[Federal Register Volume 85, Number 147 (Thursday, July 30, 2020)]
[Rules and Regulations]
[Pages 45780-45793]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-15562]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF LABOR
Occupational Safety and Health Administration
29 CFR Part 1913
[Docket No. OSHA-2020-0005]
RIN 1218-AC95
Rules of Agency Practice and Procedure Concerning Occupational
Safety and Health Administration Access to Employee Medical Records
AGENCY: Occupational Safety and Health Administration (OSHA); Labor.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: OSHA is issuing a final rule to amend the regulation
addressing the rules of agency practice and procedure concerning OSHA
access to employee medical records. The final rule transfers the
approval of written medical access orders (MAO) from the Assistant
Secretary for Occupational Safety and Health (Assistant Secretary) to
the OSHA Medical Records Officer (MRO) and makes the MRO responsible
for making determinations regarding inter-
[[Page 45781]]
agency transfer and public disclosure of personally identifiable
medical information in OSHA's possession.
DATES: This final rule is effective on July 30, 2020.
ADDRESSES: In accordance with 29 U.S.C. 2112(a)(2), OSHA designates,
Mr. Edmund C. Baird, Associate Solicitor of Labor for Occupational
Safety and Health, Office of the Solicitor, Room S-4004, U.S.
Department of Labor, 200 Constitution Avenue NW, Washington, DC 20210,
to receive petitions for review of the final rule.
FOR FURTHER INFORMATION CONTACT:
Press inquiries: Mr. Frank Meilinger, OSHA, Office of
Communications; telephone: (202) 693-1999; email:
[email protected].
General and technical information: Dr. Michael Hodgson, Director,
OSHA Office of Occupational Medicine and Nursing; telephone: (202) 693-
1768; email: [email protected].
SUPPLEMENTARY INFORMATION: The final rule also amends Sec. 1913.10 to
clarify that a written MAO does not constitute an administrative
subpoena, eliminates outdated requirements for the removal of direct
personal identifiers when OSHA personnel review medical information
away from a worksite, and establishes new procedures for the access and
safeguarding of personally identifiable employee medical information in
electronic form. The revisions to Sec. 1913.10 in the final rule will
increase employee privacy and enhance OSHA's ability to safeguard
personally identifiable medical information.
Table of Contents
I. Background
II. Legal Authority
III. Summary and Explanation of the Final Rule
IV. State Plans
V. Regulatory Flexibility Certification
VI. Environmental Impact Analysis
VII. Federalism
VIII. Unfunded Mandates
IX. Consultation and Coordination With Indian Tribal Governments
X. Office of Management and Budget Review Under the Paperwork
Reduction Act of 1995
I. Background
A. Introduction
In order to carry out its statutory obligations, OSHA often reviews
employee medical records. For example, OSHA may need to review employee
medical records during a compliance inspection to determine whether an
employer is in compliance with OSHA standards and regulations, or to
verify that an employer has taken steps to correct existing violations.
Access to employee medical records may also be necessary during
inspections to determine the effectiveness of voluntary employer safety
and health programs. OSHA also reviews medical records when gathering
information during agency rulemaking to develop or revise occupational
safety and health standards.
Several OSHA standards and regulations mandate medical records
access, including 29 CFR 1910.1020, Access to Employee Exposure and
Medical Records, which sets forth procedures by which exposure and
medical records can be accessed by employees, their designated
representatives, and OSHA. This regulation, which applies to employers
with employees exposed to toxic substances and harmful physical agents,
provides OSHA representatives with prompt access to employee exposure
and medical records and to analysis thereof using exposure or medical
records. See 29 CFR 1910.1020(e)(3). In addition, several of OSHA's
substance-specific standards include provisions for OSHA access to
employee medical records. (e.g., 29 CFR 1910.25(n)(4) (Lead), and 29
CFR 1910.1028(k) (Benzene)).
In many instances, OSHA must examine and copy employee medical
information in personally identifiable form. Personally identifiable
employee medical information as defined by 29 CFR 1913.10(b)(2) means
employee medical information accompanied by either direct identifiers
(name, address, social security number, payroll number) or by
information which could reasonably be used in particular circumstances
indirectly to identify specific employees (e.g., date of birth, race,
sex, date of initial employment, job title). An employee medical record
may include individual health histories as well as medical opinions and
evaluations generated during diagnosis, physical examinations, or
medical treatment by a health care professional.
Because of the substantial personal privacy interests involved,
OSHA authority to access personally identifiable employee medical
information is exercised only after the agency has made a careful
determination of the need for the information, and only when
appropriate safeguards are in place to prevent unauthorized access.
Once this information is accessed, OSHA examination and use is limited
to only that information needed to accomplish a relevant statutory
purpose. Also, personally identifiable employee medical information is
retained by OSHA only for so long as needed to accomplish the purpose
for access, is kept secured while being used, and is not disclosed to
other agencies or members of the public except in narrowly defined
circumstances. In addition, the examination and use of personally
identifiable employee medical information is limited to only OSHA
personnel with a need to review such information.
This rule is not an Executive Order (E.O.) 13771 regulatory action
because this rule is not significant under E.O. 12866. Pursuant to the
Congressional Review Act (5 U.S.C. 801 et seq.), the Office of
Information and Regulatory Affairs designated this rule not a `major
rule', as defined by 5 U.S.C. 804(2).
B. OSHA's Regulation at 29 CFR 1913.10
On May 25, 1980, OSHA issued a final rule entitled Rules of Agency
Practice and Procedure Concerning OSHA Access to Employee Medical
Records (45 FR 35284). The final rule was developed and published in
concert with the promulgation of 29 CFR 1910.1020, Access to Employee
Exposure and Medical Records (45 FR 35212). During the rulemaking,
there was universal agreement that if OSHA obtained access to employee
medical records, the access should be accompanied by stringent internal
agency procedures to preclude abuse of personally identifiable medical
information. Provided these procedures were established, many
participants in the rulemaking endorsed OSHA access to employee medical
records without the consent of the employee for occupational safety and
health purposes (see 45 FR 35218).
Except as provided in 29 CFR 1913.10(b)(3) through (6), the rules
of agency practice and procedure apply to all requests by OSHA
personnel to obtain access to records to examine and copy personally
identifiable employee medical information, whether or not access is
mandated by 29 CFR 1910.1020. Among other things, the regulation at 29
CFR 1913.10 establishes certain responsibilities for specific OSHA
officials when the agency accesses personally identifiable employee
medical information. The regulation also includes provisions addressing
the internal use of employee medical records by agency personnel, as
well as requirements for inter-agency transfer and public disclosure of
such records. The regulation includes security procedures for the use
and storage of employee medical records while in the agency's
possession. Finally, the regulation sets forth internal
[[Page 45782]]
agency requirements for the retention and destruction of records.
A key provision set forth in Sec. 1913.10 is that, with few
exceptions, each request by an OSHA representative to examine or copy
personally identifiable employee medical information must be made
pursuant to a written access order. The written access order is an
authorization for specific OSHA personnel to examine or copy personally
identifiable employee medical information contained in records held by
an employer or other record holder. The rules of agency practice and
procedure in Sec. 1913.10 make clear that each written access order
must state the statutory purpose for which access is sought, a general
description of the type of employee medical information that will be
examined and why there is a need to examine personally identifiable
information, whether the medical information will be examined on-site,
what type of information will be copied and removed off-site, and the
anticipated time during which OSHA expects to retain the employee
medical information in personally identifiable form.
In order to enhance employee privacy, and clarify certain
provisions, OSHA has determined that it is necessary to revise its
regulation at Sec. 1913.10. For example, OSHA's previous regulation at
Sec. 1913.10 used the term ``written access order.'' However, this
final rule revises the regulatory text to include the more commonly
used term ``medical access order'' or ``MAO.''
The final rule also amends the regulation at 29 CFR 1913.10 to
transfer certain responsibilities from the Assistant Secretary to the
OSHA Medical Records Officer (MRO). Specifically, the MRO will now be
responsible for the overall administration and implementation of the
procedures contained in Sec. 1913.10. These new responsibilities
include making determinations regarding (1) OSHA access to personally
identifiable employee medical information pursuant to a MAO, and (2)
inter-agency transfer and public disclosure of personally identifiable
employee medical information. The final rule also transfers
responsibility from the Assistant Secretary to the MRO for issuing
written directives that authorize OSHA compliance personnel to review
certain information without obtaining a MAO.
The final rule clarifies that a MAO does not constitute an
administrative subpoena, and eliminates requirements for the removal of
direct personal identifiers when OSHA personnel review medical
information away from a workplace. The deletion of requirements for the
removal of direct personal identifiers will be offset by new provisions
designed to strengthen employee privacy. Finally, the final rule
establishes new internal OSHA requirements, based on existing agency
policy, for the access and safeguarding of personally identifiable
employee medical information maintained in electronic form.
The procedures set forth in Sec. 1913.10 are internal agency
procedures and do not affect employer compliance with OSHA
requirements. Employers and employees will benefit from the revisions
to Sec. 1913.10 in several ways. First, since the process for
determining whether there is a need for OSHA to review employee medical
information will be more efficient, employers will know sooner if such
a review is authorized at their worksite. Second, the elimination of
the outdated requirement to remove direct personal identifiers before
taking medical information off-site for review will reduce the amount
of an employer's time and physical space needed by OSHA personnel when
they visit a specific workplace. Third, the revisions will benefit
employees because the procedures in Sec. 1913.10 to protect the
security and privacy of employee medical records will be strengthened,
especially with regard to medical information in electronic form.
Fourth, the elimination of the requirement to remove direct personal
identifiers before taking medical information off-site will enhance
employee privacy because the removal process always carries with it the
possibility that medical information will be misidentified or
mislabeled, which could result in unauthorized staff mistakenly
reviewing that information. Finally, deletion of the time-consuming de-
identification procedures will mean that authorized OSHA personnel can
conduct follow-up consultations with employees about their health more
quickly.
The notice and comment rulemaking procedures of 5 U.S.C. 553 of the
Administrative Procedure Act (APA) do not apply to ``interpretive
rules, general statements of policy, or rules of agency organization,
procedure, or practice.'' 5 U.S.C. 553(b)(A). The provisions in 29 CFR
1913.10 are rules of agency procedure and practice within the meaning
of section 553(b)(A) of the APA. Therefore, publication in the Federal
Register of a notice of proposed rulemaking and request for comments is
not required. Furthermore, because this rule is procedural rather than
substantive, the normal requirement of 5 U.S.C. 553(d) that a rule not
be effective until at least 30 days after publication in the Federal
Register is inapplicable. OSHA also finds good cause to provide an
immediate effective date for this rule, because it imposes no
obligations on parties outside the federal government and therefore no
advance notice is required to enable employers or other private parties
to come into compliance.
II. Legal Authority
The Occupational Safety and Health Act of 1970, 29 U.S.C. 651 et
seq. (OSH Act) authorizes the Secretary to issue two types of
occupational safety and health rules: Standards and regulations.
Standards, which are authorized by section 6 of the Act, specify
remedial measures to be taken to prevent and control employee exposure
to identified occupational safety and health hazards, while regulations
are the means to effectuate other statutory purposes, including the
maintaining of records. For example, the OSHA requirements at 29 CFR
1910.95 are a ``standard'' because they include remedial measures to
address the specific and already identified hazard of employee exposure
to occupational noise. In contrast, a ``regulation'' is a purely
administrative effort designed to uncover violations of the Act and
discover unknown dangers. The procedural regulations in 29 CFR 1913.10
are necessary to enable the use of employee medical records by OSHA
consistent with the employee's right of privacy.
In section 2(b) of the OSH Act, Congress declared the overriding
purpose of the Act is ``to assure so far as possible every working man
and woman in the Nation safe and healthful working conditions.'' (29
U.S.C. 651.) Congress also explicitly declared that this must be
accomplished, among other ways, ``by providing an effective enforcement
program . . .'' (29 U.S.C. 651(b)(10)). For the Secretary of Labor to
conduct an effective enforcement program, he or she must determine
whether occupational safety and health hazards exist in the workplace.
To that end, the OSH Act authorizes the Secretary to enter and inspect
workplaces and to conduct reasonable investigations into working
conditions.
Section 8(a) of the OSH Act authorizes OSHA to enter, inspect, and
investigate places of employment, and section 8(b) permits OSHA to
subpoena both witnesses and evidence when conducting inspections and
investigations. (29 U.S.C. 657(a) and (b)). As noted above, in some
instances, it may be necessary for OSHA to examine personally
identifiable employee medical information. Section
[[Page 45783]]
8 of the OSH Act recognizes OSHA's right of access to medical records,
and records access is mandated by OSHA standards and regulations,
including 29 CFR 1910.1020(e)(3) (access to employee exposure and
medical records). OSHA relies on administrative subpoenas to compel
production of medical records by employers and other record holders.
OSHA is issuing the final rule pursuant to authority expressly
granted in section 8 of the OSH Act. Section 8(c)(1) requires each
employer to ``make, keep, preserve, and make available to the Secretary
[of Labor] or the Secretary of Health and Human Services, such records
regarding his activities relating to this Act as the Secretary, in
cooperation with the Secretary of Health and Human Services, may
prescribe by regulation as necessary or appropriate for the enforcement
of this Act or for developing information regarding the causes and
prevention of occupational accidents and illnesses'' (29 U.S.C.
657(c)(1)). Employee medical records are included within the type of
records addressed by this provision.
Section 8(g)(1) of the OSH Act provides that the Secretary and
Secretary of Health and Human Services are authorized to compile,
analyze, and publish, either in summary or detailed from, all records
or information obtained under this section (29 U.S.C. 657(g)(1)).
Section 8(g)(2) is the general rulemaking authority of the OSH Act and
provides that the Secretary and the Secretary of Health and Human
Services shall prescribe such rules and regulations as he may deem
necessary to carry out their responsibilities under this Act, including
rules and regulations dealing with the inspection of an employer's
establishment.
III. Summary and Explanation of the Final Rule
Section 1913.10(b)--Scope and Application
OSHA's regulation at 29 CFR 1913.10(b), Scope and application,
defines the circumstances under which the procedural regulations in
Sec. 1913.10 will apply. Except as provided in paragraphs (b)(3)
through (6), the policies and procedures in Sec. 1913.10 apply to all
requests by OSHA personnel to access personally identifiable employee
medical information.
In general, 29 CFR 1913.10 requires OSHA personnel to obtain a MAO
(previously ``written access order,'' but referred to in this section
as ``MAO'' as it is in the final rule) when accessing personally
identifiable employee medical information. However, under certain
circumstances, the regulation states that OSHA access may be
accomplished without obtaining a MAO. For example, Sec.
1913.10(d)(4)(i) provides that a MAO is not needed when an employee
gives specific written consent for OSHA to access their medical
records. Also, Sec. 1913.10(b)(3) through (5) include several
categories of records that are not subject to Sec. 1913.10 and
therefore may be accessed without obtaining a MAO. These categories of
records include medical information that is not in personally
identifiable form, injury and illness records required by 29 CFR part
1904, death certificates, employee exposure records, and medical
information obtained in the course of litigation. In addition, previous
Sec. 1913.10(b)(6) provided that the policies and procedures in Sec.
1913.10 do not apply when a written directive by the Assistant
Secretary authorizes appropriately qualified personnel to conduct
limited review of specific medical information mandated by an OSHA
standard or of specific biological monitoring test results. This final
rule amends Sec. 1913.10(b)(6) to state that the MRO is now
responsible for issuing these written authorization directives.
OSHA Directive CPL 02-02-072, Rules of agency practice and
procedure concerning OSHA access to employee medical records, August
22, 2007, includes authorization for review of three categories of
information based on the provisions in Sec. 1913.10(b)(6). The
directive authorizes OSHA compliance personnel to review (1) medical
opinions mandated by OSHA standards, (2) information required by a
medical surveillance program, and (3) certain information used to
verify compliance with the injury and illness recordkeeping
requirements in 29 CFR part 1904. OSHA personnel do not need a MAO when
they access the information at a workplace pursuant to a written
directive under Sec. 1913.10(b)(6). Instead, OSHA personnel follow the
procedures set forth in the written directive. The 2007 directive
includes provisions on how OSHA personnel may access the specific types
of information and how the information should be protected once in the
agency's possession.
OSHA believes the MRO is in the best position to make
determinations regarding written authorization under Sec.
1913.10(b)(6). Section 1913.10(c)(2) already provides that the MRO must
have experience or training in the evaluation, use, and privacy
protection of medical records, and, as discussed below in this
preamble, paragraph (c) of Sec. 1913.10 has been amended to provide
that the MRO is now responsible for the overall administration of the
policies and procedures in Sec. 1913.10. Also, as part of the final
rule, paragraph (c) now states that the MRO is specifically responsible
for making determinations regarding the approval of MAOs, inter-agency
transfer, and public disclosure of identifiable employee medical
records. Given all the new MRO responsibilities set forth in paragraph
(c), as well as the existing duties in the other paragraphs of the
regulation, it is appropriate to also make the MRO responsible for
written authorization under paragraph (b)(6). Accordingly, final Sec.
1913.10(b)(6) states that the provisions of 29 CFR 1913.10 do not apply
where a written directive by the MRO authorizes appropriately qualified
personnel to conduct limited review of specific medical information
mandated by an occupational safety and health standard or of specific
biological monitoring test results. OSHA will also amend Directive CPL
02-02-072 to reflect the new regulatory text in paragraph (b)(6).
Section 1913.10(c)--Responsible Persons
OSHA's regulation at 29 CFR 1913.10(c) establishes certain
responsibilities for OSHA personnel when the agency accesses personally
identifiable employee medical information. Paragraph (c) is largely a
summary of duties established by other paragraphs in Sec. 1913.10 and
sets forth specific responsibilities for the Assistant Secretary, MRO,
and Principal OSHA Investigator. The final rule amends several
provisions in paragraph (c) to emphasize the responsibilities of the
MRO.
Under the previous regulation, paragraph (c)(1) provided that the
OSHA Assistant Secretary was responsible for the overall administration
and implementation of the policies and procedures in Sec. 1913.10.
This responsibility included making determinations regarding (1) OSHA
access to personally identifiable employee medical information and (2)
interagency transfer or public disclosure of personally identifiable
employee medical information. Also under the previous regulation, Sec.
1913.10(d)(1) provided that each request by an OSHA representative to
access information through a written access order must be approved by
the Assistant Secretary upon the recommendation of the MRO.
Section 1913.10(c)(2) of the previous regulation provided that the
Assistant Secretary was responsible for designating an OSHA official
with experience or training in the evaluation,
[[Page 45784]]
use, and privacy protection of medical records to be the MRO. The MRO,
who reported directly to the Assistant Secretary on matters related to
Sec. 1913.10, was responsible for making recommendations to the
Assistant Secretary on whether to approve or deny written access
orders, and served as the central reviewer of the sufficiency and
justification of these documents. The MRO was also responsible for
responding to employee, collective bargaining agent, and employer
objections to written access orders. In addition, Sec. 1913.10(c)(2)
of the previous regulation stated that the MRO was responsible for
controlling the use of direct personal identifiers; controlling
internal agency use and security of personally identifiable employee
medical information; assuring that the results of agency analysis of
personally identifiable employee medical information are, where
appropriate, communicated to employees; preparing an annual report for
the Assistant Secretary on OSHA's experience with respect to Sec.
1913.10; and assuring that adequate notice is given of intended inter-
agency transfers or public disclosures of personally identifiable
employee medical information.
The other OSHA official with important responsibilities when the
agency accesses employee medical information is the Principal OSHA
Investigator. Section 1913.10(c)(3) provides that the Principal OSHA
Investigator is the OSHA employee designated on the MAO who is
primarily responsible for ensuring that OSHA examination and use of
employee medical information is in accordance with the provisions of
the MAO and Sec. 1913.10. In most instances, the Principal OSHA
Investigator named on a MAO is an employee from an OSHA Regional or
Area Office and determines how and when employee medical information
will be accessed during an OSHA inspection or investigation. In
practice, the Principal OSHA Investigator is responsible for ensuring
that the provisions of the MAO and Sec. 1913.10 are followed by OSHA
personnel when medical information is accessed at a specific workplace.
As provided in Sec. 1913.10(c)(3), the Principal OSHA Investigator
must be professionally trained in medicine, public health, or similar
fields (epidemiology, toxicology, industrial hygiene, biostatistics,
environmental health) when access is made pursuant to a MAO. The
provisions in Sec. 1913.10(c)(3) concerning the Principal OSHA
Investigator are unchanged by the final rule.
The final rule retains the Assistant Secretary's responsibility to
designate an OSHA official as MRO. However, this responsibility is now
set forth in Sec. 1913.10(c)(1). Like the previous regulation, Sec.
1913.10(c)(1) of the final rule states that the Assistant Secretary
shall designate an OSHA official with experience or training in the
evaluation, use, and privacy protection of medical records to be the
OSHA Medical Records Officer. The final rule also states that the
Assistant Secretary may change the designation of the MRO at will.
The final rule includes several changes to paragraph (c)(2), OSHA
Medical Records Officer. Some of these changes transfer specific
responsibilities from the Assistant Secretary to the MRO while other
responsibilities assigned to the MRO in Sec. 1913.10(c)(2) are carried
over from the previous regulation.
The final rule amends paragraph (c)(2) to provide that the MRO is
now responsible for the overall administration and implementation of
the procedures contained in Sec. 1913.10. OSHA believes there are two
central principles that form the basis of the procedural requirements
in Sec. 1913.10: (1) There should be a thorough review of all efforts
to examine or copy personally identifiable employee medical information
before the information is obtained and (2) personally identifiable
information must be carefully protected once obtained. OSHA also
believes the MRO is in the best position to ensure that the central
principles of Sec. 1913.10 are carried out by the agency.
As already noted, paragraph (c)(1) of the final rule, like the
previous regulation, provides that the MRO must have experience and
training in the evaluation, use, and privacy protection of medical
records. Historically, a physician from OSHA's Office of Occupational
Medicine and Nursing (OOMN) has been designated as MRO, and, in most
cases, the person designated has been the Director of OOMN. As a
result, the MRO has had an extensive background in both medicine and
administration.
Additionally, under the previous regulation, the MRO was already
responsible for ensuring the sufficiency and justification of MAOs and
making recommendations to the Assistant Secretary on whether to approve
or deny such documents. The MRO also has several duties set forth
throughout the other paragraphs in Sec. 1913.10 and therefore has a
good understanding of the day-to-day implementation of the regulation.
Under the final rule, the MRO will now be responsible for making
determinations regarding whether to approve or deny MAOs, any inter-
agency transfer, and public disclosures of personally identifiable
employee medical information, as well as whether to issue written
directives authorizing OSHA personnel to conduct limited review of
certain medical information without an MAO. Accordingly, the extensive
medical and administrative experience, the responsibilities under the
previous regulation, and the new responsibilities assigned by this
final rule make the MRO the logical OSHA official to have
responsibility for the overall administration and implementation of the
procedures in Sec. 1913.10.
While the final rule limits the role of the Assistant Secretary in
the day-to-day implementation of Sec. 1913.10, the Assistant Secretary
still maintains an important oversight responsibility. As in the
previous regulation, the Assistant Secretary retains the responsibility
for naming an OSHA official as MRO, with the ability to replace the MRO
at will, and the MRO must still report to the Assistant Secretary on
matters related to Sec. 1913.10. In practice, the MRO will continue to
consult with the Assistant Secretary on MAO approval, inter-agency
transfers, and public disclosures of personally identifiable employee
medical information. In addition, paragraph (l) requires the MRO to
prepare an annual report for the Assistant Secretary on matters related
to the approval and purpose of MAOs, objections to MAOs, and inter-
agency transfers and public disclosures during the previous year. The
responsibility to designate an OSHA official as MRO, continued
consultation, and receiving reports from the MRO will keep the
Assistant Secretary informed about OSHA's overall implementation of
Sec. 1913.10. Accordingly, like the previous regulation, the final
rule at paragraph (c)(2) provides that the MRO is responsible for
reporting directly to the Assistant Secretary on matters concerning
Sec. 1913.10.
Under the final rule, the MRO is also now responsible for making
determinations concerning (1) access to personally identifiable
employee medical information and (2) interagency transfer or public
disclosure of personally identifiable employee medical information.
These two responsibilities had been assigned to the Assistant Secretary
in previous Sec. 1913.10(c)(1).
Section 1913.10(c)(2)(i) of the final rule states that the MRO is
responsible for making determinations concerning
[[Page 45785]]
OSHA access to personally identifiable employee medical information
under Sec. 1913.10(d). Paragraph (d) addresses OSHA access to
personally identifiable employee medical information by MAO.
With the exception of two circumstances described at the end of
paragraph (d), each request by OSHA to examine or copy personally
identifiable employee medical information is made pursuant to an MAO.
Paragraph (d)(2) sets criteria the agency must follow when it seeks
access to identifiable medical information, and paragraph (d)(3) sets
forth the content to be included in the MAO. In order to be valid, an
MAO must be approved by the MRO using the criteria in paragraph (d)(2).
First, the MRO must consider whether the information to be examined or
copied is relevant to a statutory purpose and whether there is a need
to gain access to the information. The MRO has the responsibility, on a
case-by-case basis, to ensure that access is sought only where there is
a genuine need to do so. OSHA believes that a finding of relevance and
need by the MRO is a significant safeguard against excessive use of the
agency's authority to access personally identifiable employee medical
information.
Paragraph (d)(2) next states that consideration must be given to
whether the personally identifiable employee medical information
subject to the MAO is limited to only that information needed to
accomplish the purpose for access. This provision is aimed at
preventing OSHA access to extraneous medical information unrelated to
the purpose for access. Lastly, paragraph (d)(2) states that the MRO
must determine that the personnel authorized to review the medical
information are limited to those who have a need for access and have
appropriate professional qualifications. The limiting of personnel that
can review and analyze information to only those who have a need for
access and who have appropriate professional qualifications is
important for maintaining the confidentiality of employee medical
records.
OSHA believes the MRO is in the best position to evaluate the
criteria in paragraph (d) and make determinations on whether to approve
or deny MAOs. Typically, the MRO has extensive subject-matter clinical
experience and expertise in occupational medicine. This allows the MRO
to evaluate whether, and to what extent, employee medical information
needs to be accessed by OSHA. Accordingly, paragraph (d)(2) has been
amended to state that, before approving an MAO, the MRO must determine
that the documents meet the criteria in that paragraph.
For similar reasons, the MRO is also now responsible for making
determinations concerning inter-agency transfer and public disclosure
of personally identifiable employee medical information. Section
1913.10(m) describes the circumstances under which personally
identifiable employee medical information can be transferred to another
agency or disclosed to the public. The requirements in paragraph (m)
remain unchanged from the previous regulation. However, the provisions
in paragraph (m), as well as paragraph (c)(2), are amended by the final
rule to provide that the MRO, not the Assistant Secretary, is now
responsible for making determinations regarding inter-agency transfer
and public disclosure of personally identifiable employee medical
information. The individual provisions in paragraph (m) are amended to
cross reference with the new MRO responsibility established in Sec.
1913.10(c)(2)(vii).
The following discussion of the individual provisions in paragraph
(m) clarifies the MRO's new responsibility for making determinations
concerning inter-agency transfer and public disclosure set forth in
Sec. 1913.10(c)(2). The previous regulation at Sec. 1913.10(m)(1)
stated that personally identifiable employee medical information shall
not be transferred to another agency or office outside of OSHA (other
than the Office of the Solicitor of Labor) or disclosed to the public
(other than to the affected employee or the original recordholder)
except when required by law or when approved by the Assistant
Secretary. The final rule amends paragraph (c)(2)(vii) to make clear
that the MRO is now responsible for making these determinations. The
final rule also amends paragraph (m) to provide that the MRO must
follow specific criteria when making determinations concerning inter-
agency transfer and public disclosure of personally identifiable
employee medical information.
OSHA's longstanding position is that inter-agency transfer and
public disclosure of personally identifiable employee medical
information should be carefully considered, and paragraph (m) addresses
these issues. Inter-agency transfer and public disclosure of personally
identifiable employee medical information are not categorically
prohibited by the regulation for two reasons. OSHA believes (1) it
cannot legally make such a commitment and (2) situations arise where
transfer or disclosure is appropriate. Under certain circumstances, as
a matter of law, OSHA is compelled to transfer information to another
agency or disclose it to a non-governmental individual. For example,
OSHA might be required to provide the information in response to a
lawful subpoena. In other circumstances, disclosure may also be
appropriate. For example, in order to resolve a public health problem,
OSHA may need to transfer employee medical information to another
federal or state agency. In such situations, the transfer of employee
medical information may be critical in identifying an emerging health
issue, compiling data on worker fatalities from specific exposure, or
evaluating the effectiveness of workplace controls designed to prevent
occupational illness at manufacturing facilities.
OSHA notes that inter-agency transfer and public disclosure of
personally identifiable employee medical information is not a common
occurrence. In the last five years, the agency has made only three
inter-agency transfers of personally identifiable employee medical
information to another federal or state agency. OSHA also notes that
inter-agency transfer and public disclosure of employee medical
information not in personally identifiable form is not subject to
provisions in Sec. 1913.10.
Paragraph (m) of Sec. 1913.10 includes strict limitations on
inter-agency sharing and public disclosure of employee medical
information. Except when required by law, all inter-agency transfer or
public disclosure of personally identifiable employee medical
information must be approved by the MRO in accordance with the criteria
in paragraph (m).
Paragraph (m)(2) states that, except as provided for in paragraph
(m)(3), the MRO shall not approve a request for an inter-agency
transfer, which has not been consented to by the affected employee,
unless the request is by a public health agency. Under this provision,
transfer of medical information is permitted only to a public health
agency for a substantial public health purpose. The regulation goes on
to state that the MRO can approve the transfer only if the public
health agency (1) needs the information for substantial public health
purposes, (2) will not use the information to make individual
determinations concerning affected employees which could be to their
detriment, (3) has regulations or written established procedures
providing protection for personally identifiable medical information
substantially equivalent to Sec. 1913.10,
[[Page 45786]]
and (4) satisfies an exemption to the Privacy Act to the extent the
Privacy Act applies to the requested information.
Because OSHA collects medical information only for a public health
purpose, OSHA believes it is appropriate to restrict all subsequent
discretionary transfers to those agencies with an equivalent public
health purpose. The MRO must review each request for a transfer on a
case-by-case basis by taking into account each of the listed criteria
in paragraph (m)(2). Most importantly, in order to protect individual
privacy, the MRO must be satisfied that the recipient agency's privacy
protections are equivalent to OSHA's.
Paragraph (m)(3) contains two exceptions to the requirements of
paragraph (m)(2). First, upon the approval of the MRO, personally
identifiable employee medical information can be shared with the
National Institute for Occupational Safety and Health (NIOSH). Like
OSHA, NIOSH is a public health agency and its research activities
complement OSHA's regulatory responsibilities. OSHA's ability to
analyze employee medical records is often improved by gaining NIOSH
assistance, and medical information collected by OSHA may have major
research value for NIOSH. Also, because of its frequent use of medical
information, and sensitivity to individual privacy, NIOSH has
procedures in place that provide for the protection of personally
identifiable medical information that are substantially equivalent to
Sec. 1913.10. As a result, employee medical information may be
transferred to NIOSH if approved by the MRO without further inquiry
into the sufficiency of its programs for protecting medical records.
Paragraph (m)(3) also permits, upon the approval of the MRO, the
inter-agency transfer of personally identifiable employee medical
information to the U.S. Department of Justice when necessary with
respect to a specific action under the OSH Act. For example, the
Justice Department prosecutes criminal violations under the OSH Act, as
well as civil penalty collection actions. The Justice Department also
represents OSHA in Freedom of Information Act (FOIA) lawsuits.
Personally identifiable employee medical information may be relevant in
these legal actions, and OSHA must be able to share information in
these circumstances.
Paragraphs (m)(4) and (5) address public disclosure of personally
identifiable employee medical information which has not been consented
to by the affected employee. Paragraph (m)(4) provides that the MRO
shall not approve a request for public disclosure of employee medical
information containing personal identifiers unless there are compelling
circumstances affecting the health or safety of an individual. Also,
paragraph (m)(5) states that the MRO shall not approve a request for
public disclosure of employee medical information which contains
information which could reasonably be used indirectly to identify
specific employees when the disclosure would constitute a clearly
unwarranted invasion of personal privacy. Finally, paragraph (m)(6)
retains the provision from the previous regulation that, except as to
inter-agency transfer to NIOSH or the Department of Justice, the MRO
shall ensure that advance notice is provided to any collective
bargaining agent representing affected employees and to the employer on
each occasion OSHA intends to transfer personally identifiable employee
medical information to another agency or disclose it to a member of the
public other than to an affected employee. When feasible, the MRO must
take reasonable steps to assure that advance notice is provided to
affected employees when the employees' medical information to be
transferred or disclosed contains direct personal identifiers.
Finally, the final rule at Sec. 1913.10(c)(2) retains several
provisions from the previous regulation. Specifically, paragraph
(c)(2)(iii) continues to provide that the MRO is responsible for
responding to MAO objections, and paragraph (c)(2)(iv) continues to
provide that the MRO is responsible for overseeing the internal use and
security of personally identifiable employee medical information. Two
other MRO responsibilities in paragraph (c)(2) have been retained from
the previous regulation but have been renumbered under the final rule.
Paragraph (c)(2)(v), formerly paragraph (c)(2)(vi), continues to
provide that the MRO is responsible for assuring that the results of
agency analyses of personally identifiable medical information are,
where appropriate, communicated to employees. Paragraph (c)(2)(vi),
formerly paragraph (c)(2)(vii), retains the provision that the MRO is
responsible for preparing an annual report of OSHA's experience under
Sec. 1913.10.
Section 1913.10(d)(1)--Requirements for Medical Access Orders
OSHA's previous regulation at Sec. 1913.10(d)(1) stated that,
except as provided in paragraph (d)(4), each request by an OSHA
representative to examine or copy personally identifiable employee
medical information contained in a record held by an employer or other
record holder shall be made pursuant to a written access order which
has been approved by the Assistant Secretary upon the recommendation of
the OSHA Medical Records Officer. Paragraph (d)(1) went on to state
that, if deemed appropriate, a written access order may constitute, or
be accompanied by, an administrative subpoena.
As explained above, the MRO is now responsible for the approval or
denial of MAOs, and paragraph (d)(1) has been revised to reflect this
change. The final rule also amends paragraph (d)(1) to make clear that
a MAO does not constitute an administrative subpoena.
An administrative subpoena is a written order issued by OSHA to
require an employer, or any other person, to produce listed records,
documents, testimony and/or other supporting evidence relevant to an
inspection or investigation under the OSH Act. If the person served
with a subpoena refuses to honor (or only partially honors) the order,
the subpoena is subject to judicial review and enforcement by a U.S.
District Court. OSHA Regional Administrators have authority to issue
administrative subpoenas and are also authorized to delegate to Area
Directors the authority to issue routine administrative subpoenas.
OSHA's policies and procedures for issuing an administrative subpoena
are set forth in OSHA Instruction ADM 01-00-002, August 19, 1991.
In contrast, a MAO is an authorization for specified OSHA personnel
to examine or copy personally identifiable employee medical information
contained in a record held by an employer or some other record holder.
Since an MAO relates to internal OSHA procedures, it cannot be used to
compel the production of records, nor be enforced in a U.S. District
Court. Historically, OSHA has not treated an MAO as equivalent to an
administrative subpoena. OSHA's longstanding practice has been to rely
on an administrative subpoena to compel production of medical records
by employers. See OSHA's August 22, 2007, Instruction CPL 02-02-072,
Rules of agency practice and procedure concerning OSHA access to
employee medical records. MAOs set forth internal OSHA procedure for
assuring appropriate confidentiality of medical records is observed by
OSHA personnel. As a result, except when reasonably certain that the
employer will grant access to employee medical
[[Page 45787]]
information, OSHA personnel present an administrative subpoena to the
employer concurrently with an MAO.
The final rule amends Sec. 1913.10(d)(1) to state that except as
provided in paragraph (d)(4), each request by an OSHA representative to
examine or copy personally identifiable employee medical information
contained in a record held by an employer or other recordholder shall
be made pursuant to a written medical access order which has been
approved by the OSHA Medical Records Officer. A medical access order
does not constitute an administrative subpoena.
Section 1913.10(g)--Removal of Direct Personal Identifiers
OSHA's previous regulation at Sec. 1913.10(g) provided that all
direct personal identifiers (e.g., name, address, Social Security
Number, payroll number) must be removed by OSHA personnel whenever
employee medical information obtained pursuant to a written access
order is taken off-site, unless otherwise directed by the MRO. The
regulation also required the Principal OSHA Investigator to code the
medical information and the list of direct personal identifiers with a
unique identifying number for each employee and then hand deliver or
mail the list of identifiers to the MRO. The MRO thereafter controlled
the use and distribution of the list of coded identifiers to those with
a need to know its contents. In addition, the numerical coded medical
information was to be used and kept secured as though still in a
directly identifiable form.
Paragraph (g) was originally promulgated by OSHA when the rules of
agency practice and procedure were issued in 1980. At that time,
electronic medical records did not exist, and the employee records that
did exist were maintained almost entirely in paper form. Since 1980,
the number of medical records maintained by employers and other record
holders has substantially increased, and the majority of these records
are now maintained in electronic form.
The final rule revises Sec. 1913.10 by deleting the outdated
procedures set forth in paragraph (g). OSHA is eliminating this
internal requirement for several reasons. First, existing access and
safeguarding requirements in Sec. 1913.10 already address privacy
concerns when OSHA takes medical information away from a workplace for
off-site review. Specifically, paragraph (h) of Sec. 1913.10 provides
that only authorized personnel may examine or copy personally
identifiable employee medical information. As explained below, OSHA
experience is that this process can result in coding and re-coding
errors in individual employee medical records. Likewise, it provides
that, unless an exception applies, OSHA personnel and contractors are
authorized to use information only for the purpose for which it was
obtained. In addition, paragraph (h)(5) states that, whenever
practicable, the examination of personally identifiable employee
medical information shall be conducted on-site with a minimum of
medical information taken off-site in a personally identifiable form.
Additionally, paragraph (i) of Sec. 1913.10 includes security
procedures for handling personally identifiable employee medical
information. For example, paragraph (i)(1) provides that files
containing personally identifiable employee medical information shall
be segregated from other agency files and, when not in active use, must
be kept in a locked cabinet or vault. In practice, the locking
requirement extends to when medical information is transported from the
workplace, as OSHA personnel place records in a locked trunk during
transport by automobile.
Second, paragraph (n) of this final rule establishes new
requirements for the access and safeguarding of personally identifiable
employee medical information in electronic form. As discussed more
extensively below, paragraph (n) of the final rule provides that the
Principal OSHA Investigator is responsible for preventing any careless,
accidental, or unintentional disclosure of, modification to, or
destruction of electronic medical records. Paragraph (n)(3) of the
final rule provides that the transfer and/or duplication of medical
records in electronic form must be kept to the minimum necessary to
accomplish the purpose for which it was obtained. Also, paragraph
(n)(4) states that electronic files containing personally identifiable
employee medical information shall be downloaded only to a computer
hard drive or laptop that is secured (e.g., password protected).
Paragraph (n)(4) now includes the Government standards that address
secure access to Government systems and the data they contain: Federal
Information Processing Standards (FIPS) 201-2, ``Personal Identity
Verification (PIV) of Federal Employees and Contractors''; and HSPD-12,
``Homeland Security Presidential Directive 12: Policy for a Common
Identification Standard for Federal Employees and Contractors (HSPD-
12).''
In addition, paragraph (n)(5) provides that electronic files
containing personally identifiable employee medical information must be
encrypted before transferred to authorized individuals. OSHA believes
the safeguards for electronic medical records established by this final
rule, which are based on existing OSHA practices and policy, enhance
privacy protection and reduces the need to remove direct personal
identifiers when OSHA personnel take personally identifiable employee
medical information off-site.
OSHA's experience is that de-identification increases the risk of
mislabeling or misidentifying employee medical records and places a
burden on agency resources by requiring additional OSHA staff time to
accurately conduct de-identification and copying of employee medical
records. In some cases, depending on the number of employees at a
specific facility, OSHA employees may spend several hours finding and
removing each direct personal identifier within each affected
employee's medical record. The deletion of paragraph (g) will reduce
the amount of time and physical space needed by OSHA personnel at a
worksite.
Finally, the deletion of de-identification procedures in paragraph
(g) will simplify follow-up communication from authorized OSHA
personnel with individual employees after evaluation of their medical
information. For example, by not having to complete a potentially
extensive de-identification process, critical medical information about
an employee will be reviewed by an OSHA physician sooner, and this will
allow the physician to conduct follow-up consultation with the employee
in a timely manner. Also, because personally-identifiable information
will remain in the medical records taken from a workplace for off-site
review, it will make it easier for the OSHA physician to identify
employees, compare associated records, and contact individual
employees.
For all of the above reasons, OSHA has concluded that the removal
of direct personal identifier requirements in paragraph (g) should be
deleted.
Section 1913.10(n)--Medical Records Maintained in Electronic Form
In many cases, employers and other record holders maintain
personally identifiable employee medical information in electronic
form. OSHA's regulation at 29 CFR 1910.1020 provides that a ``record''
includes any item, collection, or grouping of information regardless of
the form or process by which it is maintained (e.g., paper, document,
microfilm, X-ray film, or
[[Page 45788]]
automated data processing). Medical records may also be maintained on
media such as magnetic tape, computer disks, USB storage devices (e.g.,
thumb drives), and online computer storage. Historically, OSHA
personnel have followed the requirements in 29 CFR 1913.10 when
accessing personally identifiable employee medical information
maintained in electronic form. However, the regulation did not include
provisions that specifically addressed electronic medical records. The
final rule establishes new internal policies and procedures in
paragraph (n) to Sec. 1913.10 that specifically address OSHA access,
use, and safeguarding of personally identifiable employee medical
information maintained in electronic form.
Since the rules of agency practice and procedure were first issued
in 1980, medical professionals have increasingly relied on the use and
storage of medical records in electronic form. These records tend to
improve the quality of health care and have several practical
advantages over paper records. For example, electronic medical records
can be accessed by health care professionals at any time from any given
location. Legible records can also lead to more accurate diagnosis,
treatment, and drug prescription. Electronic medical records are cost-
effective because they take up less storage space and can be stored
indefinitely. However, because they are in electronic form, these
records also present unique challenges to security, privacy, and data
integrity.
OSHA believes the best way to protect the security and
confidentiality of personally identifiable employee medical information
in electronic form is to prevent unauthorized access to such
information. Several effective administrative, technological, and
physical measures can be taken to protect electronic medical
information from unauthorized access, use, disclosure, disruption,
modification, or destruction. These methods include establishing
specific security roles and responsibilities for OSHA officials,
technology safeguards such as encryption or firewalls to protect
against electronic breaches, ID/password protection for devices and
information systems, and the use of anti-virus and intrusion detection
software. The establishment of new internal OSHA policies and
procedures in paragraph (n) of this final rule will effectively protect
the security, privacy, and data integrity of employee medical
information in electronic form.
Section 1913.10(n)(1) of the final rule provides that, in general,
when accessing and/or copying personally identifiable employee medical
information in electronic form, OSHA personnel shall follow the
requirements set forth in 29 CFR 1913.10. As noted above, OSHA
personnel have historically followed the rules of agency practice and
procedure in Sec. 1913.10 when accessing employee medical information
in electronic form, and many of the provisions in Sec. 1913.10 are
applicable regardless of the format used to maintain information. As a
result, unless specifically addressed in paragraph (n), OSHA personnel
should continue to follow the rules of agency practice and procedure in
paragraphs (a) through (m) when accessing and safeguarding electronic
employee medical information.
Section (n)(2) of the final rule includes responsibilities for the
Principal OSHA Investigator when OSHA personnel access personally
identifiable employee medical information in electronic form.
Specifically, paragraph (n)(2) states that when personally identifiable
employee medical information in electronic form is taken off-site, the
Principal OSHA Investigator is primarily responsible for ensuring that
such information is properly used and kept secured. This provision is
based on the requirement in paragraph (h)(1) of Sec. 1913.10, which
provides that the Principal OSHA Investigator is responsible for
ensuring that medical information is used and kept secured in
accordance with Sec. 1913.10. Other specific responsibilities assigned
to the Principal OSHA Investigator in paragraph (n)(2) include
preventing any accidental or unintentional disclosure of, modification
to, or destruction of personally identifiable employee medical
information in electronic form (paragraph (n)(2)(i)); controlling the
flow of data into, through, and from agency computer operations
(paragraph (n)(2)(ii)); and ensuring that distribution and review of
medical information in electronic form is limited to only those OSHA
personnel and contractors with a need for access (paragraph
(n)(2)(iii)). The requirement in paragraph (n)(2)(iii) is derived from
Sec. 1913.10(d)(2)(iii), which provides that, before approving a MAO,
the MRO must determine that personnel authorized to review and analyze
personally identifiable employee medical information are limited to
those who have a need for access and have appropriate qualifications.
As discussed above, the Principal OSHA Investigator is the OSHA
employee in the field with primary responsibility for ensuring that the
examination and use of employee medical information is in accordance
with Sec. 1913.10. As such, the Principal OSHA Investigator is
responsible for ensuring that the provisions in paragraph (n) are
followed by OSHA personnel when electronic medical information is
accessed from a specific workplace. For example, this would include
ensuring that access to personally identifiable employee medical
records in electronic form is limited to only authorized personnel with
a need to review the information, ensuring that employee medical
information is only downloaded to a secured device (e.g., password
protected), and verifying that medical information is deleted or
destroyed when no longer needed by the agency.
Section 1913.10(n)(3) of the final rule provides that the transfer
and/or duplication of medical information in electronic form shall be
kept to the minimum necessary to accomplish the purpose for which it
was obtained. This provision is similar to paragraph (i)(3) of Sec.
1913.10, which states that the photocopying or other duplication of
personally identifiable employee medical information shall be kept to
the minimum necessary to accomplish the purpose for which the
information was obtained.
In some cases, personally identifiable employee medical information
in electronic form needs to be transferred or duplicated to facilitate
internal OSHA review. For example, in order to conduct a proper
workplace inspection or investigation, it may be necessary for OSHA
personnel to transfer employee medical records to another OSHA employee
with expertise on a specific occupational health hazard. Paragraph
(n)(3) of the final rule permits the transfer and duplication of
electronic medical information but only to authorized individuals with
a need to review the information. Transfer and duplication are also
limited to the minimum necessary to accomplish the purpose for which it
was obtained. An example of this limitation might include the review of
a medical record to determine whether an employee has sustained a work-
related injury or illness. In such cases, review of a medical record
would extend only to information about the employee's injury or
illness. In this example, the transfer and/or duplication of electronic
medical information unrelated to the injury or illness would not be
permitted.
Additionally, OSHA believes the likelihood that medical information
in electronic form will be lost, altered, or destroyed increases during
transfer or duplication. The duplication of electronic medical
information can also
[[Page 45789]]
raise concern about data integrity. For example, the copying or
deleting of employee medical information from one document to another
raises concern about the accuracy of the information. Accordingly,
personally identifiable electronic medical information should be
transferred only to authorized individuals with a need to know the
information and should be duplicated only to facilitate authorized
internal agency review.
Consistent with existing OSHA policy, Sec. 1913.10(n)(4) of the
final rule states that electronic files containing personally
identifiable employee medical information shall be downloaded only to a
computer hard drive or laptop that is in accordance with Federal
Information Processing Standard (FIPS) 201-2, ``Personal Identity
Verification (PIV) of Federal Employees and Contractors,'' and
``Homeland Security Presidential Directive 12: Policy for Common
Identification Standard for Federal Employees and Contractors (HSPD-
12).'' The use of secured technology when downloading medical records
will help to ensure that information is (1) accessed only by authorized
individuals with a need-to-know and (2) not modified or deleted.
In accordance with current OSHA and Federal Government policy, the
use of password protection is easy to implement, cost-effective, and a
reliable method for securing electronic information. By downloading
employee medical information to a secured hard drive or laptop, OSHA
personnel will be able to ensure that only individuals that know the
password can open a document and read its content. This practice also
provides a level of protection that goes with the document no matter
where it is stored or sent. Finally, because tampering with a secured
device takes time and effort, providing this level of protection acts
as a deterrent to accessing document content by unauthorized
individuals.
Additionally, it is important for OSHA personnel to follow proper
security practices when using password protected devices containing
personally identifiable employee medical information. Authorized
individuals must not share their ID with others, should log-off when
leaving a terminal, and use their own ID to access employee medical
records. Also, authorized individuals should not keep written
facsimiles of passwords or access codes. Other security measures, such
as the use of firewalls, anti-virus software, and intrusion detection
software should also be used to protect data integrity. Again, the
Principal OSHA Investigator is responsible for ensuring that proper
security measures are in place in the field to protect the
confidentiality of personally identifiable employee medical records in
electronic form.
Moreover, it is critically important that mobile devices be
encrypted or use password protection when used to download, transfer,
or store electronic medical information. Mobile devices are for
individual use, and are not designed for centralized IT management.
These devices can easily be manipulated, damaged, or stolen. By
encryption, OSHA means the process of changing plain text into cypher
text for the purpose of security. The use of encryption results in the
encoding of information in such a way so that only authorized
individuals can access the information.
Section 1913.10(n)(5) of the final rule states that electronic
files containing personally identifiable employee medical information
shall not be transferred to authorized personnel through email
attachment unless appropriately encrypted. The transfer of employee
medical information by email attachment increases the risk that such
information will be sent to an unauthorized individual. The transfer of
personally identifiable employee medical information in electronic form
must be made through secured means. See Sec. 1913.10(n)(4), discussed
above (``Electronic files containing personally identifiable employee
medical information shall only be downloaded to a computer hard drive
or laptop that is secured.''). Appropriate methods for the transfer of
personally identifiable employee medical information in electronic form
may include the use of password protected or encrypted files on a
secured agency website designed for confidential information, the
mailing of encrypted computer disks or USB drives, the emailing of
password protected medical records (Adobe secured), and the printing
and hand delivery of paper records.
Paragraph (n)(6) provides that when an employer or other record
holder(s) provides access to employee medical information through a
properly encrypted email attachment, the attachment shall be downloaded
to a secured hard drive or laptop. After the attachment is downloaded,
the email shall be permanently deleted.
In some cases, employers and other record holders provide OSHA with
access to employee medical information through an encrypted email
attachment. As noted above, the use of email attachments to transfer
medical records makes it more likely that the information will be sent
to unauthorized individuals. Paragraph (n)(6) ensures that medical
information received in an encrypted email attachment is downloaded to
a secured device.
After downloading the attachment from the employer or other record
holder, the email must be permanently deleted to prevent transfer to
unauthorized individuals. By permanently deleted, OSHA means that the
email should be deleted so that it cannot be retrieved. Some email
programs automatically delete trashed emails after a certain amount of
time. Other programs retain emails until the user runs out of space.
However, the intent of this provision is that, once the attachment is
downloaded, OSHA personnel should immediately and permanently delete
the incoming email. Most email programs have a ``delete forever''
function that allows the user to select emails in the trash folder for
permanent deletion.
Section 1913.10(n)(7) of the final rule states that personally
identifiable employee medical information in electronic form shall be
secured when not in use. This provision is based on paragraph (i)(1) of
Sec. 1913.10, which states that agency files containing personally
identifiable employee medical information shall be segregated from
other agency files, and when not in active use, files containing this
information shall be kept secured in a locked cabinet or vault.
Paragraph (n)(7) is intended to prevent unauthorized access or
modification to employee medical information in electronic form. In
addition to all of the procedures in paragraph (n) addressing the use
of electronic information by OSHA personnel, when not in use, such
information must be stored in a secured manner. For example, when not
in use, personally identifiable employee medical information should be
stored on a password protected hard drive or laptop. Another example
might be the storing of information on a password protected agency
website designed to store confidential information. Also, if employee
medical records are kept on computer disk or other electronic storage
media, when not in use, the disk or media should be stored under lock
and key. Paragraph (n)(7)(i) of the final rule also emphasizes the
importance of proper storage by specifically stating that medical
information in electronic form shall only be maintained or stored where
facilities and conditions are designed to prevent unauthorized access.
Paragraph (n)(7)(ii) provides that personally identifiable employee
medical information in electronic form shall be maintained only for so
long as
[[Page 45790]]
needed to accomplish the purpose for access. This provision is derived
from paragraph (j)(1) of Sec. 1913.10, which provides that consistent
with OSHA records disposition programs, personally identifiable
employee medical information shall be destroyed or returned to the
original record holder when no longer needed for the purposes for which
they were obtained. In OSHA's view, maintaining medical records only
for so long as needed helps to ensure that such information will not be
accessed by unauthorized individuals.
In some cases, after its initial use by the agency, personally
identifiable employee medical information may not be used again until
sometime in the future. For example, medical information used as the
basis for an OSHA citation may be used during the hearing stage of an
enforcement case before the Occupational Safety and Health Review
Commission. The medical information may not be used while the case is
on appeal, but there may be a need for the information if the case is
remanded for further judicial proceedings. Similarly, an investigation
of an apparently new health hazard may produce uncertain results.
Before completely closing out this investigation, it may be appropriate
to await the outcome of an ongoing research study or parallel
investigation elsewhere in the country. In these cases, Sec.
1913.10(j) provides that the medical information should be transferred
to the MRO. Also, under Sec. 1913.10(l)(2), the MRO must conduct an
annual review of all centrally-held information to determine which
information is no longer needed for the purposes for which it was
obtained. These requirements apply equally to personally identifiable
employee medical information stored in electronic form.
Paragraph (n)(7)(iii) of the final rules states that when no longer
needed, the Principal OSHA Investigator shall ensure that all
personally identifiable employee medical information on electric files
has been deleted, destroyed, or returned to the original record holder.
The requirement in paragraph (n)(7)(iii) is intended to ensure that the
Principal OSHA Investigator is responsible for OSHA access and use of
electronic medical information from beginning to end. When no longer
needed, the Principal OSHA Investigator must make sure that authorized
OSHA personnel follow proper procedures for the deletion, destruction
and disposal of personally identifiable employee medical information.
In practice, the Principal OSHA Investigator must ensure that media
containing employee medical information is sanitized or destroyed
before disposal or release for reuse in accordance with approved
methods. In addition, if electronic medical records are returned to the
original record holder, the Principal OSHA Investigator must ensure
that all data is returned, and no data remains in the possession of
OSHA personnel.
Paragraph (n)(7)(iv) states that the disposal of personally
identifiable employee medical information maintained in electronic form
shall be accomplished in such a manner as to make the data unattainable
by unauthorized personnel. When no longer needed, electronic media must
be handled and sanitized appropriately to prevent unauthorized
disclosure or modification of personally identifiable employee medical
information.
OSHA personnel use several types of electronic media to access,
use, and maintain personally identifiable employee medical information,
including hard drives, laptops, USB storage drives (e.g., thumb
drives), CDs, DVDs, and digital storage cards such as camera cards. In
order to meet the requirement in paragraph (n)(7)(iv), and depending on
the type of electronic media used, OSHA personnel may need to re-use,
recycle, or destroy the electronic media containing medical
information. Also, when employee medical information in electronic form
is no longer needed, it is important to ensure that deleted data is not
easily recoverable. Residual data may allow unauthorized individuals to
reconstruct data and thereby gain access to personally identifiable
employee medical information. Sanitization is one method that can be
used to ensure that deleted data cannot be reconstructed.
Sanitization is the general process of removing data from storage
media, such that there is reasonable assurance that the data may not be
easily retrieved and reconstructed. There are different types of
sanitization for each type of media, including cleaning, purging, and
destroying. Cleaning is the removal of data from devices in such a way
that there is assurance that the data cannot be reconstructed using
normal system functions or software file/data recovery utilities. For
example, cleaning may include using software or hardware products to
overwhelm media with non-sensitive data. Purging is generally done
before releasing media beyond control, such as before discarding old
media, and includes degaussing or exposing media to a strong magnetic
field in order to disrupt recorded magnetic domains. Destruction of
media is the ultimate form of sanitization.
In some cases, OSHA personnel maintain employee medical information
on media that may not be able to be reused such as computer disks and
camera cards. In these situations, when no longer needed, electronic
media containing personally identifiable employee medical information
should be disposed of using approved secure data destruction. Several
methods exist to dispose of electronic media containing medical
information. For example, computer disks can be rendered unusable by
shredding, incinerating, or pulverizing. Many OSHA Regional and Area
Offices already have equipment that can shred or burn disks. Other
offices contract with private companies to perform this task in a
secure manner. As a reminder, in order to address security and privacy
concerns, disposal operations should be conducted in accordance with
approved DOL or OSHA methods. In addition, OSHA is responsible for the
management of records pursuant to the Federal Records Act of 1950, as
amended (44 U.S.C. Chapters 21, 29, 31, 33). The retention and
destruction of Federal records must be conducted in accordance with the
procedures described in the Federal Records Act.
Finally, in the future, OSHA personnel will be using media types
not specifically mentioned in this preamble. The processes mentioned in
this document should guide media sanitization and disposal decisions
regardless of the type of media in use. In the future, OSHA will issue
guidance to agency staff as new technology is developed.
IV. State Plans
The 28 states and U.S. territories with their own OSHA-approved
occupational safety and health plans are encouraged, but not required,
to adopt these rules of agency practice and procedure concerning
employee medical record access that Federal OSHA is promulgating to 29
CFR 1913.10 in this final rule. The states and U.S. territories with
OSHA-approved occupational safety and health plans covering private
employees and state and local government employees are Alaska, Arizona,
California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan,
Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico,
South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, and
Wyoming. In addition, six states and U.S. territories have OSHA-
approved state Plans that apply to state and local government employees
only: Connecticut, Illinois,
[[Page 45791]]
Maine, New Jersey, New York, and the Virgin Islands.
This final rule describes a Federal program change for which State
Plan adoption is not required. However, State Plans are required to
have standards, and an enforcement program, that are ``at least as
effective in providing safe and healthful employment'' as those of
Federal OSHA. In order to be ``at least as effective'' as Federal OSHA,
a State Plan must appropriately utilize its authority for access to
medical records, and must have effective procedures to assure that the
privacy of those records is protected in a manner consistent with
applicable state and federal privacy laws. Therefore, although adoption
of this rule is not required, State Plans must have procedures covering
this issue that are at least as effective as those of Federal OSHA and
are encouraged to adopt requirements comparable to those in 29 CFR
1913.10.
Within 60 days of the effective date of this final rule, a State
Plan must submit a notice of intent indicating whether they already
have a similar policy in place, intend to adopt new policies and
procedures, or do not intend to adopt this final rule. If a State Plan
does not adopt at first, but at some later point decides to adopt this
final rule or an at least as effective version of this final rule, the
State Plan must notify OSHA of this change in intent. Within 60 days of
adoption, the State Plan must provide an electronic copy of the
regulation or policy, or a link to where their policy is posted on the
State Plan's website. The State Plan must also provide the date of
adoption and identify differences, if any, between their policy and
this final rule. OSHA will provide summary information on the State
Plan responses to this instruction on its website at: www.osha.gov/dcsp/osp/index.html.
V. Regulatory Flexibility Certification
The notice and comment procedures of section 553 of the APA do not
apply ``to interpretative rules, general statements of policy, or rules
of agency organization, procedure, or practice.'' 5 U.S.C. 553(b)(A).
Rules that are exempt from APA notice and comment requirements are also
exempt from the Regulatory Flexibility Act (RFA). See SBA Office of
Advocacy, A Guide for Government Agencies: How to Comply with the
Regulatory Flexibility Act (August 2017); also found at http://www.sba.gov/sites/default/files/rfaguide5F05125F0.pdf. This is a rule
of agency procedure, practice, and interpretation within the meaning of
that section; and therefore, is exempt from both the notice and comment
rulemaking procedures of the APA and the requirements of the RFA.
VI. Environmental Impact Analysis
In accordance with the requirements of the National Environmental
Policy Act (NEPA) (42 U.S.C. 4231 et seq.), Council on Environmental
Quality NEPA regulations (40 CFR parts 1500 through 1518), and the
Department of Labor NEPA regulations (29 CFR part 11), OSHA has
determined that this final rule will not have a significant impact on
the external environment.
VII. Federalism
OSHA reviewed this final rule in accordance with the most recent
Executive order on federalism (Executive Order 13132, 64 FR 43255,
August 10, 1999). This Executive order requires Federal agencies, to
the extent possible, to refrain from limiting state policy options,
consult with states prior to taking any action that would restrict
state policy options, and take such actions only when clear
constitutional authority exists and the problem is national in scope.
This rule does not have ``federalism implications.'' The rule does
not have ``substantial direct effects on the States, on the
relationship between the National Government and the States, or on the
distribution of power and responsibilities among the various levels of
government'' and therefore is not subject to Executive Order 13132
(Federalism).
VIII. Unfunded Mandates
The Department has concluded that this rule is not a ``significant
regulatory action'' within the meaning of Executive Order 12866,
reaffirmed by Executive Order 13563, because it is not likely to (1)
have an annual effect on the economy of $100 million or more or
adversely affect in a material way the economy, a sector of the
economy, productivity, competition, jobs, the environment, public
health or safety, or state, local, or Tribal governments or
communities; (2) create a serious inconsistency or otherwise interfere
with an action taken or planned by another agency; (3) materially alter
the budgetary impact of entitlements, grants, user fees, or loan
programs or the rights and obligations of recipients thereof; or (4)
raise novel legal or policy issues arising out of legal mandates, the
President's priorities, or the principles set forth in Executive Order
12866. Therefore, no economic impact analysis under section 6(a)(3)(C)
of Executive Order 12866 has been prepared. For the same reason, and
because no notice of proposed rulemaking was published, no statement is
required under section 202 of the Unfunded Mandates Reform Act of 1995,
2 U.S.C. 1532. In any event, this rulemaking is procedural and
interpretive in nature and is thus not expected to have a significant
economic impact.
IX. Consultation and Coordination With Indian Tribal Governments
OSHA reviewed this rule in accordance with Executive Order 13175
(65 FR 67249, November 6, 2000) and determined that it does not have
``tribal implications'' as defined in that order. The rule does not
have substantial direct effects on one or more Indian tribes, on the
relationship between the Federal Government and Indian tribes, or on
the distribution of power and responsibilities between the Federal
Government and Indian tribes.
X. Office of Management and Budget Review Under the Paperwork Reduction
Act of 1995
The Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.)
and OMB regulations (5 CFR part 1320) require agencies to obtain
approval from OMB before conducting any collection of information. The
PRA defines a ``collection of information'' as ``the obtaining, causing
to be obtained, soliciting, or requiring the disclosure to third
parties or the public of facts or opinions by or for an agency
regardless of form or format'' (44 U.S.C. 3502(3)(A)). The PRA does not
apply to this final rule because it amends existing internal agency
procedures and does not impose any new recordkeeping or information
collection requirements that require OMB approval.
Authority and Signature
This document was prepared under the direction of Loren Sweatt,
Principal Deputy Assistant Secretary for Occupational Safety and
Health. It is issued under Section 8 of the Occupational Safety and
Health Act (29 U.S.C. 657), 5 U.S.C. 553, 5 U.S.C. 552a(e), 5 U.S.C.
301, and Secretary of Labor's Order No. 5-2012 (77 FR 3912).
Signed at Washington, DC, on July 14, 2020.
Loren Sweatt,
Principal Deputy Assistant Secretary of Labor for Occupational Safety
and Health.
Final Rule
Part 1913 of title 29 of the Code of Federal Regulations is hereby
amended as follows:
[[Page 45792]]
PART 1913--[AMENDED]
0
1. The authority citation for part 1913 is revised to read as follows:
Authority: 29 U.S.C. 657; 5 U.S.C. 553; 5 U.S.C. 301; Secretary
of Labor's Order No. 8-76 (41 FR 25059), 5-2002 (67 FR 65008), or 1-
2012 (77 FR 3912) as applicable.
0
2. Amend Sec. 1913.10 by:
0
a. Revising paragraphs (b)(6), (c)(1) and (2), and (d)(1) and (2);
0
b. Removing and reserving paragraph (g);
0
c. Revising paragraph (m); and
0
d. Adding paragraph (n).
The revisions and addition read as follows:
Sec. 1913.10 Rules of agency practice and procedure concerning OSHA
access to employee medical records.
* * * * *
(b) * * *
(6) This section does not apply where a written directive by the
OSHA Medical Records Officer authorizes appropriately qualified
personnel to conduct limited reviews of specific medical information
mandated by an occupational safety and health standard, or of specific
biological monitoring test results.
* * * * *
(c) * * *
(1) Assistant Secretary. The Assistant Secretary of Labor for
Occupational Safety and Health (Assistant Secretary) shall designate an
OSHA official with experience or training in the evaluation, use, and
privacy protection of medical records to be the OSHA Medical Records
Officer. The Assistant Secretary may change the designation of the OSHA
Medical Records Officer at will.
(2) OSHA Medical Records Officer. The OSHA Medical Records Officer
shall be responsible for the overall administration and implementation
of the procedures contained in this section. The OSHA Medical Records
Officer shall report directly to the Assistant Secretary on matters
concerning this section and be responsible for:
(i) Making final determinations concerning the approval or denial
of medical access orders (paragraph (d) of this section);
(ii) Assuring that medical access orders meet the requirements of
paragraphs (d)(2) and (3) of this section;
(iii) Responding to objections concerning medical access orders
(paragraph (f) of this section);
(iv) Overseeing internal agency use and security of personally
identifiable employee medical information (paragraphs (g) through (j)
of this section);
(v) Assuring that the results of agency analyses of personally
identifiable medical information are, where appropriate, communicated
to employees (paragraph (k) of this section);
(vi) Preparing an annual report of OSHA's experience under this
section (paragraph (l) of this section); and
(vii) Making final determinations concerning inter-agency transfer
or public disclosure of personally identifiable employee medical
information (paragraph (m) of this section). The Medical Records
Officer shall also assure that advance notice is given of intended
inter-agency transfers or public disclosures.
* * * * *
(d) * * *
(1) Requirement for medical access order. Except as provided in
paragraph (d)(4) of this section, each request by an OSHA
representative to examine or copy personally identifiable employee
medical information contained in a record held by an employer or other
recordholder shall be made pursuant to a written medical access order
which has been approved by the OSHA Medical Records Officer. A medical
access order does not constitute an administrative subpoena.
(2) Approval criteria for medical access order. Before approving a
medical access order, the OSHA Medical Records Officer shall determine
that:
(i) The medical information to be examined or copied is relevant to
a statutory purpose and there is a need to gain access to this
personally identifiable information;
(ii) The personally identifiable medical information to be examined
or copied is limited to only that information needed to accomplish the
purpose for access; and
(iii) The personnel authorized to review and analyze the personally
identifiable medical information are limited to those who have a need
for access and have appropriate professional qualifications.
* * * * *
(m) Inter-agency transfer and public disclosure. (1) Personally
identifiable employee medical information shall not be transferred to
another agency or office outside of OSHA (other than to the Office of
the Solicitor of Labor) or disclosed to the public (other than to the
affected employee or the original recordholder) except when required by
law or when approved by the OSHA Medical Records Officer.
(2) Except as provided in paragraph (m)(3) of this section, the
OSHA Medical Records Officer shall not approve a request for an inter-
agency transfer of personally identifiable employee medical
information, which has not been consented to by the affected employees,
unless the request is by a public health agency which:
(i) Needs the requested information in a personally identifiable
form for a substantial public health purpose;
(ii) Will not use the requested information to make individual
determinations concerning affected employees which could be to their
detriment;
(iii) Has regulations or established written procedures providing
protection for personally identifiable medical information
substantially equivalent to that of this section; and
(iv) Satisfies an exemption to the Privacy Act to the extent that
the Privacy Act applies to the requested information (see 5 U.S.C.
552a(b); 29 CFR 70a.3).
(3) Upon the approval of the OSHA Medical Records Officer,
personally identifiable employee medical information may be transferred
to:
(i) The National Institute for Occupational Safety and Health
(NIOSH); and
(ii) The Department of Justice when necessary with respect to a
specific action under the Occupational Safety and Health Act.
(4) The OSHA Medical Records Officer shall not approve a request
for public disclosure of employee medical information containing direct
personal identifiers unless there are compelling circumstances
affecting the health or safety of an individual.
(5) The OSHA Medical Records Officer shall not approve a request
for public disclosure of employee medical information which contains
information which could reasonably be used indirectly to identify
specific employees when the disclosure would constitute a clearly
unwarranted invasion of personal privacy (see 5 U.S.C. 552(b)(6); 29
CFR 70.26).
(6) Except as to inter-agency transfers to NIOSH or the Department
of Justice, the OSHA Medical Records Officer shall ensure that advance
notice is provided to any collective bargaining agent representing
affected employees and to the employer on each occasion that OSHA
intends to either transfer personally identifiable employee medical
information to another agency or disclose it to a member of the public
other than to an affected employee. When feasible, the OSHA Medical
Records Officer shall take reasonable steps to assure that advance
notice is provided to affected employees when
[[Page 45793]]
the employee medical information to be transferred or disclosed
contains direct personal identifiers.
(n) Medical records maintained in electronic form. (1) In general,
when accessing and/or copying personally identifiable employee medical
information in electronic form, OSHA personnel shall follow all of the
requirements set forth in this section.
(2) When personally identifiable employee medical information in
electronic form is taken off-site, the Principal OSHA Investigator is
primarily responsible for ensuring that such information is properly
used and kept secured.
(i) The Principal OSHA Investigator is responsible for preventing
any accidental or unintentional disclosure of, modification to, or
destruction of personally identifiable employee medical information in
electronic form.
(ii) The Principal OSHA Investigator is responsible for controlling
the flow of data into, through, and from agency computer operations.
(iii) The Principal OSHA Investigator shall ensure the distribution
and review of medical information in electronic form is limited to only
those OSHA personnel and contractors with a need for access.
(3) The transfer and/or duplication of medical information in
electronic form shall be kept to the minimum necessary to accomplish
the purpose for which it was obtained.
(4) Electronic files containing personally identifiable employee
medical information shall be downloaded only to a computer hard drive
or laptop that is secured in accordance with Federal Information
Processing Standard (FIPS) 201-2 ``Personal Identity Verification (PIV)
of Federal Employees and Contractors'' and ``Homeland Security
Presidential Directive 12: Policy for a Common Identification Standard
for Federal Employees and Contractors (HSPD-12).''
(5) Electronic files containing personally identifiable employee
medical information shall not be transferred to authorized personnel
through email attachment unless appropriately encrypted.
(6) When an employer or other record holder(s) provides access to
employee medical information through a properly encrypted email
attachment, the attachment shall be downloaded to a secured hard drive
or laptop. After the attachment is downloaded, the email shall be
permanently deleted.
(7) Personally identifiable employee medical information in
electronic form shall be secured when not in use.
(i) Medical information in electronic form shall only be maintained
or stored where facilities and conditions are designed to prevent
unauthorized access.
(ii) Personally identifiable employee medical information in
electronic form shall be maintained only for so long as needed to
accomplish the purpose for access.
(iii) When no longer needed, the Principal OSHA Investigator shall
ensure that all personally identifiable employee medical information on
electronic files has been deleted, destroyed, or returned to the
original record holder.
(iv) The disposal of personally identifiable employee medical
information maintained in electronic form shall be accomplished in such
a manner as to make the data unattainable by unauthorized personnel.
[FR Doc. 2020-15562 Filed 7-29-20; 8:45 am]
BILLING CODE 4510-26-P