OSHA Instruction CPL 2-2.46 January 5, 1989 Office of Health Compliance Assistance

Subject: 29 CFR 1913.10(b)(6), Authorization and Procedures for Reviewing Specific Medical Records to Verify Compliance with 29 CFR 1904

A. Purpose. This instruction authorizes appropriately qualified OSHA personnel to conduct reviews of the medical records specified at I of this instruction where there is a need to gain access to verify compliance with 29 CFR 1904 recordkeeping requirements

B Scope. This instruction applies OSHA-wide.

C. References

1. OSHA Instruction CPL 2.45A, April 18, 1983, Field Operations Manual (FOM).

2. OSHA Instruction CPL 2-2.30, November 14, 1980.

3. OSHA Instruction CPL 2-2.32, January 19, 1981.

4. OSHA Instruction CPL 2-2.33, February 8, 1982.

D. Action. OSHA Regional Administrators and Area Directors shall ensure that the authorization described at I to review specific medical information is administered and implemented according to this instruction.

E. Federal Program Change. This instruction describes a Federal program change which affects State programs. Each Regional administrator shall:

1. Ensure that this change is forwarded to each State designee.

2. Explain the technical content of the change to the State designee as requested

3. Advise the State designee that this instruction clarifies the authority, under 29 CFR 1913.10(b)(3), and procedures for obtaining access, without a written access order or written employees consent, to the OSHA-200, OSHA-101 or equivalent, and any backup information, as

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

described in paragraph F.4 of this instruction, to determine compliance with 29 CFR Part 1904. The States arc required to provide for equivalent authorization and procedures in order to remain at least as effective as the Federal OSHA program,

NOTE: OSHA Instruction STP 2-1.99A, May 17, 1982, required the States to adopt as effective regulations comparable to 29 CFR 1913.10, Rule of Agency Practice and Procedure concerning OSHA Access to Employee Medical Records. OSHA Instruction CPL 2-2.30, November 14, 1980, and OSHA Instruction CPL 2-2.32, January 19, 1981, instructed the States on the adoption of similar authorization and procedures for review of employee medical information mandated by specific Occupational health standards, as noted in F.1. of this instruction. Further, Chapter III, sections on injury and illness records and verification of records, of the FOM establishes the requirement to examine all applicable employer injury and illness records during every inspection to verify compliance with 29 CFR Part 1904.

4. Ensure that State designees are asked to acknowledge receipt of this Federal change in writing, within 30 days of notification, to the Regional Administrator This acknowledgment should include: (a) the State's plan to adopt identical enforcement procedures by following those in this instruction; (b) the State's plan to develop alternative enforcement procedures for authorizing appropriately qualified personnel to conduct reviews of specific medical records to verify compliance with recordkeeping requirements; or (c) an explanation of the reason why no change is necessary in the State's procedures. If a State implements option (a) or (b), it must submit a plan supplement within 6 months.

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

a. If the State intends to adopt OSHA's enforcement procedures, the State must submit either a revised version of this instruction or a cover sheet describing how references in this instruction correspond to the State's structure The State's acknowledgment letters may fulfill the plan supplement requirement if the appropriate documentation is provided

b. If the State adopts an alternative to Federal enforcement procedures, the State's supplement must identify and provide a rationale for all substantial differences from Federal procedure in order for OSHA to judge whether a different State procedure is as effective as the comparable Federal procedure.

5. After Regional review of the State's plan supplement and resolution of any comments thereon, forward the State submission to the National Office in accordance with established procedures. The Regional Administrator shall provide a judgment of the relative effectiveness of each substantial difference thereon with a recommendation for approval or disapproval by the Assistant Secretary.

6. Review policies, instructions, and guidelines issued by the State to determine that this change has been communicated to State personnel and to ensure documentation of adherence to the State's procedures.

F. Background

1. Through the FOM, OSHA emphasized the necessity of examining all applicable employer injury and illness records during every inspection to verify compliance with the recordkeeping requirements of 29 CFR 1904. These records, which are often in the form of employee medical records, must be compared with the OSHA-200 log entries to investigate potential underreporting.

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

      2.  "Employee medical record" is defined at 29 CFR 1910.20(c)(6)(1)
           as a record concerning the health status of an employee which is
           made or maintained by a physician, nurse, or other health care
           personnel, or technician, including:

a. Medical and employment questionnaires or histories (including job description and Occupational exposures),

b. The results of medical examinations (pre-employment, preassignment, periodic, or episodic) and laboratory tests (including X-ray examinations and all biological monitoring),

c. Medical opinions, diagnoses, progress notes and recommendations,

d. First-aid records.

e. Descriptions of treatments and prescriptions, and

f. Employee medical complaints. 3. 29 CFR 1913.10 specifies the rules governing OSHA access to personally identifiable employee medical information contained in medical records. OSHA excluded from coverage by these rules, however, certain records that are of such occupational safety and health importance and that are so frequently used by various agency personnel that rigid approval and security procedures would be both impractical and inappropriate.

4. 29 CFR 1913.10(b) (3) states that ".... This section does not apply to records required by 29 CFR 1904......" The agency interprets this to mean that OSHA does not need an access order or written employee consent to obtain access to the following employer-maintained records:

a. OSHA-200.

b. OSHA-101 or equivalent.

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

c. Any backup information (e.g., first-aid logs, first report of injury) no more detailed than the type of information contained in the OSHA-101.

5. Certain backup medical records (e.g., some first reports of injury) that may be necessary to verify, compliance with 29 CFR 1904 Recordkeeping requirements contain information more detailed than that required by the OSHA-101, such as written medical opinions, progress notes, prescriptions, and recommendations.

6. 29 CFR 1913.10(b)(6) excluded from the rules governing OSHA records access situations "where a written directive by the Assistant Secretary authorizes appropriately qualified personnel to conduct limited reviews of specific medical information mandated by an occupational safety and health standard, or of specific biological monitoring test results." Therefore, this instruction, pursuant to that provision, establishes procedures allowing direct OSHA access to additional types of medical records when necessary for the sole purpose of verifying compliance with 29 CFR 1904.

G. Statutory Purpose and Need to Gain Access. The purpose of obtaining access to the medical information specified I.2. is to ensure safe and healthful working conditions for working men and Women by providing an effective enforcement program for OSHA standards and the Occupational Safety and Health Act.

1. To accomplish this purpose it may be necessary for agency personnel to examine the employee medical, information specified at 1.2. to determine compliance with the recordkeeping requirements of 29 CFR Part 1904, Regulations and Procedures on Recording and Reporting Occupational Injuries and Illnesses.

2. It may further be necessary for appropriately qualified agency personnel to examine this medical information in a personally identifiable form to enable the agency to determine if all workplace injuries involving more than first-aid

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

treatment are properly recorded on the OSHA Forms 200 and 101, or equivalents

3. If a review of the medical information indicates that injuries and/or illnesses are occurring that are not being recorded, OSHA will investigate closely to determine the propriety of the employer's decision not to record them Personally identifiable information is, therefore, necessary to specify which records are to be examined and enable a complete investigation of all relevant information.

H. Qualified OSHA Personnel. Review of the medical information described at 1.2. shall be limited to:

1. Experienced safety or health compliance officers of journeyman grades who are well versed in the OSHA/Bureau of Labor Statistics recordability guidelines for the OSHA-200, or

2. Professionals with specific training or experience in reviewing the types of medical information necessary to verify compliance with 29 CFR 1904 recordkeeping requirements, if approved by the Area Director.

I. Authorized Medical Information.

1. This instruction authorizes qualified OSHA personnel to examine the content of and, if appropriate, copy employee medical records that:

a. Are necessary to verify compliance with 29 CFR 1904 recordkeeping requirements, and

b. Contain more detailed information than that found in records specifically accessible to OSHA pursuant to 29 CFR 1904 (e.g., the OSHA-101).

2. The types of medical information so authorized to be accessible, if not already accessible under F.4., are:

a. Daily reports of new injury or illness cases.

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

b. State workers' Compensation forms (independent of OSHA-200 and -101

c. First-aid records.

d. Nurse/Physician/clinic logs.

e. Company accident reports; insurers' accident reports

f. Sanitized medical records available to employer Officials Outside the medical office.

3. This authorization is contingent upon adherence to the guidelines described at J below of this instruction.

4. The information revealed through review of the records authorized in this instruction can then be used to document or support violations other than 29 CFR 1904

5. This instruction is not intended to limit OSHA access to information authorized elsewhere by regulation or directive.

a. Authorization Procedures for access to biological monitoring results that involve the evaluation or Physiological status of a body system are described in OSHA Instruction CPL 2-2.32.

b. Authorization procedures for access to medical opinions mandated by existing standards are described in OSHA Instruction CPL 2-2.30

c. Biological monitoring results which directly assess the absorption of a substance or agent by body systems are exposure records not medical records. (See 29 CFR 1910.20(c) (5) (ii) and OSHA Instruction CPL 2-2.33, Paragraph E.2.)

6. Access to information other than that specified in I.2. and (4 above, will require a written

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

access order following the Procedures in 29 CFR 1913.10 and OSHA Instruction CPL 2-2.33 unless:

a. Specific written consent of an employee is obtained pursuant to 29 CFR 1910.20(e)(2) (ii) (b) and the agency or an agency employee is listed on the authorization as the designated representative to receive the medical information.

b. An OSHA staff or contract physician consults with an employer's physician Pursuant to 29 CFR 1913.10(d) (4)(ii)

c. OSHA access to, or the use of, personally identifiable employee medical information is obtained in the course of litigation,

J. Guidelines for Screening Authorized Medical Information. Access to the medical information described at I. (hereinafter referred to as "authorized backup records") shall be restricted to situations where qualified OSHA Personnel have determined that a review of such records is necessary to verify compliance with 29 CFR 1904 recordkeeping requirements, Moreover, where such review has been deemed necessary, it shall be confined to only that extent needed to assess 29 CFR 1904 compliance.

1. Limit Removal of Records. Access to authorized backup records shall, if Practicable, involve onsite review. If Possible, remove direct personal identifiers from the medical information onsite and code the medical information and the list of direct identifiers with a unique identifying number for each employee. (See 29 CFR 1910.20(g) and OSHA Instruction CPL 2-2.33) A minimum of Personally identifiable information shall be recorded for enforcement purposes and taken offsite.

2. Limit Review of More Sensitive Records. Records reviewed to assess 29 CFR 1904 compliance shall be screened in reverse order of sensitivity (the least sensitive first) to determine needs for further review, The order of review is normally thus:

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

a. OSHA 200; OSHA-101 or equivalent.

b. State workers' compensation forms (independent of OSHA-200 and -101).

c. First-aid records, first report of injury, nurse/doctor/clinic logs, company accident reports, and insurers' accident reports, whose information is no more detailed than that of the OSHA-101 or equivalent.

d. Any further backup sanitized medical information describing injuries and illnesses resulting from workplace accidents available to employer officials outside the medical office.

e. Supporting records specified in J.2.c. that also contain more detailed medical information, such as medical opinions, progress notes, prescriptions, and recommendations.

3. Limit Access to Employee Medical File. Personally identifiable employee medical information shall be requested in as specific terms as possible to avoid unnecessary reviews of complete employee medical files.

4. Limit Unnecessary Documentation of Authorized Backup Records, Documentation of 29 CFR 1904 noncompliance through authorized backup records shall normally be confined to:

a. Employed name.

b. Nature and location of record,

c. Nature of observed recordkeeping deficiency,

d. Evidentiary relationship of record to reserve recordkeeping deficiency.

NOTE: Personally identifiable information shall not be disclosed on the citation, Page nine

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

K. Security and Confidentiality. Where access to employee medical information is obtained pursuant to the authorization of this instruction, the Area Director or a qualified person designated by the Area Director shall be responsible for ensuring its security and confidentiality.

1. Agency Use. Employee medical information in Personally identifiable form obtained pursuant to this instruction shall be used and kept secured in accordance with 29 CFR 1913.10(h) (2)-(5) and OSHA Instruction CPL 2-233,

2. Retention of Identifiers. If clearance is obtained from the OSHA Medical Records Officer, direct Personal identifiers may be kept together with the authorized backup records to which access has been obtained pursuant to this instruction, as long as the instant investigation and/or subsequent litigation is ongoing. Upon completion of the instant investigation and/or subsequent litigation, the personal identifiers shall either be removed and retained separately, or all records shall be returned to their sources or destroyed consistent with OSHA records disposition programs. (See 29 CFR 1910.10(g) and (j) and Records Disposition Schedule NC-100-82-1.)

3. Segregation Agency files containing Personally identifiable employee medical information obtained pursuant to this instruction shall be kept segregated from other agency files, When not in active use, files containing the information shall be kept secured in a locked cabinet or vault.

4. Security. The security procedures set forth at 29 CFR 1913.10(i)(3)-(5) shall be followed.

5. Interagency Transfer and Public Disclosure. Personally identifiable employee medical information obtained pursuant to this instruction shall not be transferred to another agency or office outside of OSHA (other than to the Office of the

OSHA INSTRUCTION CPL 2-2.46 JAN 5 1989 OFFICE OF HEALTH COMPLIANCE ASSISTANCE

Solicitor of Labor, or to the Bureau of Labor Statistics when necessary to determine compliance with 29 CFR 1904) or disclosed to the public except when required by law or approved by the Assistant Secretary.

L. Technical Assistance and Training. Technical assistance and/or training can be provided by the Bureau of Labor Statistics and the OSHA Medical Records Officer. It shall be sought, where determined necessary, through appropriate Area and Regional Offices'procedures.

M. When Access is Denied If access to medical records, as authorized by this instruction is denied, an administrative subpoena shall be issued, if determined appropriate by the Regional Administrator. In addition, the Director of Field Programs shall be consulted as to the appropriateness of also issuing a medical access order

John A. Pendergrass Assistant Secretary

DISTRIBUTION: National, Regional, and Area Offices

All Compliance Officers State Designees NIOSH Regional Program Directors