-year medical-record period for anything that could be considered a medical record.

4. How It Works: Building and Managing a Records Retention Program

A compliant program follows a life-cycle approach:

1. Inventory every safety, health, environmental, and transportation record the organization creates.
2. Identify the governing requirement for each (federal, state, contractual, insurance, corporate). When requirements conflict, the longest applicable period controls.
3. Classify each record (medical, exposure, injury/illness, training, inspection, program) because classification drives the retention period and the confidentiality controls.
4. Define the retention trigger precisely – end of calendar year, date of creation, termination of employment, date of next inspection, life of the process, closure of the facility.
5. Assign a custodian and a storage medium. Electronic records are acceptable if they are legible, readily retrievable, protected against alteration and loss, and can be produced within the required time frames. Backups and migration plans are needed for 30-year records because software and media become obsolete.
6. Protect confidentiality – medical records are kept separate from personnel files with restricted access; privacy-concern cases on the OSHA 300 Log are entered as privacy case numbers.
7. Provide access within legal time limits (next business day / 7 days / 4 business hours under 1904; 15 working days under 1910.1020).
8. Implement legal holds – when litigation or a government investigation is pending or reasonably anticipated, all routine destruction of potentially relevant records must be suspended, regardless of the schedule.
9. Destroy records in a documented, secure manner when the period expires, and document the destruction (what, when, who authorized).
10. Audit the program periodically and update the schedule when regulations change or when the organization acquires, sells, or closes operations (remember the successor-employer and NIOSH notification rules).

Good practice is to retain records at least as long as the law requires; many organizations retain anything medical or exposure-related permanently because the cost of storage is small compared with the cost of being unable to defend a latent-disease claim.

5. How to Answer Exam Questions on Records Retention

CSP questions on this topic are usually one of four types: (a) recall of a specific retention period, (b) identification of which category a record belongs to, (c) application of access or transfer rules, and (d) scenario-based program management judgment. Use this approach:

Step 1 – Identify the regulation. Is the record under OSHA 1904 (injury/illness), 1910.1020 (exposure/medical), a substance-specific standard, PSM, RCRA, DOT, or MSHA? The agency and part number narrow the answer immediately.

Step 2 – Classify the record. Ask: Is this a medical record (anything about an individual's health status), an exposure record (anything about agents in the workplace), an injury/illness record, or a training/inspection record? The classification is often the real question hidden inside the scenario.

Step 3 – Identify the trigger. Watch for phrases like following the end of the calendar year (1904), duration of employment plus (medical records), from the date of training (BBP), until the next (fit test), life of the process (PHA), from the date accepted by the initial transporter (manifests).

Step 4 – Apply the number. Memorize the core set: 5 years (OSHA 300/301, PSM incident reports, MSHA Part 50, DOT positive drug tests), 30 years (exposure records, analyses, chemical identity), employment + 30 (medical records), 3 years (BBP training, RCRA manifests, DOT accident register, DQ files after departure), 2 years (noise measurements, MSHA training), 1 year (confined space permits, IH background data, asbestos training beyond employment), 15 working days (1910.1020 access), 3 months (NIOSH notification).

Step 5 – Eliminate distractors. Wrong answers often swap exposure and medical periods, apply the 30-year rule to audiograms (which is actually duration of employment), apply 1904's calendar-year trigger to medical records, or offer the SDS as something that must itself be kept 30 years (it is the chemical identity information that must survive).

Step 6 – For judgment questions, choose the most conservative compliant answer. When two requirements apply, the longer period wins. When litigation is anticipated, destruction stops. When the company closes, records are transferred to a successor or NIOSH is notified. When an employee requests a record, it is provided within the regulatory time frame regardless of internal policy.

6. Exam Tips: Answering Questions on Records Retention Requirements

• Memorize the big three first: injury/illness = 5 years after the calendar year; exposure = 30 years; medical = employment + 30 years. A large share of questions resolve with these alone.
• Read for the word plus. Only medical records carry the duration-of-employment-plus-30 formula. Exposure records are a flat 30 years regardless of how long the person worked.
• Know the exceptions to 1910.1020. Less than one year of employment with records given to the employee, first-aid logs for minor one-time treatment, and separately maintained insurance claims are the three classic exceptions.
• Do not confuse update duties. The OSHA 300 Log must be updated during the 5-year retention period; the 300A does not.
• Noise is the outlier. Audiograms are kept for duration of employment (not plus 30) and noise measurements for only 2 years. Expect a question built on this.
• Training record periods vary by standard. BBP = 3 years from the date of training; asbestos = 1 year beyond last date of employment; DOT hazmat = employment plus 90 days; RCRA = until closure (current) / 3 years after termination (former); PSM = document most recent training including the method of verifying understanding.
• PSM has its own set: PHA for the life of the process, incident investigations 5 years, two most recent compliance audits.
• RCRA is almost always 3 years, with automatic extension during enforcement actions.
• DOT numbers are varied – HOS logs 6 months, DVIRs 3 months, annual inspections 14 months, maintenance 1 year, positive drug tests 5 years, negative 1 year, accident register 3 years, DQ files 3 years after departure.
• Access time limits are testable: 1904 – next business day (employee), 7 calendar days (authorized representative for 301 forms), 4 business hours (government); 1910.1020 – 15 working days.
• Company closure: transfer to successor; if none, notify employees and NIOSH at least 3 months in advance.
• Electronic records are acceptable if retrievable, legible, protected, and producible within the required time. Questions describing a system that cannot retrieve records quickly are pointing to a noncompliance.
• Longest requirement governs when federal, state, contractual, or corporate requirements overlap.
• Legal hold overrides the schedule. If a scenario mentions a lawsuit, subpoena, or OSHA investigation, the correct action is to suspend destruction.
• Separate medical files from personnel files – a confidentiality question is often disguised as a records question.
• Look for the trigger words in the stem before looking at the numbers in the options; most wrong answers use a correct number with the wrong trigger.
• When unsure between two periods, pick the longer one only if the question asks what an employer should do to ensure compliance; if it asks what the regulation requires, choose the exact regulatory figure.

7. Practice Questions

Q1. An employee worked at a chemical plant for 8 years and left in 2020. Under 29 CFR 1910.1020, how long must the employer retain that employee's medical surveillance records?
Answer: At least 30 years after termination (duration of employment plus 30 years), i.e., until at least 2050.

Q2. Industrial hygiene air sampling was performed in 2015. The laboratory bench sheets may be discarded after what period, provided the results, methodology, and data summary are retained for 30 years?
Answer: 1 year.

Q3. How long must an employer retain the OSHA 300 Log covering calendar year 2023?
Answer: 5 years following the end of 2023 – through December 31, 2028 – and it must be updated with newly discovered or reclassified cases during that time.

Q4. Audiometric test records under the OSHA noise standard must be kept for how long?
Answer: The duration of the affected employee's employment. (Noise exposure measurements: 2 years.)

Q5. A PSM-covered facility replaced its process hazard analysis with a revalidated version. What must be done with the earlier PHA?
Answer: Retain it; PHAs and all updates and revalidations are kept for the life of the process.

Q6. A large quantity generator ships hazardous waste off-site. How long must the signed manifest copy be retained?
Answer: 3 years from the date the waste was accepted by the initial transporter, extended automatically during unresolved enforcement actions.

Q7. An employer is closing permanently and has no successor. What must it do with 30-year exposure records?
Answer: Notify affected employees of their access rights at least 3 months before closing and notify the Director of NIOSH at least 3 months before disposing of the records.

Q8. How long are bloodborne pathogens training records retained?
Answer: 3 years from the date the training occurred.

Q9. A respirator fit test was performed in March. How long must that record be kept?
Answer: Until the next fit test is administered.

Q10. Within what time must an employer provide an employee access to a requested exposure record under 1910.1020?
Answer: 15 working days.

8. Quick-Reference Summary Table (text form)

• OSHA 300/300A/301, privacy list, sharps log – 5 years after the end of the calendar year
• Exposure records – 30 years
• Analyses of exposure/medical data – 30 years
• Chemical identity / where / when used (SDS surrogate) – 30 years
• Medical records – duration of employment + 30 years (exceptions: under 1 year employed and given to employee; first-aid minor treatment; separate insurance claims)
• IH background/lab data – 1 year if summary data kept 30 years
• Noise measurements – 2 years; audiograms – duration of employment
• Fit tests – until next fit test
• BBP training – 3 years; asbestos training – 1 year beyond last employment
• PSM: PHA – life of process; incident investigations – 5 years; compliance audits – two most recent
• Confined-space canceled permits – 1 year
• Construction crane monthly inspections – 3 months; annual – 12 months
• RCRA manifests, reports, waste analyses, inspection logs – 3 years; TSDF training – until closure / 3 years after termination
• DOT hazmat training – employment + 90 days; DQ file – employment + 3 years; HOS – 6 months; DVIR – 3 months; annual inspection – 14 months; maintenance – 1 year (+6 months after disposal); drug/alcohol positives – 5 years, negatives – 1 year; accident register – 3 years
• MSHA Part 50 – 5 years; Part 46/48 training – 2 years after cessation
• Access: 1904 – next business day / 7 days / 4 business hours; 1910.1020 – 15 working days; annual employee notification
• Closure – transfer to successor or 3-month notice to employees and NIOSH

Master the triggers, the classifications, and the handful of numbers above, and records retention questions on the CSP exam become some of the most reliable points you can earn.