The following are selected excerpts from the preamble to the Occupational Injury and Illness Recording and Reporting Requirements, the Recordkeeping rule (66 FR 5916, 29 CFR Parts 1904 and 1952). These excerpts represent some of the key discussions related to the final rule (66 FR 6122, 29 CFR Parts 1904 and 1952).

Section[s] 1904.35 Employee Involvement...

One of the goals of the final rule is to enhance employee involvement in the recordkeeping process. OSHA believes that employee involvement is essential to the success of all aspects of an employer's safety and health program. This is especially true in the area of recordkeeping, because free and frank reporting by employees is the cornerstone of the system. If employees fail to report their injuries and illnesses, the "picture" of the workplace that the employer's OSHA forms 300 and 301 reveal will be inaccurate and misleading. This means, in turn, that employers and employees will not have the information they need to improve safety and health in the workplace.

Section 1904.35 of the final rule therefore establishes an affirmative requirement for employers to involve their employees and employee representatives in the recordkeeping process. The employer must inform each employee of how to report an injury or illness, and must provide limited access to the injury and illness records for employees and their representatives...

Under the employee involvement provisions of the final rule, employers are required to let employees know how and when to report work-related injuries and illnesses. This means that the employer must establish a procedure for the reporting of work-related injuries and illnesses and train its employees to use that procedure. The rule does not specify how the employer must accomplish these objectives. The size of the workforce, employees' language proficiency and literacy levels, the workplace culture, and other factors will determine what will be effective for any particular workplace.

... The prominent employee involvement issues in the rulemaking were thus not whether employee involvement should be strengthened but to what extent and in what ways employees should be brought into the process.

...OSHA has strengthened the final rule to promote better injury and illness information by increasing employees' knowledge of their employers' recordkeeping program and by removing barriers that may exist to the reporting of work-related injuries and illnesses. To achieve this goal, the final rule establishes a simple two-part process for each employer who is required to keep records, as follows:

OSHA agrees with commenters that employees must know and understand that they have an affirmative obligation to report injuries and illnesses. Additionally, OSHA believes that many employers already take these actions as a common sense approach to discovering workplace problems, and that the rule will thus, to a large extent, be codifying current industry practice, rather than breaking new ground.

OSHA is convinced that a performance requirement, rather than specific requirements, will achieve this objective effectively, while still giving employers the flexibility they need to tailor their programs to the needs of their workplaces. The Agency finds that employee awareness and participation in the recordkeeping process is best achieved by such provisions of the final rule as the requirement to extend the posting period for the OSHA 300 summary, the addition of accessibility statements on the OSHA Summary, and requirements designed to facilitate employee access to records...

Employee access to OSHA injury and illness records

The Part 1904 final rule continues OSHA's longstanding policy of allowing employees and their representatives access to the occupational injury and illness information kept by their employers, with some limitations. However, the final rule includes several changes to improve employees' access to the information, while at the same time implementing several measures to protect the privacy interests of injured and ill employees. Section 1904.35 requires an employer covered by the Part 1904 regulation to provide limited access to the OSHA recordkeeping forms to current and former employees, as well as to two types of employee representatives. The first is a personal representative of an employee or former employee, who is a person that the employee or former employee designates, in writing, as his or her personal representative, or is the legal representative of a deceased or legally incapacitated employee or former employee. The second is an authorized employee representative, which is defined as an authorized collective bargaining agent of one or more employees working at the employer's establishment.

Section 1904.35 accords employees and their representatives three separate access rights. First, it gives any employee, former employee, personal representative, or authorized employee representative the right to a copy of the current OSHA 300 Log, and to any stored OSHA 300 log(s), for any establishment in which the employee or former employee has worked. The employer must provide one free copy of the OSHA 300 Log(s) by the end of the next business day. The employee, former employee, personal representative or authorized employee representative is not entitled to see, or to obtain a copy of, the confidential list of names and case numbers for privacy cases. Second, any employee, former employee, or personal representative is entitled to one free copy of the OSHA 301 Incident Report describing an injury or illness to that employee by the end of the next business day. Finally, an authorized employee representative is entitled to copies of the right-hand portion of all OSHA 301 forms for the establishment(s) where the agent represents one or more employees under a collective bargaining agreement. The right-hand portion of the 301 form contains the heading ["Information about the case,"] and elicits information about how the injury occurred, including the employee's actions just prior to the incident, the materials and tools involved, and how the incident occurred, but does not contain the employee's name. No information other than that on the righthand portion of the form may be disclosed to an authorized employee representative. The employer must provide the authorized employee representative with one free copy of all the 301 forms for the establishment within 7 calendar days.

Employee privacy is protected in the final rule in paragraphs 1904.29(b)(7) to (10). Paragraph 1904.29(b)(7) requires the employer to enter the words "privacy case" on the OSHA 300 Log, in lieu of the employee's name, for recordable privacy concern cases involving the following types of injuries and illnesses: (i) an injury from a needle or sharp object contaminated by another person's blood or other potentially infectious material; (ii) an injury or illness to an intimate body part or to the reproductive system; (iii) an injury or illness resulting from a sexual assault; (iv) a mental illness; (v) an illness involving HIV, hepatitis; or tuberculosis, or (vi) any other illness, if the employee independently and voluntarily requests that his or her name not be entered on the log...

The employer may take additional action in privacy concern cases if warranted. Paragraph 1904.29(b)(9) allows the employer to use discretion in describing the nature of the injury or illness in a privacy concern case, if the employer has a reasonable basis to believe that the injured or ill employee may be identified from the records even though the employee's name has been removed. Only the six types of injuries and illnesses listed in Paragraph 1904.29(b)(7) may be considered privacy concern cases, and thus the additional protection offered by paragraph 1904.29(b)(9) applies only to such cases.

Paragraph 1904.29(b)(10) protects employee privacy if the employer decides voluntarily to disclose the OSHA 300 and 301 forms to persons other than those who have a mandatory right of access under the final rule. The paragraph requires the employer to remove or hide employees' names or other personally identifying information before disclosing the forms to persons other than government representatives, em-ployees, former employees or authorized representatives, as required by paragraphs 1904.40 and 1904.35, except in three cases. The employer may disclose the forms, complete with personally identifying information, [ ] only: (i) to an auditor or consultant hired by the employer to evaluate the safety and health program; (ii) to the extent necessary for processing a claim for workers' compensation or other insurance benefits; or (iii) to a public health authority or law enforcement agency for uses and disclosures for which consent, an authorization, or opportunity to agree or object is not required under section 164.512 of the final rule on Standards for Privacy of Individually Identifiable Health Information, 45 CFR 164.512...

Balancing the Interests of Privacy and Access

OSHA historically has recognized that the Log and Incident Report (Forms 300 and 301, respectively) may contain information of a sufficiently intimate and personal nature that a reasonable person would wish it to remain confidential. In its 1978 records access regulation (29 CFR 1910.1020), OSHA addressed the privacy implications of its decision to grant employee access to the Log. The agency noted that while Log entries are intended to be brief, they may contain medical information, including diagnoses of specific illnesses, and that disclosure to other employees, former employees or their representatives raised a sensitive privacy issue. 43 FR 31327 (1978). However, OSHA concluded that disclosure of the Log to current and former employees and their representatives benefits these employees generally by increasing their awareness and understanding of the health and safety hazards to which they are, or have been, exposed.

OSHA found that this knowledge "will help employees to protect themselves from future occurrences," and that "[i]n such cases, the right of privacy must be tempered by the obvious exigencies of informing employees about the effects of workplace hazards."...

OSHA continues to believe that granting employees a broad right of access to injury and illness records serves important public interests. There is persuasive evidence that access by employees and their representatives to the Log and the Incident Report serves as a useful check on the accuracy of the employer's recordkeeping and promotes greater employee involvement in prevention programs that contribute to safer, more healthful workplaces...

There exist at present no mechanisms to protect against unwarranted disclosure of private information contained in OSHA records. While Agency policy is that employees and their representatives with access to records should treat the information contained therein as confidential except as necessary to further the purposes of the Act, the Secretary lacks statutory authority to enforce such a policy against employees and representatives (e.g., 29 U.S.C. Sections 658, 659) (Act's enforcement mechanisms directed solely at employers)...

OSHA has concluded that the disclosure of occupational injury and illness records to employees and their representatives serves important public policy interests. These interests support a requirement for access by employees and their representatives to personally identifiable information for all but a limited number of cases recorded on the Log, and to all information on the righthand side of the Form 301. However, OSHA also concludes that prior Agency access policies may not have given adequate consideration to the harm which could result from disclosure of intimate medical information. In the absence of effective safeguards against unwarranted use or disclosure of private information in the injury and illness records, confidentiality must be preserved for particularly sensitive cases. These "privacy concern cases" listed in paragraph 1904.29 (b)(7) of the final rule involve diseases, such as AIDS and hepatitis, other illnesses if the employee voluntarily requests confidentiality, as well as certain types of injuries, the disclosure of which could be particularly damaging or embarrassing to the affected employee...

...[T]he final rule requires that the employer withhold the employee's name from the OSHA 300 Log for each "privacy concern case," and maintain a separate confidential list of employee names and case numbers. In all other respects, the final rule ensures full access to the OSHA Log by employees, former employees, personal representatives and authorized employee representatives.

Protections Against Broad Public Access

...OSHA agrees that confidentiality of injury and illness records should be maintained except for those persons with a legitimate need to know the information. This is a logical extension of the agency's position that a balancing test is appropriate in determining the scope of access to be granted employees and their representatives. Under this test, "the fact that protected information must be disclosed to a party who has need for it* * * does not strip the information of its protection against disclosure to those who have no similar need." Fraternal Order of Police, 812 F2d at 118.

OSHA has determined that employees, former employees and authorized employee representatives have a need for the information that justifies their access to records, including employee names, for all except privacy concern cases. While the possibility exists that employees and their representatives with access to the records could disclose the information to the general public, OSHA does not believe that this risk is sufficient to justify restrictions on the use of the records by persons granted access under sections 1904.40 and 1904.35. Strong policy and legal considerations militate against placing restrictions on employees' and employee representatives' use of the injury and illness information.

There is also a concern that employers may voluntarily grant access to OSHA records to persons outside their organization, who do not need the information for safety and health purposes. To protect employee confidentiality in these circumstances, paragraph 1904.29(b)(10) requires employers generally to remove or shield employee names and other personally identifying information when they disclose the OSHA forms to persons other than government representatives, employees, former employees or authorized employee representatives. Employers remain free to disclose unredacted records for purposes of evaluating a safety and health program or safety and health conditions at the workplace, processing a claim for workers' compensation or insurance benefits, or carrying out the public health or law enforcement functions described in section 164.512 of the final rule on Standards for Privacy of Individually Identifiable Health Information.

OSHA believes that this provision protects employee privacy to a reasonable degree consistent with the legitimate business needs of employers and sound public policy considerations...

Misuse of the Records by Employees and Their Representatives

...While there may be instances where employees share the data with third parties who normally would not be allowed to access the data directly, the final rule contains no enforceable restrictions on use by employees or their representatives. Employees and their representatives might reasonably fear that they could be found personally liable for violations of such restrictions. This would have a chilling effect on employees' willingness to use the records for safety and health purposes, since few employees would voluntarily risk such liability. Moreover, despite the concerns of commenters about abuse problems, OSHA has not noted any significant problems of this type in the past. This suggests that, if such problems exist, they are infrequent. In addition, as noted in the privacy discussion above, a prohibition on the use of the data by employees or their representatives is beyond the scope of OSHA's enforcement authority. For these reasons, the employer may not require an employee, former employee or designated employee representative to agree to limit the use of the records as a condition for viewing or obtaining copies of records.

OSHA has added a statement to the Log and Incident Report forms indicating that these records contain information related to employee health and must be used in a manner that protects the confidentiality of employees to the extent possible while the information is used for occupational safety and health purposes. This statement is intended to inform employees and their representatives of the potentially sensitive nature of the information in the OSHA records and to encourage them to maintain employee confidentiality if compatible with the safety and health uses of the information. Encouraging parties with access to the forms to keep the information confidential where possible is reasonable and should not discourage the use of the information for safety and health purposes. OSHA stresses, however, that the statement does not reflect a regulatory requirement limiting the use of records by those with access under sections 1904.35 and 1904.40.

The Records Access Requirement and the ADA

...Section 12112(d)(3)(B) of the ADA permits an employer to require a job applicant to submit to a medical examination after an offer of employment has been made but before commencement of employment duties, provided that medical information obtained from the examination is kept in a confidential medical file and not disclosed except as necessary to inform supervisors, first aid and safety personnel, and government officials investigating compliance with the ADA. Section 12112(d)(4)(C) requires that the same confidentiality protection be accorded health information obtained from a voluntary medical examination that is part of an employee health program.

By its terms, the ADA requires confidentiality for information obtained from medical examinations given to prospective employees, and from medical examinations given as part of a voluntary employee health program. The OSHA injury and illness records are not derived from pre-employment or voluntary health programs. The information in the OSHA injury and illness records is similar to that found in workers' compensation forms, and may be obtained by employers by the same process used to record needed information for workers' compensation and insurance purposes. The Equal Employment Opportunity Commission (EEOC) recognizes a partial exception to the ADA's strict confidentiality requirements for medical information regarding an employee's occupational injury or workers' compensation claim. See EEOC Enforcement Guidance: Workers' Compensation and the ADA, 5 (September 3, 1996). Therefore, it is not clear that the ADA applies to the OSHA injury and illness records.

Even assuming that the OSHA injury and illness records fall within the literal scope of the ADA's confidentiality provisions, it does not follow that a conflict arises. The ADA states that "nothing in this Act shall be construed to invalidate or limit the remedies, rights, and procedures of any Federal law. * * *" 29 U.S.C. 12201(b). In enacting the ADA, Congress was aware that other federal standards imposed requirements for testing an employee's health, and for disseminating information about an employee's medical condition or history, determined to be necessary to preserve the health and safety of employees and the public. See H.R. Rep. No. 101-485 pt. 2, 101st Cong., 2d Sess. 74-75 (1990), reprinted in 1990 U.S.C.C.A.N. 356, 357 (noting, e.g., medical surveillance requirements of standards promulgated under OSH Act and Federal Mine Safety and Health Act, and stating "[t]he Committee does not intend for [the ADA] to override any medical standard or requirement established by Federal * * * law * * * that is job-related and consistent with business necessity"). See also 29 CFR part 1630 App. p. 356. The ADA recognizes the primacy of federal safety and health regulations; therefore such regulations, including mandatory OSHA recordkeeping requirements, pose no conflict with the ADA. Cf. Albertsons, Inc. v. Kirkingburg, 527 U.S. 555, (1999) ("When Congress enacted the ADA, it recognized that federal safety and health rules would limit application of the ADA as a matter of law.")

The EEOC, the agency responsible for administering the ADA, has recognized both in the implementing regulations at 29 CFR part 1630, and in interpretive guidelines, that the ADA yields to the requirements of other federal safety and health standards. The implementing regulation codified at 29 CFR 1630.15(e) explicitly states that an employer's compliance with another federal law or regulation may be a defense to a charge of violating the ADA:

(e) Conflict with other Federal laws. It may be a defense to a charge of discrimination under this part that a challenged action is required or necessitated by another Federal law or regulation, or that another Federal law or regulation prohibits an action (including the provision of a particular reasonable accommodation) that would otherwise be required by this part.

Interpretive guidance provided by the EEOC further underscores this point. The 1992 Technical Assistance Manual on Title I of the ADA states as follows:

4.6 Health and Safety Requirements of Other Federal or State Laws

The ADA recognizes employers' obligations to comply with requirements of other laws that establish health and safety standards. However, the [ADA] gives greater weight to Federal than to state or local law.

1. Federal Laws and Regulations

The ADA does not override health and safety requirements established under other Federal laws. If a standard is required by another Federal law, an employer must comply with it and does not have to show that the standard is job related and consistent with business necessity (emphasis added).

U.S. Equal Employment Opportunity Commission, A Technical Assistance Manual on the Employment Provisions (Title I) of the Americans With Disabilities Act, IV-16 (1992) (Technical Assistance Manual). The Technical Assistance Manual also states that, while medical-related information about employees must generally be kept confidential, an exception applies where "[o]ther Federal laws and regulations * * * require disclosure of relevant medical information." Assistance Manual at VI-12. See also Assistance Manual at VI-14-15 (actions taken by employers to comply with requirements imposed under the OSH Act are job related and consistent with business necessity). For these reasons, OSHA does not believe that the mandatory employee access provisions of the final recordkeeping rule conflict with the provisions of the ADA.

Times Allowed To Provide Records

...Under the final rule, an employer must provide a copy of the 300 Log to an employee, former employee, personal representative or authorized employee representative on the business day following the day on which an oral or written request for records is received. Likewise, when an employee, former employee or personal representative asks for copies of the 301 form for an injury or illness to that employee, the employer must provide a copy by the end of the next business day. OSHA finds that these are appropriate time frames for supplying a copy of the existing forms, which in the case of the Form 301 is a single page. The average 300 Log is also only one page, although employers who have a larger number of occupational injuries and illnesses will have more than one page.

The final rule allows the employer seven business days to provide copies of the OSHA 301 forms for all occupational injuries and illnesses that occur at the establishment.

...[A]s stated in the final rule, the employer may not provide the authorized employee representative with the information on the left side of the 301 form, so the employer needs additional time to redact this information. Because the final rule only provides a right of access to an authorized employee representative (authorized collective bargaining agent), the number of requests should not exceed the number of unions representing employees at the establishment.

...[T]he employer must provide only one free copy. If additional copies are requested, the employer may charge for the copies.

Charging Employees for Copies of the OSHA Records

...In the final rule, OSHA has implemented the proposed provision requiring employers to provide copies free of charge to employees who ask for the records.

...OSHA agrees that there are some circumstances where employers should have the option of charging for records. After receiving an initial, free copy of requested records, an employee, former employee, or designated representative may be charged a reasonable search and copying fee for duplicate copies of the records. However, no fee may be charged for an update of a previously requested record.