OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

Subject: 29 CFR 1913.10(b)(6), Authorization of Review of Specific Medical Information

A. Purpose. This instruction authorizes appropriately qualified OSHA personnel to conduct reviews of the medical records specified in G. of this instruction where there is a need to gain access for enforcement purposes.

B. Scope. This instruction applies OSHA-wide.

C. Action. OSHA Regional Administrators and Area Directors shall assure that this authorization to review specific medical information is administered and implemented according to F., G., H., I. and J. of this instruction.

D. Federal Program Change. This instruction describes a Federal program change which affects State programs. Each Regional Administrator shall:

1. Ensure that this change is forwarded to each State designee.

2. Explain the technical content of the change to the State designee as requested.

3. Ensure that State designees are asked to acknowledge receipt of this Federal program change in writing, within 30 days of notification, to the Regional Administrator. This acknowledgment should include a description either of the State's plan to implement the change or the reasons why the change should not apply to that State.

4. Review policies, instructions and guidelines issued by the State to determine that this change has been communicated to State program personnel. Routine monitoring activities (accompanied inspections and case file reviews) shall also be used to determine if this change has been implemented in actual performance.

OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

E. Background.

1. For compliance purposes, and solely in order to verify employer compliance with recordkeeping requirements, OSHA compliance personnel are permitted access to that employee medical information which is part of a medical surveillance program mandated by specific occupational health standards; i.e., in order to determine that the medical information exists. (See 29 CFR 1910.20(e)(3) and 29 CFR 1910.13(b)(4).) In doing so:

a. OSHA compliance personnel should verify employer compliance with medical recordkeeping requirements by interviewing employer and employee representatives, employees, and, where appropriate, physicians.

b. In addition, compliance officers may want to verify compliance by determining that appropriate medical records exist as required. Where medical records are used to verify compliance:

(1) Documentation of non-compliance will comprise only the employee's name and the violation, and not the specific medical information.

(2) Documentation of compliance will consist of a statement attesting to a check of some of the records and compliance with the specific recordkeeping requirements.

(3) No analysis is to be made of the medical content of the file. If copying or review of the content of the records is necessary, the Area Director must follow the procedures set forth in 29 CFR 1913.10 (e.g., appoint a Principal OSHA Investigator).

2. OSHA compliance personnel also are permitted access (for compliance purposes) to biological monitoring results which directly assess the absorption of a substance or agent by body systems (e.g., blood lead levels). These results are treated by 29 CFR 1910.20(c)(5) as exposure records.

OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

3. Procedures for access to medical opinions mandated by existing standards are described in OSHA Instruction CPL 2-2.30.

4. There may, however, be compliance needs for reviewing the content of and if appropriate, copying employee medical records that pertain to diagnostic tests which measure or reflect the adverse effects of exposure to toxic substances or harmful physical agents. 29 CFR 1910.20(c)(6) treats these as medical records.

F. Application and Statutory Purpose.

1. 29 CFR 1913.10(b)(6) excluded from the rules of agency practice and procedure situations "where a written directive by the Assistant Secretary authorizes appropriately qualified personnel to conduct limited reviews of specific medical information mandated by an occupational safety and health standard, or of specific biological monitoring test results."

2. Thus, this instruction authorizes appropriately qualified field personnel to conduct reviews of the tests named in G. of this instruction where the supervisory Industrial Hygienist determines that there is a need to gain access for enforcement purposes.

a. This authorization applies where the tests are part of medical surveillance programs mandated by standards; or where a laboratory test is not mandated by a standard but is:

(1) A recognized indicator of a worker's past and/or potential exposure to a toxic substance or harmful physical agent which is known to be present or is likely to be present (e.g., hippuric acid found in the urine due to exposure to toluene); or

(2) A recognized indicator of an adverse health effect of that substance or agent (e.g., pulmonary function testing of workers exposed to silica).

OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

b. For the purposes of this instruction, "employee medical record" means any record concerning a current or former employee's health as it pertains to the laboratory tests specified in G. of this instruction, and which is made or maintained by a physician, nurse, technician, or other health care personnel. This includes:

(2) Control, certification, and standardization data used for the laboratory determinations and findings.

3. Statutory Purpose. The purpose of obtaining access to this medical information is to assure safe and healthful working conditions for working men and women by providing an effective enforcement program for OSHA standards and the Occupational Safety and Health Act.

G. Specific Medical Information. This instruction authorizes the examination of the content of and, if appropriate, the copying of employee medical records pertaining to the following:

1. Pulmonary function tests.

2. Audiograms.

3. Blood Urea Nitrogen (BUN).

4. Serum creatinine.

5. Complete blood count with differential and description of peripheral smear.

6. Serum electrolytes.

7. Serum calcium.

8. Serum phosphorus.

9. Lactic dehydrogenase (LDH).

10. Creatine phosphokinase (CPK).

OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

11. Serum glutamic-oxaloacetic transaminase (SGOT).

12. Serum glutamic-pyruvic transaminase (SGPT).

13. Urinalysis, including test for hematuria, glucosuria, proteinuria, ketonuria, and microscopic examination of urine.

14. Zinc protoporphyrin test. 15. Erythrocyte and plasma cholinesterase assays.

16. Metabolites found in urine when a specific exposure is identified or postulated.

17. Metabolites found in blood when a specific exposure is identified or postulated.

18. Radiologists' interpretations of employee X-rays.

19. Erythrocyte sedimentation rate.

20. Platelet count.

21. Serum bilirubin.

22. Urine and sputum cytology reports.

23. Serum triglycerides.

24. Serum cholesterol.

H. Qualified Compliance Personnel. Review of the results of any medical tests named in G. of this instruction which are in personally identifiable form shall be limited to:

1. OSHA field-qualified Industrial Hygienists, of at least Grade GS-11; or

2. Professionals with specific training or experience in medical disciplines, if approved by a National Office physician.

OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

I. Compliance Procedures.

1. Before obtaining access to the medical information described in G. of this instruction, it must be determined by the OSHA supervisory Industrial Hygienist that there is a genuine and supportable need to gain access for OSHA enforcement puposes.

a. Review of the medical information named in G. of this instruction could be relevant to the type of enforcement action OSHA may initiate against an employer, or could serve as evidence of the appropriateness of an enforcement action. The following considerations are among those which could indicate the need to gain access to such personally identifiable employee medical information:

(1) To document employer knowledge by establishing that the records show a pattern of disease.

(2) To provide evidence that the employer willfully violated an OSHA standard.

(4) To document inadequate management of employees found to have evidence of adverse health effects. For example, to document that workers were not adequately notified of abnormal laboratory values or that appropriate followup protective measures were not taken.

b. A determination must also be made that:

(1) An employee is subjected to a toxic substance or harmful physical agent in the course of employment through any route of entry (e.g., inhalation, ingestion, skin contact or absorption, etc.). This determination of the employee's exposure includes both past or potential exposure.

OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

(2) The laboratory test is a recognized indicator of this employee's past and/or potential exposure to a toxic substance or harmful physical agent, or recognized indicator of an adverse health effect of such an exposure. This can be derived from a variety of sources, including recognized textbooks in the fields of industrial hygiene, medicine and toxicology; Federal publications; and technical journals.

c. This instruction does not authorize the compliance officer to examine records for the purpose of identifying trends of illnesses which are not directly related to the recognized adverse effects of specific substances or agents. Thus, the compliance officer is not to do investigative research or conduct a wholesale investigation of medical records to identify possible violations.

2. Access to medical information named in G. of this instruction shall, if practicable, involve on-site review. A minimum of personally identifiable information shall be recorded for enforcement purposes and taken off-site.

3. Compliance personnel shall use, if available, the normal ranges for the laboratory conducting the test, or normal values established in accepted medical texts.

4. When an abnormality is identified, the compliance officer shall investigate the abnormality through one or more of the following mechanisms:

a. Consult with the examining physician or health care personnel in charge of or who has access to employee medical records. If, based on this consultation, the compliance officer determines that no further investigation is necessary, documentation shall be made in the files of:

OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

(3) All abnormalities found (without personally identifiable information); and

NOTE: Personally identifiable information shall be removed from all other field notes concerning these test results once a decision has been made that no further action is necessary.

b. If the procedure described in I.4.a. above was not followed, or it was followed but no satisfactory response was given, the Area Director shall contact the Regional Office, and the Regional Office in turn shall either obtain the services of a medical consultant or contact the National Office medical staff.

5. Notifying Employees of Abnormal Results.

a. When abnormalities have been satisfactorily explained by the employer's physician, the compliance officer shall investigate whether the physician notified the employee of the results.

b. When the services of a contract or National Office physician have been used, the compliance officer shall ensure that the physician notifies the employee of any abnormalities found.

6. OSHA compliance officers have the responsibility to maintain the confidentiality of all medical information and records.

a. The compliance officer shall not discuss any of the information found in the records which is or could be identified with specific individuals, with any employer or employee representatives, except the physician or health care personnel in charge of or who has access to employee medical records. This restriction applies even in situations where such medical information may be known to those (or other) individuals.

b. However, the compliance officer is authorized to reveal the following information to an employee whose medical record has been looked at:

OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

(3) The normal ranges used and where these ranges were derived; and

(4) The numerical test result if known by the compliance officer.

NOTE:

(1) Under no circumstances should the compliance officer attempt any further discussion with the employee of the meaning of the results, conclusions, interpretations, diagnoses, etc. These judgments can only be made in view of the total medical record and only by an examining physician. If the employee wants clarification, he/she shall be referred to a physician for any discussion of test results.

(2) The compliance officer shall not re-examine the medical records solely to inform an employee of his/her test results.

7. Security Procedures. Whenever personally identifiable employee medical information is obtained pursuant to this instruction and taken off-site, the Area Director shall:

a. Promptly name a Principal OSHA Investigator to assure protection of this information.

b. Assure that the personally identifiable medical information obtained shall thereafter be subject to the use and security requirements of 29 CFR 1913.10(h)-(m).

8. Access to this medical information for purposes other than for the limited enforcement needs illustrated in I. of this instruction will require a written access order (29 CFR 1913.10(d)) unless:

a. Specific written consent of an employee is obtained pursuant to 29 CFR 1910.20(e)(2)(ii),

OSHA Instruction CPL 2-2.32 January 19, 1981 Office of Compliance Programming

and the agency or an agency employee is listed on the authorization as the designated representative to receive the medical information.

b. An OSHA staff or contract physician consults with an employer's physician pursuant to 29 CFR 1913.10(d)(4)(ii).

J. Citations.

1. If abnormalities have been detected and the employee has not been notified, the Regional Office should consult with the National Office before issuing a citation.

2. Documentation to support a citation (see paragraph I. 1. a. of this instruction) shall include personally identifiable information. However, this information shall not be disclosed on the citation.

Eula Bingham Assistant Secretary Occupational Safety and Health

DISTRIBUTION: National, Regional and Area Offices All Compliance Officers State Designees NIOSH Regional Program Directors