Access to Medical and Exposure Records

The following is a text extract of the OSHA 3169 Publication. The official full color publication is a 25.5" x 11" landscape presentation in PDF format.

Who should read this booklet?

  • If you are an employee who has a possible exposure to or uses toxic substances or harmful physical agents at your work site or an employer who has employees that may be exposed, you need to know your rights and responsibilities under OSHA’s standard on Access to Employee Exposure and Medical Records [Title 29 of the Code of Federal Regulations (CFR) Part 1910.1020].1
    If you are an employee who may have been exposed to toxic substances or harmful physical agents in the workplace, OSHA’s regulation may help you detect, prevent, and treat occupational disease.

    You have the right to access relevant exposure and medical records and to know how OSHA’s standard covers you if you are any of the following:

  • A current or former employee who is or may have been exposed to toxic substances or harmful physical agents.

  • An employee who was assigned or transferred to work involving toxic substances or harmful physical agents.

  • The legal representative of a deceased or legally incapacitated employee who was or may have been exposed to toxic substances or harmful physical agents.

  • Designated employee representatives may access employee medical or exposure records and analyses created from those records only in very specific circumstances. Designated employee representatives include any individual or organization to whom an employee has given written authorization to exercise a right of access.

What types of exposures should I be concerned about?

  • The tandard covers records documenting the amount of employee exposure to “toxic substances and harmful physical agents.” Toxic substances and harmful physical agents may include the following:2
  • Metals and dusts, such as, lead, cadmium, and silica.
  • Biological agents, such as bacteria, viruses, and fungi.
  • Physical stress, such as noise, heat, cold, vibration, repetitive motion, and ionizing and non-ionizing radiation.

What is "access"?

Access means the right to examine and copy medical and exposure records. As an employee, you have the right to access exposure and medical records and analyses based on these records that concern your employment. An employer must permit employees and, in certain circumstances their designated representatives,to access exposure and medical records relevant to the employee, free of charge, within a reasonable period of time. As an employee, you and your designated representatives may access your medical and exposure records in one of three ways:

  • The employer may give you a copy of the document, or

  • The employer may provide facilities for you to copy the document, or

  • The employer may loan you the document to copy it offsite.

As an employee, what types of records can I access?

You may access any employee exposure records that show the measuring or monitoring of your own exposure to a toxic substance or harmful physical agent. If your employer does not have any records that specifically chart your own exposure levels, you may access the exposure records of employees who engage in similar work or working conditions and may have experienced exposures similar to yours. Employee exposure records include the following:

  • Monitoring results of workplace air or measurements of toxic substances or harmful physical agents in the workplace, including personal, area, grab, wipe, or other forms of sampling results.

  • Biological monitoring results, such as blood and urine test results.

  • Material safety data sheets (MSDSs) containing information about a substance’s hazards to human health.

You also may access any employee medical records concerning your health status that were created or maintained by a physician, nurse, health care professional, or technician. Employee medical records include the following:

  • Medical and employment questionnaires or histories.

  • Results of medical examinations and laboratory tests.

  • Medical opinions, diagnoses, progress notes, and recommendations.

  • First-aid records.

  • Descriptions of treatments and prescriptions.

  • Employee medical complaints.

In addition, you may access any analyses—compilations of data or statistical studies—of employee medical and exposure records that concern your working conditions or workplace. If an analysis includes information that could be used to directly or indirectly identify individual employees, however, the employer is required to remove these “identifiers” to the extent possible before permitting employee access to the analysis. Examples of identifiers include an employee’s name, address, social security number, and job title.

What types of records can a designated employee representative access?

The OSHA standard recognizes two types of designated representatives: (1) an individual or organization to whom the employee has given written authorization to access his or her medical or exposure records, and (2) a recognized or certified collective bargaining agent. To access employee information, employee representatives must follow very specific requirements, such as the following:

  • Employee Exposure Records. Recognized or certified collective bargaining agents may access employee exposure records without individual employees’ written consent. The designated representative must request access in writing from the employer, however, and must specify the records to be disclosed and the occupational health need for accessing the records.

  • Employee Medical Records. Designated representatives may access the medical records of any employees who have given the representative specific written consent. As with employee access to medical records, access is limited to those records pertaining to the authorizing employees.

  • Analyses. For the purpose of analyses using exposure or medical records, recognized or certified collective bargaining agents may access the records without individual employee’s written consent. As with employee access, however, the employer must remove or prevent access to any information in these analyses that could reasonably be used to identify the individual employees whose records are the subject of the analyses.

As an employer, what do I need to know about this standard?

If you are an employer, you must do the following:
  • Preserve and maintain accurate medical and exposure records for each employee.3

  • Inform workers of the existence, location, and availability of those medical and exposure records.

  • Give employees any informational material regarding this standard that OSHA makes available to you.

  • Make records available to employees, their designated representatives, and to OSHA, as required.

Do employers have to make all records available?

No. If you are an employer, the following are not considered “medical records” under this standard:

  • Physical specimens, such as blood and urine samples.

  • Records concerning health insurance claims if they are (1) maintained separately from your medical program and its records, and (2) not accessible by employee name or other personal identifier (e.g., social security number or home address).

  • Records created only for use in litigation that are privileged from discovery.

  • Records created as part of voluntary employee assistance programs, such as records for alcohol and drug abuse or personal counseling, if they are maintained separately from your medical program and its records.

  • Trade secret information involving manufacturing processes or a percentage of a chemical substance in a mixture, as long as you inform health professionals and employees and their designated representatives that you have deleted that information from medical and exposure records. If the exclusion of the trade secret information substantially impairs the evaluation of when and where the exposure occurred, however, you must provide alternative information to the employee consistent with the requirements of 29 CFR Part 1910.1020.

What if I do not have exposure records for a particular employee?

If you do not have exposure records that document the amount of a toxic substance or harmful physical agent that the requesting employee has been exposed to, you must give the requesting employee the records of other employees (with personal identifiers removed) with similar duties or working conditions that reasonably indicate the amount and nature of exposures the employee requesting the records may have had.

You also may be required to supply exposure records that reasonably indicate the amount and nature of toxic substances or harmful physical agents at a particular workplace, or used in a specific working condition, to which the requesting employee is being assigned or transferred.

How long do I have to keep employee exposure and medical records and other exposure information?

Unless another OSHA rule specifically provides a different period of time, you must keep the following:

  • Employee medical records for at least the duration of the employee’s employment plus 30 years, except for

    • Health insurance claims records that you maintain separately from your medical program and its records.

    • First-aid records made onsite by a non-physician of one-time treatment and later observations of minor scratches, scrapes, or other injuries that did not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job.

    • Medical records of employees who have worked for less than 1 year as long as you offer all such records to the employee upon termination of employment.

  • Employee exposure records for at least 30 years, except for

    • Background data related to environmental, or workplace, monitoring or measuring—such as laboratory reports and worksheets—must only be retained for 1 year, so long as you preserve certain interpretive documents relevant to the interpretation of the data for 30 years.

    • MSDSs and other specified records concerning the identity of a substance or agent, so long as you keep some record of the identity, preferably the chemical name and information on when and where it was used, for 30 years.

    • Biological monitoring results designated as exposure records by specific OSHA standards shall be preserved and maintained as required by the specific standard governing their use.

  • Analyses using medical or exposure records for at least 30 years.

What if I go out of business?

If you go out of business, you must do the following:

  • Transfer all records subject to this standard to the successor employer OR, if there is no successor,

  • Notify current employees at least 3 months before the business closes of their right to access their records. You also must either transfer the records required to be preserved under this standard to the National Institute for Occupational Safety and Health (NIOSH), or notify the Director of NIOSH in writing of your intent to dispose of the records 3 months before that disposal.

Does the standard cover me if I work or run a business in a state that operates its own job safety plan?

Yes. OSHA requires states with their own safety and health programs to have rules and enforcement programs that are at least as effective as those of the federal program

  • If you are an employee in an OSHA-approved state plan, you have the same rights as employees in states under federal OSHA jurisdiction, but your state plan may have additional requirements.

  • If you are an employer in a state plan, you have at least the same responsibilities and rights as employers in states under federal OSHA jurisdiction, but your state plan may have additional requirements.

For more information on state plans, contact the state plan in your state or visit OSHA’s website at

How can I get assistance or more information about OSHA and its requirements?

OSHA operates technical assistance, training and education, and consultation programs to help employers and employees understand rules and their requirements.

In addition, OSHA’s website—— contains information on agency programs, activities, policies, rules, training and education, outreach, and more. For a list of available publications and information on OSHA electronic products, visit the website or contact the OSHA Publications Office, P.O. Box 37535, Washington, DC 20013-7535; (202) 693-1888 (phone); or (202) 693-2498 (fax). For a schedule of OSHA training and education courses, contact the OSHA Training Institute, 1555 Times Drive, Des Plaines, IL 60018, (708) 297-4810, or OSHA’s online course schedule.

For more information about Access to Employee Exposure and Medical Records, see Standards on OSHA’s website, or contact your nearest OSHA Regional Office.

Atlanta .......................... (404) 562-2300
Boston .......................... (617) 565-9860
Chicago ........................ (312) 353-2220
Dallas ........................... (214) 767-4731
Denver .......................... (303) 844-1600
Kansas City ................... (816) 426-5861
New York ...................... (212) 337-2378
Philadelphia .................. (215) 861-4900
San Francisco ................ (415) 975-4310
Seattle .......................... (206) 553-5930

To file a complaint, report an emergency, or seek OSHA advice, assistance, or products, call 1-800-321-OSHA or your nearest regional office. The teletypewriter (TTY) number is 1-877-889-5627.

1 Particular circumstances may vary for access to medical and exposure records. Refer to the provisions of the OSHA standard for specific information and requirements.

2 According to OSHA’s regulation, “toxic substance or harmful physical agent” posing a hazard to human health must either (1) be listed in the latest edition of the NIOSH Registry of Toxic Effects of Chemical (2) have yielded positive evidence of an acute or chronic health hazard in testing conducted by or known to the employer, or (3) be the subject of a material safety data sheet (MSDS) kept by or known to the employer indicating that the material may pose a hazard to human health.

3 The Americans with Disabilities Act of 1990 (ADA), 42 U.S.C. §12112(d)(3)(B)-(C) generally requires employers to keep employee medical information confidential. Equal Employment Opportunity Commission (EEOC) standards, however, do not prohibit employers from making the disclosures required by OSHA’s medical access standard. For further information on ADA standards regarding employee medical records, contact the EEOC at

U.S. Department of Labor
Occupational Safety and Health Administration
OSHA 3110