Authorization To Release Covered Records
The OSHA rules provide that employees, their designated representatives, and OSHA will have access to covered employee medical records. Access means the right to examine and copy the records. If the employee is dead or legally incapacitated, the employee’s legal representative may exercise all the employee’s rights under the rules. A designated representative is any individual or organization to whom the employee gives written authorization for access to his or her medical records. A recognized or certified collective bargaining agent is automatically treated as a designated representative without requiring written employee authorization for access to some regulated records. This implied authorization does not extend to employee medical records.
A designated representative must have the employee’s specific written consent to have access to the employee’s medical records. This written authorization must include the following:
The name and signature of the employee authorizing the release of medical information
The date of the written authorization
The name of the individual or organization that is authorized to release the medical information
The name of the designated representative (individual or organization) that is authorized to receive the released information
A general description of the medical information that is authorized to be released
A general description of the purpose for the release of the medical information
A date or condition upon which the written authorization will expire (if less than one year)
A written authorization (Exhibit 15–1) does not authorize the release of medical information not in existence on the date of the written authorization, unless the release of future information is expressly authorized. A written authorization is not valid for more than one year from the date on the authorization. A written authorization may be revoked in writing at any time.
Although OSHA has the right to have access to employee medical information without the employee’s written permission, the employer must notify its employees when OSHA seeks access to their medical records:
Each employer shall, upon request, and without derogation of any rights under the Constitution or the Occupational Safety and Health Act of 1970, 29 U.S.C. 651 et seq., that the employer chooses to exercise, assure the prompt access of representatives of the Assistant Secretary of Labor for Occupational Safety and Health to employee exposure and medical records and to analyses using exposure or medical records.… Whenever OSHA seeks access to personally identifiable employee medical information … the employer shall prominently post a copy of the written access order and its accompanying cover letter for at least fifteen (15) working days.