The OSHA rules provide that employees, their designated representatives, and
OSHA will have access to covered employee medical records. Access means the
right to examine and copy the records. If the employee is dead or legally
incapacitated, the employee’s legal representative may exercise all the
employee’s rights under the rules. A designated representative is any individual
or organization to whom the employee gives written authorization for access to
his or her medical records. A recognized or certified collective bargaining agent
is automatically treated as a designated representative without requiring
written employee authorization for access to some regulated records. This
implied authorization does not extend to employee medical records.
A designated representative must have the employee’s specific written consent
to have access to the employee’s medical records. This written authorization
must include the following:
The name and signature of the employee authorizing the release of
medical information
The date of the written authorization
The name of the individual or organization that is authorized to release
the medical information
The name of the designated representative (individual or organization)
that is authorized to receive the released information
A general description of the medical information that is authorized to be
released
A general description of the purpose for the release of the medical
information
A date or condition upon which the written authorization will expire (if
less than one year)
A written authorization (Exhibit 15–1) does not authorize the release of medical
information not in existence on the date of the written authorization, unless
the release of future information is expressly authorized. A written
authorization is not valid for more than one year from the date on the
authorization. A written authorization may be revoked in writing at any time.
Although OSHA has the right to have access to employee medical information
without the employee’s written permission, the employer must notify its
employees when OSHA seeks access to their medical records:
Each employer shall, upon request, and without derogation of any rights
under the Constitution or the Occupational Safety and Health Act of
1970, 29 U.S.C. 651 et seq., that the employer chooses to exercise,
assure the prompt access of representatives of the Assistant Secretary
of Labor for Occupational Safety and Health to employee exposure and
medical records and to analyses using exposure or medical records.…
Whenever OSHA seeks access to personally identifiable employee
medical information … the employer shall prominently post a copy of
the written access order and its accompanying cover letter for at least
fifteen (15) working days.
