OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

Subject: 29 CFR 1913.10, Rules of Agency Practice and Procedure Concerning OSHA Access to Employee Medical Records--Procedures Governing Enforcement Activities

A. Purpose. This instruction provides guidance for implementing the rules of agency practice and procedure concerning OSHA access to employee medical records, published in the Federal Register May 23, 1980, and effective August 21, 1980.

B. Scope. This instruction applies OSHA-wide.

C. Action. OSHA Regional Administrators, Area Directors and National Office Directors shall ensure that the practices and procedures outlined in this instruction are used in conjunction with 29 CFR 1913.10 to regulate the manner in which OSHA seeks access to and uses employee medical and exposure records.

D. Federal Program Change. This instruction describes a Federal program change which affects State programs. Each Regional Administrator shall:

1. Ensure that this change is forwarded to each State designee. (Pursuant to OSHA Instruction STP 2-1.99, August 15, 1980, designees were to be notified of the requirement that they adopt a standard as effective as 29 CFR 1913.10).

2. Explain the technical content of the change to the State designee as requested.

3. Ensure that State designees are asked to acknowledge receipt of this Federal program change in writing, within 30 days of notification, to the Regional Administrator. This acknowledgment should include a description either of the State's plan to implement the change or of the reasons why the change should not apply to that State.

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

4. Review policies, instructions and guidelines issued by the State to determine that this change has been communicated to State program personnel. Routine monitoring activities (accompanied inspections and case file reviews) shall also be used to determine if this change has been implemented in actual performance.

E. Authorization to Review Medical Records. Before obtaining access to personally identifiable employee medical information, it must be determined by the OSHA Supervisory Industrial Hygienist that there is an identifiable and supportable need to gain access for OSHA enforcement purposes.

1. OSHA compliance personnel are permitted access to employee medical information for the limited purpose of verifying employer compliance with recordkeeping requirements; i.e., in order to determine that the medical information exists. (See 29 CFR 1910.20 (e)(3) and 29 CFR 1913.10(b)(4).) In doing so:

a. OSHA compliance personnel should verify employer compliance with medical recordkeeping requirements by interviewing employer and employee representatives, employees, and, where appropriate, physicians.

b. In addition, compliance officers may want to verify compliance by seeing the records. Where medical records are used to verify compliance:

(1) Documentation of noncompliance will comprise only the employee's name and the violation, not the specific medical information.

(2) Documentation of compliance will consist of a statement attesting to a check of some of the records and compliance with the specific recordkeeping requirements.

(3) No analysis is to be made of the medical content of the file. If copying or reviewing the records is necessary, the Area Director must follow the procedures set forth in

2

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

29 CFR 1913.10 (e.g., appoint a Principal OSHA Investigator and obtain an access order where applicable).

2. OSHA compliance personnel also are permitted access (for compliance purposes) to biological monitoring results which directly assess the absorption of a substance or agent by body systems. These results are treated by 29 CFR 1910.20(c)(5)(ii) as exposure records. Examples are:

a. Blood lead levels.

b. Urine Mercury.

c. Urine phenols.

d. Urine monoacetylbenzidine.

e. Exhaled carbon monoxide.

f. Hair assays.

g. Fingernail assays.

h. Carboxyhemoglobin.

3. Authorization procedures for access to biological monitoring results that involve the evaluation or the physiological status of a body system are described in OSHA Instruction CPL 2-2.32.

4. Authorization procedures for access to medical opinions mandated by existing standards are described in OSHA Instruction CPL 2-2.30.

5. Access to medical information other than that specified in F. 1. through 4. of this instruction will require a written access order (29 CFR 1913.10) unless:

a. Specific written consent of an employee is obtained pursuant to 29 CFR 1910.20(e)(2)(ii), and the agency or an agency employee is listed on the authorization as the designated representative to receive the medical information.

3

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

b. An OSHA staff or contract physician consults with an employer's physician pursuant to 29 CFR 1913.10 (d)(4)(ii).

c. OSHA access to, or the use of, personally identifiable employee medical information is obtained in the course of litigation.

NOTE: Even in circumstances where management voluntarily will release employee medical records to OSHA, a written access order is necessary unless the situation falls into one of the categories described in E.5.a.-c.

F. Procedures for OSHA Access to Medical Records.

1. Employee Written Consent.

a. Compliance officers may seek employee written consent for the release of medical record information, but only after the following steps are taken:

(1) Determine that there is an identifiable and supportable need to gain access to the medical records for OSHA enforcement purposes.

(2) Specify what laboratory tests, examination results or other specific medical record will be looked at for each employee, based upon known or suspected occupational exposures and the known or suspected toxicity for such exposures.

(3) Have available the range of normal values for each laboratory test to be examined (based on actual laboratory normal values or accepted normal values from a standard text.)

(4) Prepare an authorization letter which contains all of the information outlined in 29 CFR 1910.20(c)(10)(i) to be used when obtaining an employee's written consent.

4

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

(5) Obtain the approval of the Supervisory Industrial Hygienist.

(6) Explain to each affected employee

(a) OSHA's need for access to his or her medical record;

(b) OSHA's administrative procedures for assuring that the records are kept confidential;

(c) The employee's right to refuse OSHA's request for written consent; and

(d) That no action will be taken against the employee if he or she does refuse to give written consent.

b. The Supervisory Industrial Hygienist shall:

(1) Determine whether there is an identifiable and supportable need to gain access to the medical records for OSHA enforcement purposes.

(2) Ensure that an authorization letter which contains all of the information outlined in 29 CFR 1910.20(c)(10)(i) is used when obtaining an employee's written release. (See Appendix A to 1910.20.)

c. Whenever medical information is obtained pursuant to employee written consent, the Area Director shall:

(1) Promptly name a Principal OSHA Investigator to ensure protection of this information.

(2) Notify the Medical Records Officer (29 CFR 1913.10(c)(2)) of the Principal OSHA Investigator's identity.

(3) Ensure that the personally identifiable medical information obtained shall thereafter be subject to the use and security requirements of 29 CFR 1913.10(h)-(m).

5

OSHA Instructign CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

d. Whenever employees do not consent to OSHA access to their medical information, requests for a written access order shall include such objections. (See Appendix A, IV.2.e. of this instruction.)

2. Restriction of Off-site Review. Access to personally identifiable employee medical information, whether via employee consent or access order, shall be done on-site, if practicable. A minimum of such information (only that which may be needed to support a citation) shall be recorded for enforcement purposes and/or taken off-site.

3. Restriction of Nonspecific Review. Compliance officers are not authorized to examine records for the purpose of identifying trends of illnesses which are not directly related to the recognized adverse effects of specific substances or agents. Thus, the compliance officer is not to do investigative research or conduct a wholesale investigation of medical records to identify possible problems.

4. Identifying Abnormalities. Compliance personnel shall use the normal ranges for the laboratory conducting the test, if available, or normal values established in accepted medical texts. When an abnormality is identified, the compliance officer shall investigate the abnormality through one or more of the following mechanisms:

a. Consult with the examining physician or health care personnel in charge of or who has access to the medical records. If, based on this consultation, the compliance officer determines that no further investigation is necessary, documentation shall be made in the files of:

(1) Whose records and which tests were examined.

(2) The rationale for examining those tests.

(3) All abnormalities found (without personally identifiable information). If it is impossible to ensure the confidentiality of abnormal laboratory results because of a limited number of workers' records, however,

6

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

then the abnormalities should not be listed. Note only that they were found and discussed with the medical personnel.

(4) The name(s) of the medical personnel with whom the compliance officer discussed the results.

NOTE: Personally identifiable information shall be removed from all field notes concerning these test results once a decision has been made that no further action is necessary.

b. If the procedure described in F. 4. a. was not followed, or it was followed but no satisfactory response was given, the Area Director shall contact the Regional Office, and the Regional Office in turn shall either obtain the services of a medical consultant or contact the National Office medical staff.

5. Notifying Employees of Abnormal Results. The compliance officer shall ensure that appropriate notification of all workers with detected abnormalities is given.

a. When abnormalities have been satisfactorily explained by the employer's physician, the compliance officer shall investigate whether the physician notified the employee of the results. If the physician has not, a citation may be appropriate.

b. When the services of a contract or National Office physician have been used, the compliance officer shall ensure that the physician notifies the employee of any abnormalities found.

6. Confidentiality. OSHA compliance officers have the responsibility to maintain the confidentiality of all medical information and records.

a. The compliance officer shall not discuss any of the information found in the records which is or could be identified with specific individuals, with any employer or employee representatives except the physician or health care personnel in

7

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

charge of or who has access to employee medical records. This restriction applies even in situations where such medical information may be known to those specific (or other) individuals.

b. However, the compliance officer may reveal the following information to an employee whose medical record has been looked at:

(1) The laboratory test examined;

(2) The rationale for examining that test;

(3) The normal ranges used and the sources of these ranges; and

(4) The numerical test result if known by the compliance officer.

NOTE:

1. Under no circumstances should the compliance officer attempt any further discussion with the employee of the meaning of the results, conclusions, interpretations, diagnoses, etc. These judgments can be made only in view of the total medical record and only by an examining physician. If the employee wants clarification, he/she shall be referred to a physician for any discussion of test results.

2. The compliance officer shall not examine the medical records solely to inform an employee of his/her results.

7. Access Denied. Whenever the employer refuses to honor an access order, or whenever OSHA is denied access to employee exposure and/or medical records without the need for a written access order: a. Obtain an administrative subpoena from the National Office through the Regional Office.

b. Where the employer refuses to honor the administrative subpoena, notify the Regional

8

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

Solicitor to obtain a court order for enforcement of the administrative subpoena.

c. Do not cite for violations of 29 CFR 1910.20 (e)(3)(i).

8. Citations.

a. If abnormalities have been detected which have not been adequately explained by the medical personnel, the Regional Office should consult with the National Office before using this information to support a citation. (See F.4.a., p. 6 of this instruction.)

b. Where proper employee notification of abnormalities has not occurred, the Regional Office should consult the National Office before using this information to support a citation or before citing a specific health standard requirement for informing employees of their medical conditions.

c. Documentation to support a citation shall include personally identifiable information. However, this information shall not be disclosed on the citation.

G. Principal OSHA Investigator.

1. The Principal OSHA investigator shall be:

a. An OSHA professional trained in medicine, public health, or allied fields (industrial hygiene, epidemiology, toxicology, biostatistics, environmental health, etc.).

b. Determined on a case-by-case basis, depending on the necessary professional qualifications.

2. Where an OSHA Industrial Hygienist (CSHO) is to serve as a Principal OSHA Investigator, these additional guidelines apply:

a. The CSHO shall generally be a field-qualified Industrial Hygienist, of at least grade GS-11.

9

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

b. Industrial hygiene trainees may not be Principal OSHA Investigators

c. In team inspections, the team leader shall normally be designated the Principal OSHA Investigator.

H. Responsibilities for Obtaining a Written Access Order.

1. Regional Office. The ARA for Technical Support

a. Review written access order requests for their adequacy and need.

b. Determine if there is a need to consult the Regional Solicitor on the matter.

c. Consult the OSHA Medical Records Officer (MRO), where necessary, for assistance (e.g., advice on the professional qualifications needed for the Principal OSHA Investigator, merits of supporting evidence justifying access, etc.).

d. Ensure that, where an access order has been determined to be necessary:

(1) Both the access order and an accompanying cover memorandum to the MRO are expeditiously prepared either at the Area Office or by the Regional Office.

(2) The original and two copies of both the access order and cover memorandum are immediately sent to the MRO.

e. Ensure that the Principal OSHA Investigator is notified of any instructions from the MRO.

f. Promptly notify the MRO by phone of significant written objections concerning access to records pursuant to a written access order, whenever there is a need for the MRO to be briefed on any unusual or important concerns.

10

OSHA-Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

2. Area Office.

a. The Area Director shall:

(1) Designate Principal OSHA Investigators.

(2) Ensure that the information for an access order is

expeditiously telephoned to the Regional Office.

(3) Forward access orders which are prepared at the Area Office to the Regional Office. The Regional Office will forward the access order to the MRO, as described at H.1. d. of this instruction. The MRO will send the access order directly to the Area Office and will provide a copy of the access order to the Regional Administrator.

(4) Sign the cover letter that accompanies the access order after receiving the order from the MRO.

(5) Ensure that Principal OSHA Investigators encourage anyone who objects orally to a written access order to make his objections in writing.

(6) Ensure that the Regional Office is promptly notified by phone of the receipt of written objections concerning access to records pursuant to a written access order. In addition, the Area Director shall ensure that such written objections are forwarded by mail to the MRO.

(7) Ensure that all requests for public or interagency transfer of personally identifiable employee medical information are forwarded to the MRO through the Regional Office. No personally identifiable medical records shall be transferred or disclosed without the approval of the Assistant Secretary.

(8) Establish and implement written standard operating procedures governing, as a minimum,

11

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

the following procedures for protecting all employee medical information:

(a) Removal of direct personal identifiers (29 CFR 1913.10(g)).

(b) Security procedures (29 CFR 1913.10(i)).

(c) Retention and destruction of records (29 CFR

1913.10(j)).

(d) Results of Agency analysis using personally identifiable employee medical information (29 CFR 1913.10(k)).

(9) Ensure the security of the key(s) or combination for the locked cabinet(s) holding the personally identifiable medical records.

b. The Area Office Supervisory Industrial Hygienist shall:

(1) Ensure that the necessary information is gathered to support the need for access to the medical records.

(2) Advise the Area Director on the need for a written access order.

(3) Advise the Area Director on the selection of a Principal OSHA Investigator.

c. The Principal OSHA Investigator shall ensure that the examination and use of all personally identifiable employee medical information is performed in the manner prescribed by:

(1) The written access order.

(2) The requirements of 29 CFR 1913.10(d)-(m).

(3) Any written standard operating procedures for protecting the employee medical information.

12

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

I. Request for a Written Access Order.

1. Written access order requests shall include:

a. A cover memorandum from the Regional Administrator to the MRO, bringing the request to his/her attention.

b. A written access order prepared in accordance with procedures described in 29 CFR 1913.10 (d)(3) and Appendix A of this instruction, for the signature of the Assistant Secretary.

2. Use Appendix A of this instruction as a model for the format and content of the request for a written access order.

J. Presentation of Written Access Order. 29 CFR 1913.10(e) describes the mechanics of presenting a written access order to the employer and notifying employees of its existence. Use Appendix B of this instruction as a model for the format and content of the required accompanying cover letter.

K. Previously Obtained Records. Regional Offices and Area Offices shall ensure that all known files on hand containing personally identifiable employee medical information obtained prior to August 21, 1980, shall be:

1. Transferred to the OSHA MRO if the information is not being used actively, but may be needed for future use (as defined by the MRO). Medical records shall not be sent to the MRO without his or her approval.

2. After notifying the MRO, destroyed or returned to the original medical care record holder if no longer needed for the purposes for which it was obtained.

3. Made devoid of direct personal identifiers, coded, kept secured, and used according to 29 CFR 1913.10 if the information is actively being used.

L. Emergency Situations. Any situations in which it appears, in the judgment of the Area Director, that the content of employee medical records could

13

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

precipitate the initiation of emergency procedures (e.g., imminent danger situations) shall be handled in accordance with the following procedures:

1. Field Operations Manual, Chapter IX.

2. A request for a written access order shall be expeditiously accomplished. All initial communications between the Area Office and the Regional Office, and between the Regional Office and the MRO, shall be conducted over the telephone and documented in the case file. If appropriate, the written access order can be drafted in the National Office.

Thorne G. Auchter Assistant Secretary

DISTRIBUTION: National, Regional, and Area Offices All Compliance Officers State Designees NIOSH Regional Program Directors

14

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

APPENDIX A

Request for a Written Access Order

I. Cover Memorandum. A brief cover memorandum shall be written from the Regional Administrator to the MRO bringing the request to his/her attention. The cover memorandum and accompanying enclosures shall be marked "confidential."

II. Sample Written Access Order. The access order shall be completed by inserting the applicable information described in III. 1. through 8. of this appendix, pages A-3 through A-6.

To (employer):

Pursuant to the Occupational Safety and Health Act of 1970 (see 29 CFR 1910.20(e)(3)) you are hereby required to make certain employee medical records available for examination and copying by authorized Occupational Safety and Health Administration (OSHA) officials. You must provide access to the medical information listed below on all employees listed in Attachment A of this Access Order.

You are hereby required to make available 1

The Assistant Secretary for Occupational Safety and Health has determined that it is necessary for Agency personnel to examine this employee medical information to ensure safe and healthful working conditions for employees at the (name of company). The statutory purpose for seeking Agency access to this information is to determine 2

The Assistant Secretary has also determined that it is necessary to examine this medical information in a personally identifiable form because the Agency has reason to believe that the specific employees covered by this order are those employees most likely to be experiencing occupational health problems from workplace exposure to (name toxic substance or harmful physical agent).

Supporting further our need to examine this information, 3

A-1

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

If a review of the medical information covered by this order indicates that occupational health problems are occurring, OSHA will closely investigate the possible causes of these problems. Personally identifiable information is thus necessary both to specify whose records are to be examined, and to enable a complete investigation of all relevant information in the medical records. In addition, the investigation will also involve evaluating information from employee interviews or other sources.

Agency access to the personally identifiable medical information covered by this order shall be provided in the following manner:

4.

The following OSHA official has been designated as the Principal OSHA Investigator:

5.

The following individuals have been authorized by the Assistant Secretary to review this medical information based on their professional qualifications:

6.

The Agency has promulgated detailed rules of Agency practice and procedure governing OSHA's conduct, which are designed to protect employee privacy interests. A key person in the overall administration of these rules (29 CFR 1913.10) is the OSHA Medical Records Officer:

7.

(Name MRO) will have personal responsibility for ensuring that all medical records are protected under the guidelines outlined above, as mandated in 29 CFR 1913.10.

Written objections, questions or comments concerning OSHA access to employee medical records should be forwarded to this official.

(name) Assistant Secretary Occupational Safety and Health

A-2

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

(name) OSHA Medical Records Officer

Attachment A

( 8. )

III. Access Order Information.

1. Generally describe the kind of medical information that will be examined. For example:

You are hereby required to make available any and all medical records in connection with employee exposure to lead, for those employees identified, including records in connection with the following items:

a. Work and medical histories, with particular attention to the following:

(1) History of exposure to lead, both occupational and nonoccupational, including, where available, air monitoring data and history of job descriptions for each worker.

(2) Past medical history including history of hospitalizations and medications.

(3) All information on current or previous symptoms and/or complaints (including the review of systems and the absence of symptoms or complaints) with respect to the gastrointestinal, hematological, renal, cardiovascular, reproductive and/or neurological systems.

(4) Personal habits (smoking, hygiene).

b. Results of physical examinations, including results pertaining to blood pressure measurements, teeth, gums, the hematological, gastrointestinal, renal, cardiovascular and neurological systems and all negative findings with respect to the aforementioned systems.

A-3

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

c. All laboratory values relating to the above systems, including but not limited to:

(1) Blood lead levels.

(2) Hemoglobin and hematocrit determinations, red cell indices and examinations of peripheral smear morphology.

(3) Blood urea nitrogen.

(4) Serum creatinine.

(5) Urinalyses, including microscopic examinations.

(6) All pulmonary function tests.

(7) ZPP levels.

(8) Any laboratory and/or other tests which an examining physician has deemed necessary.

d. Any and all physician recommendations and/or diagnoses with respect to the aforementioned work and medical histories, physical examinations and/or laboratory values.

2. Describe the purpose for seeking access to this medical information. For example:

"The statutory purpose for seeking Agency access to this information is to determine employer compliance with the medical surveillance and medical removal protection program (and associated recordkeeping requirements) specified in paragraphs (j), (k) and (n) of OSHA's lead standard, 29 CFR 1910.1025."

3. Summarize any additional supporting evidence such as the information outlined in IV. Attachments, paragraph 2., page A-6, of this appendix. For example:

"Supporting further our need to examine this information, we have in our custody several letters sent by the employer to employees indicating elevated

A-4

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

blood lead levels. In addition, we also have an article printed in the (name of newspaper or magazine, etc.) in which the company acknowledged the problem of its employees being overexposed to lead.

"The company has been cited for overexposure to lead in 1974, 1976, and 1977. Engineering controls and/or administrative controls were required to control the overexposures. Respirators were required as an interim measure. Overexposures were also found in the most recent inspection conducted in November and December of 1980.

"Prolonged absorption of lead could result in severe gastrointestinal disturbances and anemia. With more serious intoxication there is neuromuscular dysfunction while extremely severe lead exposures may result in encephalopathy."

4. Give a step-by-step chronology of how the records will be obtained, copied, reviewed, and stored, specifying the following:

a. Who will be in charge of on-site review of the records, or who will take possession of the records for off-site review.

b. Where OSHA will review the records.

c. When OSHA review or receipt of the records is to take place. (If practicable, consistent with the nature of the investigation, allow the employer a reasonable period of time prior to OSHA access in order to locate, comply and provide the required records.)

d. Whether or not the medical information will be examined on-site and what type of information will be copied and removed off-site. (For example, at the time and place access is provided OSHA shall review the medical information on-site. The only records which will be copied and taken off-site are those records which, after initial review, indicate the possibility of occupational health problems.)

A-5

OSHA Instuction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

e. How personal identifiers will be segregated from the medical information and how long this information will be kept. (For example, to the extent personally identifiable employee medical information is taken off-site, personal identifiers will be promptly stripped from the medical information, uniquely coded and maintained separately from the medical information. All personally identifiable medical information will be destroyed at the completion of any enforcement action arising from this investigation.)

5. Name the Principal OSHA Investigator and give his or her business address and telephone number

6 Give full names and titles of these individuals. The persons listed will have the authority to permit limited access to Agency employees (Area Director, clericals, and other professionals) who have a limited need for access; thus, such people generally do not have to be listed on the access order.

7. Give the Medical Records Officer's full name, business address and telephone number.

8. On Attachment A to the written access order, identify the persons whose records are being sought, either by name, job classification, time clock number, department, or similar identifier.

IV. Attachments. The following information shall be included, as applicable, in the request for a written access order:

1. A brief statement of the professional qualifications of the designated Principal OSHA Investigator which make him/her qualified to review the records. This is not necessary when this person is delegated by the National Office.

2. A summary of the applicable information gathered during the inspection or preinspection which was considered when determining the need for a written access order. For example, information obtained from:

A-6

OSHA Instruction CPL 2-2.33 FEB 8, 1982 Office of Compliance Programming

a. Interviews with the employer, employee representatives or physicians.

b. Examination of exposure data, biological monitoring data or medical information obtained without the need for a written access order, or information obtained from a previous access order.

c. Evaluation of engineering controls and work practices, respirator program, personal protective equipment, training program, and medical surveillance program.

d. Articles from newspapers, magazines, etc.

e. Any objections concerning OSHA access to employee medical information.

3. Any additional information requested by the MRO.

OSHA Instruction CPL 2-2.33 FEB 8 1982 Office of Compliance Programming

Appendix B

Sample Cover Letter

Dear (employer):

On (date of access order) the Assistant Secretary of Labor for Occupational Safety and Health approved a formal written access order requiring that you make certain portions of specific employee medical records available for inspection and copying by OSHA officials. A copy of this letter must be posted along with the written access order, except that Attachment A, which lists the names of employees whose records are requested, shall not be posted.

The Occupational Safety and Health Act of 1970 authorizes OSHA access to employee medical records in certain circumstances, such as those applicable here, (See 29 CFR 1910.20 (e)(3).) The Agency recognizes, however, that there are often substantial personal privacy interests involved with employee medical records. Thus, the Agency has promulgated strict administrative regulations (set forth at 29 CFR 1913.10) that govern OSHA's access to personally identifiable employee medical records. Thus, the Agency has promulgated strict administrative regulations, and protect legitimate privacy interests. These regulations govern when and how OSHA will seek access to medical records, who can use this information and for what purposes, and how OSHA will safeguard these records once they are in the Agency's possession.

The written access order which accompanies this letter is the result of careful Agency considereation of these matters as they apply to your worksite. The written access order states what is being requested and why; who is authorized to review and analyze the information obtained; and other matters that inform you of OSHA'S actions regarding access to these medical records.

If you, or you employees or their representatives have questions or objections concerning the written access order, you should feel free to contact the Principal OSHA Investigator or the OSHA Medical Records Officer, whose names, addresses and telephone numbers are listed on the

B-1

OSHA Instruction CPL 2-2.33 FEB 8 1982 Office of Compliance Programming

written access order. Employee representatives include the following:

(List employee representatives.)

A copy of this letter and the written access order (excluding Attachment A) has been sent to the employee representatives listed above.

Your cooperation will be appreciated. OSHA access to personally identifiable medical information will be limited to only that which is necessary to carry out this investigation. The goal of the investigation is to assure safe and healthful working working conditions for employees of your establishment. All medical information will be protected under the provisions of the OSHA Medical Records Access Ruling.

Sincerely,

Area Director

Enclosure

B-2

---